CVE-2019-0016

Junos Space is affected: Juniper Networks Junos Space versions prior to 18.3R1 allow a malicious authenticated user to delete a device from the database via crafted Ajax interactions that piggyback on another admin delete action. Root cause is a privilege/permission check bypass in the delete flo...

CVE-2019-0014

CVE-2019-0014 affects Juniper Networks Junos OS on QFX and PTX Series. A malformed packet used by J-Flow sampling can crash the FPC (Flexible PIC Concentrator) process, causing a Denial of Service across all interfaces. The issue impacts both IPv4 and IPv6 packet processing. Affected releases inc...

CVE-2019-0023

The CVE concerns a persistent Cross-Site Scripting (XSS) vulnerability in the Golden VM menu of Juniper ATP. Affected product: Juniper ATP 5.0 series prior to 5.0.3. Root cause: XSS in the Golden VM menu that could allow an authenticated user to inject arbitrary scripts and potentially steal data...

CVE-2019-0006

Summary of CVE-2019-0006 (Juniper Junos FXPC): A crafted HTTP packet can trigger an uninitialized function pointer dereference in the Packet Forwarding Engine manager (FXPC) on EX, QFX and MX Series devices in a Virtual Chassis. This can crash the fxpc daemon or potentially allow remote code exec...

CVE-2019-0011

Junos OS kernel crash vulnerability CVE-2019-0011 affects the Junos OS kernel when processing a crafted packet to an out-of-band management interface (fxp0, me0, em0, vme0) destined for another address, enabling an attacker on the adjacent network to trigger repeated kernel crashes and a sustaine...

CVE-2019-0013

The CVE-2019-0013 issue affects Junos OS RPD when handling malformed IPv4 PIM Join packets. Affected Junos releases include 12.1X46 (prior to -D77), 12.3X48 (prior to -D77), 15.1 line (prior to 15.1F6-S10, 15.1R6-S6, 15.1R7), 15.1X49 (prior to -D150), 15.1X53 (prior to -D233, -D59), 16.1 (prior t...

CVE-2019-0005

CVE-2019-0005 affects Juniper Junos OS on EX and QFX series (EX2300/3400/4600; QFX3K/5K). The vulnerability is that firewall filter configuration cannot match IPv6 extension headers, potentially allowing IPv6 packets that should be blocked to be forwarded; IPv4 filtering is unaffected. Affected r...

CVE-2019-0001

CVE-2019-0001 affects Juniper Networks Junos OS on MX Series with dynamic VLANs. A malformed packet can trigger an uncontrolled recursion in the Broadband Edge subscriber management daemon (bbe-smgd), causing high CPU and a crash, with repeated packets leading to extended DoS. Affected Junos rele...

CVE-2019-0029: Insertion of Sensitive Information into Log File

Juniper ATP Series Splunk credentials are logged in a file readable by authenticated local users. Using these credentials an attacker can access the Splunk server. This issue affects Juniper ATP 5.0 versions prior to 5.0.3...

CVE-2019-0025: Improper Neutralization of Input During Web Page Generation

A persistent cross-site scripting XSS vulnerability in RADIUS configuration menu of Juniper ATP may allow authenticated user to inject arbitrary script and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on administrative user to perform...

CVE-2019-0014: Undefined Security Weakness

On QFX and PTX Series, receipt of a malformed packet for J-Flow sampling might crash the FPC Flexible PIC Concentrator process which causes all interfaces to go down. By continuously sending the offending packet, an attacker can repeatedly crash the FPC process causing a sustained Denial of Servi...

CVE-2019-0026: Improper Neutralization of Input During Web Page Generation

A persistent cross-site scripting XSS vulnerability in the Zone configuration of Juniper ATP may allow authenticated user to inject arbitrary script and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on administrative user to perform...

PT-2019-1369

Name of the Vulnerable Software and Affected Versions Juniper ATP versions prior to 5.0.3 Description A persistent cross-site scripting XSS issue in the Snort Rules configuration may allow an authenticated user to inject arbitrary script, potentially stealing sensitive data and credentials from a...

PT-2019-1365

Name of the Vulnerable Software and Affected Versions Juniper ATP versions prior to 5.0.3 Description A persistent cross-site scripting XSS issue in the Golden VM menu of Juniper ATP may allow an authenticated user to inject arbitrary script, potentially stealing sensitive data and credentials fr...

PT-2019-1364

Name of the Vulnerable Software and Affected Versions Juniper ATP versions prior to 5.0.3 Description A persistent cross-site scripting XSS issue in the file upload menu may allow an authenticated user to inject arbitrary scripts, potentially stealing sensitive data and credentials from a web...

PT-2019-1367

Name of the Vulnerable Software and Affected Versions Juniper ATP versions prior to 5.0.3 Description The issue is related to insufficient input validation in the Zone configuration component of Juniper ATP, which may allow a remote attacker to inject arbitrary JavaScript code into a loaded page...

PT-2019-1366

Name of the Vulnerable Software and Affected Versions Juniper ATP versions prior to 5.0.3 Description A persistent cross-site scripting XSS issue in the RADIUS configuration menu may allow an authenticated user to inject arbitrary script, potentially stealing sensitive data and credentials from a...

CVE-2019-0030: Use of a Broken or Risky Cryptographic Algorithm

Juniper ATP uses DES and a hardcoded salt for password hashing, allowing for trivial de-hashing of the password file contents. This issue affects Juniper ATP 5.0 versions prior to 5.0.3...

CVE-2019-0003: Reachable Assertion

When a specific BGP flowspec configuration is enabled and upon receipt of a specific matching BGP packet meeting a specific term in the flowspec configuration, a reachable assertion failure occurs, causing the routing protocol daemon rpd process to crash with a core file being generated. Affected...

CVE-2019-0018: Improper Neutralization of Input During Web Page Generation

A persistent cross-site scripting XSS vulnerability in the file upload menu of Juniper ATP may allow an authenticated user to inject arbitrary scripts and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on administrative user to perform...