CVE-2018-0038

Juniper Networks Contrail Service Orchestration releases prior to 3.3.0 have Cassandra service enabled by default with hardcoded credentials. These credentials allow network based attackers unauthorized access to information stored in Cassandra...

CVE-2018-0042

Juniper Networks CSO versions prior to 4.0.0 may log passwords in log files leading to an information disclosure vulnerability...

CVE-2018-0041 Contrail Service Orchestration: Hardcoded credentials for Keystone service.

Juniper Networks Contrail Service Orchestration releases prior to 3.3.0 use hardcoded credentials to access Keystone service. These credentials allow network based attackers unauthorized access to information stored in keystone...

CVE-2018-0031

CVE-2018-0031 affects Juniper Networks Junos OS where processing of transit UDP/IP packets over MPLS on MPLS-enabled interfaces can bypass a stateless firewall filter. The vulnerability requires specially crafted UDP packets encapsulated in an exact format; while individual packets do not crash s...

CVE-2018-0038

CVE-2018-0038 affects Juniper Networks Contrail Service Orchestration (CSO) prior to version 3.3.0, where the Cassandra service is enabled by default with hard-coded credentials. This allows network-based attackers to gain unauthorized access to information stored in Cassandra. The connected docu...

CVE-2018-0024

This CVE concerns an "Improper Privilege Management" flaw in a shell session of Juniper Networks Junos OS that allows an authenticated, unprivileged user to escalate to root. Affected releases include Junos OS on SRX Series (12.1X46 before 12.1X46-D45, 12.3X48 before 12.3X48-D20, 15.1X49 before 1...

CVE-2018-0034

The CVE-2018-0034 issue affects Juniper Networks Junos OS JDHCPD. A crafted IPv6 DHCP packet can cause the JDHCPD daemon to core-dump on systems processing IPv6 DHCP packets (not IPv4). Affected releases include multiple Junos OS lines, with many versions prior to specific build-suffixed revision...

CVE-2018-0042

Juniper Networks CSO is affected by an information disclosure vulnerability in versions prior to 4.0.0, caused by the CSO software logging passwords in log files. An attacker could obtain sensitive credentials from logs. A fixed version is CSO 4.0.0 or later; remediation is to upgrade to the patc...

CVE-2018-0039

CVE-2018-0039 affects Juniper Networks Contrail Service Orchestration releases prior to 4.0.0, where Grafana is enabled by default with hard-coded credentials. This enables network-based attackers to access information stored in Grafana or potentially exploit weaknesses in Grafana. The connection...

CVE-2018-0029 Junos OS: Kernel crash (vmcore) during broadcast storm after enabling 'monitor traffic interface fxp0'

While experiencing a broadcast storm, placing the fxp0 interface into promiscuous mode via the 'monitor traffic interface fxp0' can cause the system to crash and restart vmcore. This issue only affects Junos OS 15.1 and later releases, and affects both single core and multi-core REs. Releases pri...

CVE-2018-0040 Contrail Service Orchestration: hardcoded cryptographic certificates and keys

Juniper Networks Contrail Service Orchestrator versions prior to 4.0.0 use hardcoded cryptographic certificates and keys in some cases, which may allow network based attackers to gain unauthorized access to services...

CVE-2018-0041

The CVE-2018-0041 entry concerns Juniper Networks Contrail Service Orchestration (CSO) prior to version 3.3.0, where hard-coded credentials grant network-based attackers unauthorized access to Keystone service data. Root cause: hard-coded credentials in CSO access to Keystone. Affected product: C...

CVE-2018-0032 Junos OS: RPD crash when receiving a crafted BGP UPDATE

The receipt of a crafted BGP UPDATE can lead to a routing process daemon RPD crash and restart. Repeated receipt of the same crafted BGP UPDATE can result in an extended denial of service condition for the device. This issue only affects the specific versions of Junos OS listed within this...

CVE-2018-0027

The CVE-2018-0027 issue affects Juniper Networks Junos OS, where receiving a crafted or malformed RSVP PATH message can cause the routing protocol daemon (RPD) to hang or crash. This may prevent processing of routing updates when RPD is unavailable, potentially leading to an extended network outa...

CVE-2018-0026 Junos OS: Stateless IP firewall filter rules stop working as expected after reboot or upgrade

After Junos OS device reboot or upgrade, the stateless firewall filter configuration may not take effect. This issue can be verified by running the command: user@re0 show interfaces extensive | match filters" CAM destination filters: 0, CAM source filters: 0 Note: when the issue occurs, it does n...

CVE-2018-0024 Junos OS: A privilege escalation vulnerability exists where authenticated users with shell access can become root

An Improper Privilege Management vulnerability in a shell session of Juniper Networks Junos OS allows an authenticated unprivileged attacker to gain full control of the system. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D45 on SRX Series; 12.3X48 versions...

CVE-2018-0034 Junos OS: A malicious crafted IPv6 DHCP packet may cause the JDHCPD daemon to core

A Denial of Service vulnerability exists in the Juniper Networks Junos OS JDHCPD daemon which allows an attacker to core the JDHCPD daemon by sending a crafted IPv6 packet to the system. This issue is limited to systems which receives IPv6 DHCP packets on a system configured for DHCP processing...

CVE-2018-0032

CVE-2018-0032 affects Juniper Networks Junos OS where receiving a crafted BGP UPDATE can crash and restart the routing process daemon (RPD). Repeated identical crafted updates may cause an extended denial-of-service condition. Affected are specific Junos OS releases: 16.1X65 versions before 16.1X...

CVE-2018-0025

CVE-2018-0025 affects Juniper SRX Series devices when HTTP/HTTPS pass-through authentication is used; credentials in the initial session may be captured during follow-on requests by MITM or compromised servers. Affected releases: SRX 12.1X46 before D67, 12.3X48 before D25, 15.1X49 before D35. FTP...

The vulnerability of the MySQL server of Juniper Networks’ Junos Space network management platform allows a hacker to gain access with administrator privileges.

The vulnerability of the MySQL server of the Juniper Networks Junos Space network resource management platform is related to the use of pre-installed user accounts. Exploiting this vulnerability can allow a malicious actor to gain access with administrator privileges remotely...