CVE-2021-31372: Improper Input Validation

An Improper Input Validation vulnerability in J-Web of Juniper Networks Junos OS allows a locally authenticated J-Web attacker to escalate their privileges to root over the target device. This issue affects: Juniper Networks Junos OS All versions prior to 18.3R3-S5; 18.4 versions prior to...

CVE-2021-31368: Uncontrolled Resource Consumption

An Uncontrolled Resource Consumption vulnerability in the kernel of Juniper Networks JUNOS OS allows an unauthenticated network based attacker to cause 100% CPU load and the device to become unresponsive by sending a flood of traffic to the out-of-band management ethernet port. Continued receipte...

CVE-2021-31367: Missing Release of Memory after Effective Lifetime

A Missing Release of Memory after Effective Lifetime vulnerability in the Packet Forwarding Engine PFE of Juniper Networks Junos OS on PTX Series allows an adjacent attacker to cause a Denial of Service DoS by sending genuine BGP flowspec packets which cause an FPC heap memory leak. Once having r...

CVE-2021-31366: Unchecked Return Value

An Unchecked Return Value vulnerability in the authd authentication daemon of Juniper Networks Junos OS on MX Series configured for subscriber management / BBE allows an adjacent attacker to cause a crash by sending a specific username. This impacts authentication, authorization, and accounting A...

CVE-2021-31356: Improper Neutralization of Special Elements used in a Command

A command injection vulnerability in command processing on Juniper Networks Junos OS Evolved allows an attacker with authenticated CLI access to be able to bypass configured access protections to execute arbitrary shell commands within the context of the current user. The vulnerability allows an...

CVE-2021-31355: Improper Neutralization of Input During Web Page Generation

A persistent cross-site scripting XSS vulnerability in the captive portal graphical user interface of Juniper Networks Junos OS may allow a remote authenticated user to inject web script or HTML and steal sensitive data and credentials from a web administration session, possibly tricking a...

CVE-2021-0298: Concurrent Execution using Shared Resource with Improper Synchronization

A Race Condition in the 'show chassis pic' command in Juniper Networks Junos OS Evolved may allow an attacker to crash the port interface concentrator daemon picd process on the FPC, if the command is executed coincident with other system events outside the attacker's control, leading to a Denial...

CVE-2021-31386: Missing Encryption of Sensitive Data

A Protection Mechanism Failure vulnerability in the J-Web HTTP service of Juniper Networks Junos OS allows a remote unauthenticated attacker to perform Person-in-the-Middle PitM attacks against the device. This issue affects: Juniper Networks Junos OS 12.3 versions prior to 12.3R12-S20; 15.1...

CVE-2021-31385: Improper Limitation of a Pathname to a Restricted Directory

An Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in J-Web of Juniper Networks Junos OS allows any low-privileged authenticated attacker to elevate their privileges to root. This issue affects: Juniper Networks Junos OS 12.3 versions prior to 12.3R12-S1...

CVE-2021-31379: Incorrect Behavior Order

An Incorrect Behavior Order vulnerability in the MAP-E automatic tunneling mechanism of Juniper Networks Junos OS allows an attacker to send certain malformed IPv4 or IPv6 packets to cause a Denial of Service DoS to the PFE on the device which is disabled as a result of the processing of these...

CVE-2021-31378: Missing Release of Resource after Effective Lifetime

In broadband environments, including but not limited to Enhanced Subscriber Management, CHAP, PPP, DHCP, etc., on Juniper Networks Junos OS devices where RADIUS servers are configured for managing subscriber access and a subscriber is logged in and then requests to logout, the subscriber may be...

CVE-2021-31376: Improper Input Validation

An Improper Input Validation vulnerability in Packet Forwarding Engine manager FXPC process of Juniper Networks Junos OS allows an attacker to cause a Denial of Service DoS by sending specific DHCPv6 packets to the device and crashing the FXPC service. Continued receipt and processing of this...

CVE-2021-31369: Allocation of Resources Without Limits or Throttling

On MX Series platforms with MS-MPC/MS-MIC, an Allocation of Resources Without Limits or Throttling vulnerability in Juniper Networks Junos OS allows an unauthenticated network attacker to cause a partial Denial of Service DoS with a high rate of specific traffic. If a Class of Service CoS rule is...

CVE-2021-31359: Improper Privilege Management

A local privilege escalation vulnerability in Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privileged user to cause the Juniper DHCP daemon jdhcpd process to crash, resulting in a Denial of Service DoS, or execute arbitrary commands as root. Continued processing of malicious...

CVE-2021-31353: Improper Handling of Exceptional Conditions

An Improper Handling of Exceptional Conditions vulnerability in Juniper Networks Junos OS and Junos OS Evolved allows an attacker to inject a specific BGP update, causing the routing protocol daemon RPD to crash and restart, leading to a Denial of Service DoS. Continued receipt and processing of...

CVE-2021-31370: Incomplete List of Disallowed Inputs

An Incomplete List of Disallowed Inputs vulnerability in Packet Forwarding Engine PFE of Juniper Networks Junos OS on QFX5000 Series and EX4600 Series allows an adjacent unauthenticated attacker which sends a high rate of specific multicast traffic to cause control traffic received from the netwo...

PT-2021-19263

Name of the Vulnerable Software and Affected Versions Juniper Networks Junos OS SRX300 Series, SRX500 Series, SRX1500, and SRX5000 Series with SPC2 versions prior to 17.4R3-S5 Juniper Networks Junos OS SRX300 Series, SRX500 Series, SRX1500, and SRX5000 Series with SPC2 18.3 versions prior to...

PT-2021-19254

Name of the Vulnerable Software and Affected Versions Juniper Networks Junos OS versions prior to 19.2R3-S3 Juniper Networks Junos OS versions 19.3 prior to 19.3R3-S3 Juniper Networks Junos OS versions 20.1 prior to 20.1R2-S2, 20.1R3-S1 Juniper Networks Junos OS versions 20.2 prior to 20.2R3-S2...

Juniper Networks Junos OS Access Control Error Vulnerability

Juniper Networks Junos OS is a network operating system from Juniper Networks, Inc. for the company's hardware devices. The operating system provides a secure programming interface and the Junos SDK. Juniper Networks Junos OS is vulnerable to an access control error, which results from a specific...

Vulnerabilities fixed in Juniper Junos OS

Vulnerabilities have been fixed in Juniper Junos OS. The vulnerabilities allow a malicious party to carry out attacks execute attacks that result in the following categories of damage: Cross-Site Scripting XSS. Denial-of-Service DoS. Remote code execution User Rights Increased user rights Juniper...