CVE-2022-22194 Junos OS Evolved: PTX series: An attacker sending a crafted GRE packet will cause the PFE to restart

An Improper Check for Unusual or Exceptional Conditions vulnerability in the packetIO daemon of Juniper Networks Junos OS Evolved on PTX10003, PTX10004, and PTX10008 allows an unauthenticated, network-based attacker to cause a Denial of Service DoS. Continued receipt of these crafted packets will...

CVE-2022-22193 Junos OS and Junos OS Evolved: In a BGP rib-sharding scenario when a certain CLI command is executed the rpd process might crash

An Improper Handling of Unexpected Data Type vulnerability in the Routing Protocol Daemon rpd of Juniper Networks Junos OS and Junos OS Evolved allows a locally authenticated attacker with low privileges to cause a Denial of Service DoS. Continued execution of this command might cause a sustained...

CVE-2022-22193

CVE-2022-22193 affects Juniper Networks Junos OS and Junos OS Evolved. A local, low-privilege attacker can trigger an Improper Handling of Unexpected Data Type in the Routing Protocol Daemon (rpd), potentially causing a DoS. In a BGP rib-sharding scenario, executing a specific CLI command may cra...

CVE-2022-22191

CVE-2022-22191 describes a DoS in Juniper Junos OS on EX4300 switches caused by processing a flood of specific ARP traffic from the local broadcast domain. The vulnerability allows an unauthenticated network-adjacent attacker to trigger a PFEMAN watchdog timeout, causing the Packet Forwarding Eng...

CVE-2022-22191 Junos OS: EX4300: PFE Denial of Service (DoS) upon receipt of a flood of specific ARP traffic

A Denial of Service DoS vulnerability in the processing of a flood of specific ARP traffic in Juniper Networks Junos OS on the EX4300 switch, sent from the local broadcast domain, may allow an unauthenticated network-adjacent attacker to trigger a PFEMAN watchdog timeout, causing the Packet...

CVE-2022-22190 Paragon Active Assurance Control Center: Information disclosure vulnerability in crafted URL

An Improper Access Control vulnerability in the Juniper Networks Paragon Active Assurance Control Center allows an unauthenticated attacker to leverage a crafted URL to generate PDF reports, potentially containing sensitive configuration information. A feature was introduced in version 3.1 of the...

CVE-2022-22190

CVE-2022-22190 describes an information-disclosure vulnerability in Juniper Networks Paragon Active Assurance Control Center v3.1.0. An unauthenticated attacker can craft a URL to generate PDF reports that may reveal sensitive configuration data, by exploiting a feature that shares account data v...

CVE-2022-22189 Contrail Service Orchestration: An authenticated local user may have their permissions elevated via the device via management interface without authentication

An Incorrect Ownership Assignment vulnerability in Juniper Networks Contrail Service Orchestration CSO allows a locally authenticated user to have their permissions elevated without authentication thereby taking control of the local system they are currently authenticated to. This issue affects:...

CVE-2022-22189

CVE-2022-22189 (Contrail Service Orchestration) : An Incorrect Ownership Assignment vulnerability affects Juniper Networks CSO 6.0.0 on on‑prem installations, prior to 6.0.0 Patch v3. A locally authenticated user can elevate permissions and take control of the local system they are authenticated ...

CVE-2022-22188

The CVE-2022-22188 entry concerns a heap-based buffer overflow in Juniper Networks Junos OS PFE (packet forwarding engine). A network-based, unauthenticated attacker can flood the target device with traffic, causing a Denial of Service, with impact dependent on device configuration. Affected plat...

CVE-2022-22187 JIMS: Local Privilege Escalation vulnerability via repair functionality

An Improper Privilege Management vulnerability in the Windows Installer framework used in the Juniper Networks Juniper Identity Management Service JIMS allows an unprivileged user to trigger a repair operation. Running a repair operation, in turn, will trigger a number of file operations in the...

CVE-2022-22187

The CVE-2022-22187 entry describes an improper privilege management vulnerability in the Windows Installer framework used by Juniper Identity Management Service (JIMS). An unprivileged user can trigger a repair operation, causing file operations in the user’s %TEMP% folder, some executed from SYS...

CVE-2022-22186 Junos OS: EX4650 Series: Certain traffic received by the Junos OS device on the management interface may be forwarded to egress interfaces instead of discarded

Due to an Improper Initialization vulnerability in Juniper Networks Junos OS on EX4650 devices, packets received on the management interface em0 but not destined to the device, may be improperly forwarded to an egress interface, instead of being discarded. Such traffic being sent by a client may...

CVE-2022-22186

CVE-2022-22186 describes an Improper Initialization vulnerability in Juniper Networks Junos OS on the EX4650 series. Affected are EX4650 devices with Junos OS versions prior to 19.1R3-S8; 19.2 before 19.2R3-S5; 19.3 before 19.3R3-S5; 19.4 before 19.4R3-S7; 20.1 before 20.1R3-S3; 20.2 before 20.2R...

CVE-2022-22185

The CVE-2022-22185 issue affects Juniper Networks Junos OS on SRX Series devices and is triggered by a crafted fragmented packet that crashes the flowd daemon, leading to a sustained DoS. It applies only when the preserve-incoming-fragment-size feature is enabled and impacts multiple Annual/Relea...

CVE-2022-22185 Junos OS: SRX Series: Denial of service vulnerability in flowd daemon upon receipt of a specific fragmented packet

A vulnerability in Juniper Networks Junos OS on SRX Series, allows a network-based unauthenticated attacker to cause a Denial of Service DoS by sending a specific fragmented packet to the device, resulting in a flowd process crash, which is responsible for packet forwarding. Continued receipt and...

CVE-2022-22183 Junos OS Evolved: A remote attacker may cause a CPU Denial of Service by sending genuine traffic to a device on a specific IPv4 port.

An Improper Access Control vulnerability in Juniper Networks Junos OS Evolved allows a network-based unauthenticated attacker who is able to connect to a specific open IPv4 port, which in affected releases should otherwise be unreachable, to cause the CPU to consume all resources as more traffic ...

CVE-2022-22183

The CVE-2022-22183 issue affects Juniper Networks Junos OS Evolved (not Junos OS). It is an improper access control vulnerability allowing a remote, unauthenticated attacker to connect to a specific open IPv4 port and cause the CPU to exhaust resources with more traffic, creating a sustained DoS....

CVE-2022-22182 Junos OS: A XSS vulnerability allows an attacker to execute commands on a target J-Web session

A Cross-site Scripting XSS vulnerability in Juniper Networks Junos OS J-Web allows an attacker to construct a URL that when visited by another user enables the attacker to execute commands with the target's permissions, including an administrator. This issue affects: Juniper Networks Junos OS 12....

CVE-2022-22182

CVE-2022-22182 – Junos OS J-Web XSS : A cross-site scripting vulnerability in Juniper Networks Junos OS J-Web allows a crafted URL to execute commands with the target’s privileges, up to administrator. Affected Junos OS versions include 12.3 before 12.3R12-S19; 15.1 before 15.1R7-S10; 18.3 before...