Race condition

On PTX1000 System, PTX10002-60C System, after upgrading to an affected release, a Race Condition vulnerability between the chassis daemon chassisd and firewall process dfwd of Juniper Networks Junos OS, may update the device's interfaces with incorrect firewall filters. This issue only occurs whe...

Input validation

An Improper Input Validation vulnerability in J-Web of Juniper Networks Junos OS allows a locally authenticated J-Web attacker to escalate their privileges to root over the target device. This issue affects: Juniper Networks Junos OS All versions prior to 18.3R3-S5; 18.4 versions prior to...

Input validation

An Improper Input Validation vulnerability in routing process daemon RPD of Juniper Networks Junos OS devices configured with BGP origin validation using Resource Public Key Infrastructure RPKI, allows an attacker to send a specific BGP update which may cause RPKI policy-checks to be bypassed...

Design/Logic Flaw

The Juniper Networks CTPView server is not enforcing HTTP Strict Transport Security HSTS. HSTS is an optional response header which allows servers to indicate that content from the requested domain will only be served over HTTPS. The lack of HSTS may leave the system vulnerable to downgrade...

Design/Logic Flaw

In broadband environments, including but not limited to Enhanced Subscriber Management, CHAP, PPP, DHCP, etc., on Juniper Networks Junos OS devices where RADIUS servers are configured for managing subscriber access and a subscriber is logged in and then requests to logout, the subscriber may be...

Cross site scripting

A persistent cross-site scripting XSS vulnerability in the captive portal graphical user interface of Juniper Networks Junos OS may allow a remote authenticated user to inject web script or HTML and steal sensitive data and credentials from a web administration session, possibly tricking a...

CVE-2021-31386

CVE-2021-31386 is a Protection Mechanism Failure in Juniper Networks Junos OS J-Web HTTP service. Multiple Junos releases are affected (12.3 before 12.3R12-S20; 15.1 before 15.1R7-S11; 18.3 before 18.3R3-S6; 18.4 before 18.4R3-S10; 19.1 before 19.1R3-S7; 19.2 before 19.2R3-S4; 19.3 before 19.3R3-...

CVE-2021-31386 Junos OS: When using J-Web with HTTP an attacker may retrieve encryption keys via Person-in-the-Middle attacks.

A Protection Mechanism Failure vulnerability in the J-Web HTTP service of Juniper Networks Junos OS allows a remote unauthenticated attacker to perform Person-in-the-Middle PitM attacks against the device. This issue affects: Juniper Networks Junos OS 12.3 versions prior to 12.3R12-S20; 15.1...

CVE-2021-31385 Junos OS: J-Web: A path traversal vulnerability allows an authenticated attacker to elevate their privileges to root

An Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in J-Web of Juniper Networks Junos OS allows any low-privileged authenticated attacker to elevate their privileges to root. This issue affects: Juniper Networks Junos OS 12.3 versions prior to 12.3R12-S1...

CVE-2021-31385

CVE-2021-31385 describes a path traversal flaw in Juniper Networks Junos OS J-Web. The issue arises from an improper limitation of a pathname to a restricted directory, allowing a low-privileged authenticated attacker to elevate privileges to root. Affected Junos OS versions include multiple rele...

CVE-2021-31384

CVE-2021-31384 affects Juniper Networks Junos OS on SRX Series. The vulnerability stems from a Missing Authorization weakness and insufficient granularity of access control in a specific device configuration, allowing an attacker to reach J-Web administrative interfaces from any device interface,...

CVE-2021-31383

CVE-2021-31383 affects Juniper Networks Junos OS and Junos OS Evolved, where in P2MP scenarios the routing protocol daemon (RPD) may crash due to a source-to-destination copy-write operation paired with a stack-based buffer overflow on certain crafted packets. This leads to a DoS that can become ...

CVE-2021-31383 Junos OS and Junos OS Evolved: In Point to MultiPoint (P2MP) scenarios receipt of various crafted packets causes RPD to core.

In Point to MultiPoint P2MP scenarios within established sessions between network or adjacent neighbors the improper use of a source to destination copy write operation combined with a Stack-based Buffer Overflow on certain specific packets processed by the routing protocol daemon RPD of Juniper...

CVE-2021-31382

CVE-2021-31382 describes a race condition in Juniper Junos OS on PTX1000 and PTX10002-60C systems that, after upgrading to an affected release, can cause misassignment of firewall filters to interfaces due to contention between chassisd and dfwd. This may result in interfaces having incorrect pro...

CVE-2021-31381

CVE-2021-31381 refers to a configuration weakness in the JBoss Application Server (AppSvr) component of Juniper Networks SRC Series. A remote attacker can send a specially crafted query that may cause the web server to delete files, impacting integrity and availability. The NVD metrics show a hig...

CVE-2021-31381 SRC Series: A remote attacker sending a specially crafted query may cause the web server to delete files

A configuration weakness in the JBoss Application Server AppSvr component of Juniper Networks SRC Series allows a remote attacker to send a specially crafted query to cause the web server to delete files which may allow the attacker to disrupt the integrity and availability of the system...

CVE-2021-31380 SRC Series: A remote attacker sending a specially crafted query may cause the web server to disclose sensitive information

A configuration weakness in the JBoss Application Server AppSvr component of Juniper Networks SRC Series allows a remote attacker to send a specially crafted query to cause the web server to disclose sensitive information in the HTTP response which allows the attacker to obtain sensitive...

CVE-2021-31380

CVE-2021-31380 affects the JBoss Application Server (AppSvr) component in Juniper Networks SRC Series. A configuration weakness allows a remote attacker to send a crafted query that makes the web server disclose sensitive information in the HTTP response. This CVE entry sources from NVD with a CV...

CVE-2021-31379

CVE-2021-31379 describes an Incorrect Behavior Order vulnerability in Juniper Junos OS MAP-E automatic tunneling on MX Series MPC 7/8/9/10/11 cards when MAP-E IP reassembly is enabled. Exploitation leads to a Denial of Service (DoS) where the PFE is disabled after processing malformed IPv4/IPv6 p...

CVE-2021-31379 Junos OS: MX Series: MPC 7/8/9/10/11 cards with MAP-E: PFE halts when an attacker sends malformed IPv4 or IPv6 traffic inside the MAP-E tunnel.

An Incorrect Behavior Order vulnerability in the MAP-E automatic tunneling mechanism of Juniper Networks Junos OS allows an attacker to send certain malformed IPv4 or IPv6 packets to cause a Denial of Service DoS to the PFE on the device which is disabled as a result of the processing of these...