CVE-2018-0001 Junos: Unauthenticated Remote Code Execution through J-Web interface

A remote, unauthenticated attacker may be able to execute code by exploiting a use-after-free defect found in older versions of PHP through injection of crafted data via specific PHP URLs within the context of the J-Web process. Affected releases are Juniper Networks Junos OS: 12.1X46 versions...

CVE-2018-0011 Junos Space: Reflected XSS vulnerability in Junos Space management interface

A reflected cross site scripting XSS vulnerability in Junos Space may potentially allow a remote authenticated user to inject web script or HTML and steal sensitive data and credentials from a session, and to perform administrative actions on the Junos Space network management device...

PT-2018-1108

Name of the Vulnerable Software and Affected Versions Junos OS versions prior to 12.1X46-D50 Junos OS versions prior to 12.3X48-D30 Junos OS versions prior to 12.3R12-S7 Junos OS versions prior to 14.1R8-S4 Junos OS versions prior to 14.1R9 Junos OS versions prior to 14.1X53-D30 Junos OS versions...

PT-2018-8558

Name of the Vulnerable Software and Affected Versions: Junos OS versions prior to 14.1X53-D40 Junos OS versions prior to 15.1X53-D55 Junos OS versions prior to 15.1R7 Description: A issue in QFX and EX Series switches configured to drop traffic when the MAC move limit is exceeded can cause the...

CVE-2018-0007: Improper Neutralization of Special Elements used in a Command

An unauthenticated network-based attacker able to send a maliciously crafted LLDP packet to the local segment, through a local segment broadcast, may be able to cause a Junos device to enter an improper boundary check condition allowing a memory corruption to occur, leading to a denial of service...

CVE-2018-0002: Improper Restriction of Operations within the Bounds of a Memory Buffer

On SRX Series and MX Series devices with a Service PIC with any ALG enabled, a crafted TCP/IP response packet processed through the device results in memory corruption leading to a flowd daemon crash. Sustained crafted response packets lead to repeated crashes of the flowd daemon which results in...

CVE-2018-0004: Uncontrolled Resource Consumption

A sustained sequence of different types of normal transit traffic can trigger a high CPU consumption denial of service condition in the Junos OS register and schedule software interrupt handler subsystem when a specific command is issued to the device. This affects one or more threads and...

CVE-2018-0011: Improper Neutralization of Input During Web Page Generation

A reflected cross site scripting XSS vulnerability in Junos Space may potentially allow a remote authenticated user to inject web script or HTML and steal sensitive data and credentials from a session, and to perform administrative actions on the Junos Space network management device...

CVE-2018-0010: Improper Privilege Management

A vulnerability in the Juniper Networks Junos Space Security Director allows a user who does not have SSH access to a device to reuse the URL that was created for another user to perform SSH access. Affected releases are all versions of Junos Space Security Director prior to 17.2R1...

CVE-2018-0009: Undefined Security Weakness

On Juniper Networks SRX series devices, firewall rules configured to match custom application UUIDs starting with zeros can match all TCP traffic. Due to this issue, traffic that should have been blocked by other rules is permitted to flow through the device resulting in a firewall bypass...

CVE-2018-0008: Improper Authentication

An unauthenticated root login may allow upon reboot when a commit script is used. A commit script allows a device administrator to execute certain instructions during commit, which is configured under the system scripts commit stanza. Certain commit scripts that work without a problem during norm...

PT-2018-1041

Name of the Vulnerable Software and Affected Versions Juniper Networks Junos OS versions prior to 12.1X46-D71 Juniper Networks Junos OS versions prior to 12.3R12-S7 Juniper Networks Junos OS versions prior to 12.3X48-D55 Juniper Networks Junos OS versions prior to 14.1R8-S5 Juniper Networks Junos...

PT-2018-8564

Name of the Vulnerable Software and Affected Versions: Junos Space Network Management Platform affected versions not specified Description: A local file inclusion issue may allow an authenticated user to retrieve files from the system. Recommendations: At the moment, there is no information about...

PT-2018-8559

Name of the Vulnerable Software and Affected Versions: Junos OS versions prior to 15.1R6-S2, 15.1R7 Junos OS versions prior to 16.1R5-S1, 16.1R6 Junos OS versions prior to 16.2R2-S2, 16.2R3 Junos OS versions prior to 17.1R2-S5, 17.1R3 Junos OS versions prior to 17.2R2 Description: A high rate of...

PT-2018-8556

Name of the Vulnerable Software and Affected Versions: Junos OS versions prior to 12.1X46-D60 on SRX series Junos OS versions prior to 12.3X48-D35 on SRX series Junos OS versions prior to 14.1R9 on MX series Junos OS versions prior to 14.2R8 on MX series Junos OS versions prior to 15.1X49-D60 on...

PT-2018-8563

Name of the Vulnerable Software and Affected Versions: Junos Space affected versions not specified Description: A privilege escalation issue may allow a local authenticated attacker to gain root privileges. Recommendations: At the moment, there is no information about a newer version that contain...

PT-2018-8557

Name of the Vulnerable Software and Affected Versions: Junos OS versions prior to 12.1X46-D71 Junos OS versions prior to 12.3R12-S7 Junos OS versions prior to 12.3X48-D55 Junos OS versions prior to 14.1R8-S5 Junos OS versions prior to 14.1R9 Junos OS versions prior to 14.1X53-D45 Junos OS version...

CVE-2018-0003: Undefined Security Weakness

A specially crafted MPLS packet received or processed by the system, on an interface configured with MPLS, will store information in the system memory. Subsequently, if this stored information is accessed, this may result in a kernel crash leading to a denial of service. Affected releases are...

CVE-2018-0005: Improper Check for Unusual or Exceptional Conditions

QFX and EX Series switches configured to drop traffic when the MAC move limit is exceeded will forward traffic instead of dropping traffic. This can lead to denials of services or other unintended conditions. Affected releases are Juniper Networks Junos OS: 14.1X53 versions prior to 14.1X53-D40;...

CVE-2018-0012: Undefined Security Weakness

Junos Space is affected by a privilege escalation vulnerability that may allow a local authenticated attacker to gain root privileges...