Authorization

Due to a Missing Authorization weakness and Insufficient Granularity of Access Control in a specific device configuration, a vulnerability exists in Juniper Networks Junos OS on SRX Series whereby an attacker who attempts to access J-Web administrative interfaces can successfully do so from any...

Design/Logic Flaw

An Improper Handling of Exceptional Conditions vulnerability in the processing of a transit or directly received malformed IPv6 packet in Juniper Networks Junos OS results in a kernel crash, causing the device to restart, leading to a Denial of Service DoS. Continued receipt and processing of thi...

CVE-2021-31386 Junos OS: When using J-Web with HTTP an attacker may retrieve encryption keys via Person-in-the-Middle attacks.

A Protection Mechanism Failure vulnerability in the J-Web HTTP service of Juniper Networks Junos OS allows a remote unauthenticated attacker to perform Person-in-the-Middle PitM attacks against the device. This issue affects: Juniper Networks Junos OS 12.3 versions prior to 12.3R12-S20; 15.1...

CVE-2021-31386

CVE-2021-31386 is a Protection Mechanism Failure in Juniper Networks Junos OS J-Web HTTP service. Multiple Junos releases are affected (12.3 before 12.3R12-S20; 15.1 before 15.1R7-S11; 18.3 before 18.3R3-S6; 18.4 before 18.4R3-S10; 19.1 before 19.1R3-S7; 19.2 before 19.2R3-S4; 19.3 before 19.3R3-...

CVE-2021-31385 Junos OS: J-Web: A path traversal vulnerability allows an authenticated attacker to elevate their privileges to root

An Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in J-Web of Juniper Networks Junos OS allows any low-privileged authenticated attacker to elevate their privileges to root. This issue affects: Juniper Networks Junos OS 12.3 versions prior to 12.3R12-S1...

CVE-2021-31385

CVE-2021-31385 describes a path traversal flaw in Juniper Networks Junos OS J-Web. The issue arises from an improper limitation of a pathname to a restricted directory, allowing a low-privileged authenticated attacker to elevate privileges to root. Affected Junos OS versions include multiple rele...

CVE-2021-31384

CVE-2021-31384 affects Juniper Networks Junos OS on SRX Series. The vulnerability stems from a Missing Authorization weakness and insufficient granularity of access control in a specific device configuration, allowing an attacker to reach J-Web administrative interfaces from any device interface,...

CVE-2021-31383

CVE-2021-31383 affects Juniper Networks Junos OS and Junos OS Evolved, where in P2MP scenarios the routing protocol daemon (RPD) may crash due to a source-to-destination copy-write operation paired with a stack-based buffer overflow on certain crafted packets. This leads to a DoS that can become ...

CVE-2021-31383 Junos OS and Junos OS Evolved: In Point to MultiPoint (P2MP) scenarios receipt of various crafted packets causes RPD to core.

In Point to MultiPoint P2MP scenarios within established sessions between network or adjacent neighbors the improper use of a source to destination copy write operation combined with a Stack-based Buffer Overflow on certain specific packets processed by the routing protocol daemon RPD of Juniper...

CVE-2021-31382

CVE-2021-31382 describes a race condition in Juniper Junos OS on PTX1000 and PTX10002-60C systems that, after upgrading to an affected release, can cause misassignment of firewall filters to interfaces due to contention between chassisd and dfwd. This may result in interfaces having incorrect pro...

CVE-2021-31381

CVE-2021-31381 refers to a configuration weakness in the JBoss Application Server (AppSvr) component of Juniper Networks SRC Series. A remote attacker can send a specially crafted query that may cause the web server to delete files, impacting integrity and availability. The NVD metrics show a hig...

CVE-2021-31381 SRC Series: A remote attacker sending a specially crafted query may cause the web server to delete files

A configuration weakness in the JBoss Application Server AppSvr component of Juniper Networks SRC Series allows a remote attacker to send a specially crafted query to cause the web server to delete files which may allow the attacker to disrupt the integrity and availability of the system...

CVE-2021-31380 SRC Series: A remote attacker sending a specially crafted query may cause the web server to disclose sensitive information

A configuration weakness in the JBoss Application Server AppSvr component of Juniper Networks SRC Series allows a remote attacker to send a specially crafted query to cause the web server to disclose sensitive information in the HTTP response which allows the attacker to obtain sensitive...

CVE-2021-31380

CVE-2021-31380 affects the JBoss Application Server (AppSvr) component in Juniper Networks SRC Series. A configuration weakness allows a remote attacker to send a crafted query that makes the web server disclose sensitive information in the HTTP response. This CVE entry sources from NVD with a CV...

CVE-2021-31379

CVE-2021-31379 describes an Incorrect Behavior Order vulnerability in Juniper Junos OS MAP-E automatic tunneling on MX Series MPC 7/8/9/10/11 cards when MAP-E IP reassembly is enabled. Exploitation leads to a Denial of Service (DoS) where the PFE is disabled after processing malformed IPv4/IPv6 p...

CVE-2021-31379 Junos OS: MX Series: MPC 7/8/9/10/11 cards with MAP-E: PFE halts when an attacker sends malformed IPv4 or IPv6 traffic inside the MAP-E tunnel.

An Incorrect Behavior Order vulnerability in the MAP-E automatic tunneling mechanism of Juniper Networks Junos OS allows an attacker to send certain malformed IPv4 or IPv6 packets to cause a Denial of Service DoS to the PFE on the device which is disabled as a result of the processing of these...

CVE-2021-31378

CVE-2021-31378 affects Juniper Networks Junos OS in broadband subscriber management scenarios where RADIUS is used. An attacker can spoof messages from trusted RADIUS servers to a device after a subscriber logs in and requests logout, forcing the subscriber into a persistent “Terminating” state v...

CVE-2021-31377

CVE-2021-31377 affects Juniper Networks Junos OS. A local authenticated attacker can exploit an Incorrect Permission Assignment for a Critical Resource in a file in the Junos filesystem to cause the Routing Process Daemon (RPD) to crash and restart, resulting in a DoS . Affected versions include ...

CVE-2021-31376 Junos OS: ACX Series: Packet Forwarding Engine manager (FXPC) process crashes when processing DHCPv6 packets

An Improper Input Validation vulnerability in Packet Forwarding Engine manager FXPC process of Juniper Networks Junos OS allows an attacker to cause a Denial of Service DoS by sending specific DHCPv6 packets to the device and crashing the FXPC service. Continued receipt and processing of this...

CVE-2021-31376

CVE-2021-31376 affects Juniper Networks Junos OS on ACX Series (ACX500, ACX1000, ACX1100, ACX2100, ACX2200, ACX4000, ACX5048, ACX5096). The issue is an improper input validation in the FXPC (Packet Forwarding Engine manager) that can be triggered by specific DHCPv6 packets, crashing FXPC and caus...