Input validation

An Improper Validation of Specified Type of Input vulnerability in the routing protocol daemon rpd of Juniper Networks Junos OS allows an attacker to cause an RPD memory leak leading to a Denial of Service DoS. This memory leak only occurs when the attacker's packets are destined to any configure...

Memory corruption

An Improper Control of a Resource Through its Lifetime vulnerability in the Packet Forwarding Engine PFE of Juniper Networks Junos OS on MX Series allows an unauthenticated adjacent attacker to cause a Denial of Service DoS. When there is a continuous mac move a memory corruption causes one or mo...

Null pointer dereference

An Access of Uninitialized Pointer vulnerability in SIP Application Layer Gateway ALG of Juniper Networks Junos OS on SRX Series and MX Series allows an unauthenticated, network-based attacker to cause a Denial of Service DoS. When specific valid SIP packets are received the PFE will crash and...

Path traversal

A Path Traversal vulnerability in the J-Web component of Juniper Networks Junos OS allows an authenticated attacker to upload arbitrary files to the device by bypassing validation checks built into Junos OS. The attacker should not be able to execute the file due to validation checks built into...

Design/Logic Flaw

An Improper Preservation of Consistency Between Independent Representations of Shared State vulnerability in the Packet Forwarding Engine PFE of Juniper Networks Junos OS allows a locally authenticated attacker with low privileges to cause a Denial of Service DoS. If the device is very busy for...

Design/Logic Flaw

A PHP Local File Inclusion LFI vulnerability in the J-Web component of Juniper Networks Junos OS may allow a low-privileged authenticated attacker to execute an untrusted PHP file. By chaining this vulnerability with other unspecified vulnerabilities, and by circumventing existing attack...

CVE-2022-22251 cSRX Series: Storing Passwords in a Recoverable Format and software permissions issues allows a local attacker to elevate privileges

On cSRX Series devices software permission issues in the container filesystem and stored files combined with storing passwords in a recoverable format in Juniper Networks Junos OS allows a local, low-privileged attacker to elevate their permissions to take control of any instance of a cSRX softwa...

CVE-2022-22251 cSRX Series: Storing Passwords in a Recoverable Format and software permissions issues allows a local attacker to elevate privileges

On cSRX Series devices software permission issues in the container filesystem and stored files combined with storing passwords in a recoverable format in Juniper Networks Junos OS allows a local, low-privileged attacker to elevate their permissions to take control of any instance of a cSRX softwa...

CVE-2022-22251

Summary: CVE-2022-22251 affects Juniper Networks Junos OS on cSRX Series. The root cause is software permission issues in the container filesystem and stored files, combined with storing passwords in a recoverable format, enabling a local, low-privileged attacker to elevate privileges and take co...

CVE-2022-22250

CVE-2022-22250 affects Juniper Networks Junos OS and Junos OS Evolved PFE. An improper control of a resource through its lifetime allows an unauthenticated adjacent attacker to cause a DoS via memory corruption when EVPN-MPLS MAC learned locally is deleted as remotely learned, potentially causing...

CVE-2022-22249

The CVE-2022-22249 issue affects Juniper Networks Junos OS on MX Series, specifically in the Packet Forwarding Engine (PFE). A continuous MAC move can trigger a memory corruption that causes one or more FPCs to crash and reboot, leading to a Denial of Service. Affected versions include all before...

CVE-2022-22248 Junos OS Evolved: Incorrect file permissions can allow low-privileged user to cause another user to execute arbitrary commands

An Incorrect Permission Assignment vulnerability in shell processing of Juniper Networks Junos OS Evolved allows a low-privileged local user to modify the contents of a configuration file which could cause another user to execute arbitrary commands within the context of the follow-on user's...

CVE-2022-22248

CVE-2022-22248 affects Juniper Networks Junos OS Evolved. Attackers with Junos CLI access can trigger an Incorrect Permission Assignment vulnerability in shell processing, enabling a low-privileged local user to modify a configuration file and cause another user to execute arbitrary commands, pot...

CVE-2022-22247

CVE-2022-22247 affects Juniper Networks Junos OS Evolved. The issue is an improper input validation vulnerability in the processing of ingress TCP segments, allowing a network-based unauthenticated attacker to send a crafted TCP segment that triggers a kernel panic and leads to a Denial of Servic...

CVE-2022-22247 Junos OS Evolved: Kernel processing of unvalidated TCP segments could lead to a Denial of Service (DoS)

An Improper Input Validation vulnerability in ingress TCP segment processing of Juniper Networks Junos OS Evolved allows a network-based unauthenticated attacker to send a crafted TCP segment to the device, triggering a kernel panic, leading to a Denial of Service DoS condition. Continued receipt...

CVE-2022-22246 Junos OS: PHP file inclusion vulnerability in J-Web

A PHP Local File Inclusion LFI vulnerability in the J-Web component of Juniper Networks Junos OS may allow a low-privileged authenticated attacker to execute an untrusted PHP file. By chaining this vulnerability with other unspecified vulnerabilities, and by circumventing existing attack...

CVE-2022-22246

CVE-2022-22246 is a PHP Local File Inclusion vulnerability in the J-Web component of Juniper Networks Junos OS. A low-privileged authenticated attacker could include and execute an untrusted PHP file stored on the server, potentially leading to a complete system compromise when chained with other...

CVE-2022-22245 Junos OS: Path traversal vulnerability in J-Web

A Path Traversal vulnerability in the J-Web component of Juniper Networks Junos OS allows an authenticated attacker to upload arbitrary files to the device by bypassing validation checks built into Junos OS. The attacker should not be able to execute the file due to validation checks built into...

CVE-2022-22245

CVE-2022-22245 is a path traversal flaw in the J-Web component of Juniper Networks Junos OS that allows an authenticated, remote attacker to upload arbitrary files by bypassing validation, potentially compromising filesystem integrity. Affected versions range up to the listed fixed releases (e.g....

CVE-2022-22244 Junos OS: Unauthenticated XPath Injection vulnerability in J-Web

An XPath Injection vulnerability in the J-Web component of Juniper Networks Junos OS allows an unauthenticated attacker sending a crafted POST to reach the XPath channel, which may allow chaining to other unspecified vulnerabilities, leading to a partial loss of confidentiality. This issue affect...