CVE-2016-4924 vMX: Information leak vulnerability

An incorrect permissions vulnerability in Juniper Networks Junos OS on vMX may allow local unprivileged users on a host system read access to vMX or vPFE images and obtain sensitive information contained in them such as private cryptographic keys. This issue was found during internal product...

CVE-2017-10612 Junos Space: Persistent Cross site scripting in Junos Space

A persistent site scripting vulnerability in Juniper Networks Junos Space allows users who can change certain configuration to implant malicious Javascript or HTML which may be used to steal information or perform actions as other Junos Space users or administrators. Affected releases are Juniper...

CVE-2017-10613

CVE-2017-10613 affects Juniper Junos OS kernels where a loopback filter action command in a running configuration can be triggered by an attacker with CLI access and the ability to initiate remote sessions to the loopback interface, causing the kernel to hang. Affected Junos releases include 12.1...

CVE-2016-1265 Junos Space: privilege escalation vulnerabilities in Junos Space

A remote unauthenticated network based attacker with access to Junos Space may execute arbitrary code on Junos Space or gain access to devices managed by Junos Space using cross site request forgery CSRF, default authentication credentials, information leak and command injection attack vectors. A...

CVE-2017-10607 Junos: rpd core due to receipt of specially crafted BGP packet

Juniper Networks Junos OS 16.1R1, and services releases based off of 16.1R1, are vulnerable to the receipt of a crafted BGP Protocol Data Unit PDU sent directly to the router, which can cause the RPD routing process to crash and restart. Unlike BGP UPDATEs, which are transitive in nature, this...

CVE-2017-10624 Junos Space: Insufficient verification of node certificates.

Insufficient verification of node certificates in Juniper Networks Junos Space may allow a man-in-the-middle type of attacker to make unauthorized modifications to Space database or add nodes. Affected releases are Juniper Networks Junos Space all versions prior to 17.1R1...

CVE-2017-10608

CVE-2017-10608 affects Juniper SRX devices running Junos OS with Sun/MS-RPC ALG services enabled. The issue is a flowd crash triggered by processing IPv6 traffic via the Sun/MS-RPC ALG components, causing a repeated denial of service and, in clusters, potential flip-flop or complete flowd daemon ...

CVE-2017-10611 Junos: EX Series PFE and MX MPC7E/8E/9E PFE crash when fetching interface stats with 'extended-statistics' enabled

If extended statistics are enabled via 'set chassis extended-statistics', when executing any operation that fetches interface statistics, including but not limited to SNMP GET requests, the pfem process or the FPC may crash and restart. Repeated crashes of PFE processing can result in an extended...

CVE-2016-1261 Junos: vulnerabilities in J-Web (CVE-2016-1261)

J-Web does not validate certain input that may lead to cross-site request forgery CSRF issues or cause a denial of J-Web service DoS...

CVE-2016-4923 Junos J-Web: Cross Site Scripting Vulnerability

Insufficient cross site scripting protection in J-Web component in Juniper Networks Junos OS may potentially allow a remote unauthenticated user to inject web script or HTML and steal sensitive data and credentials from a J-Web session and to perform administrative actions on the Junos device...

CVE-2016-4922

CVE-2016-4922 — Junos OS privilege escalation . Affected: Juniper Networks Junos OS. Root cause: certain combinations of CLI commands and arguments allow a user with CLI permissions to gain elevated privileges and full control of the device. Impact: unauthorized access with complete control (conf...

CVE-2017-10611

CVE-2017-10611 describes a crash of the pfem process or FPC when extended statistics are enabled and interface statistics are fetched (e.g., SNMP GET), on specific Juniper platforms. Affected devices include EX2200, EX3300, XRE200 and MX Series routers with MPC7E/8E/9E PFEs, with extended-statist...

CVE-2017-10612

CVE-2017-10612 is a persistent cross-site scripting vulnerability in Juniper Networks Junos Space. The issue allows an attacker who can modify certain configuration data to inject malicious Javascript/HTML, potentially stealing information or acting as other Junos Space users or administrators. A...

Juniper Junos snmpd SNMP Packet Handling RCE (JSA10793)

According to its self-reported version number and configuration, the remote Juniper Junos device is affected by a remote code execution vulnerability in the snmpd daemon due to improper handling of SNMP packets. An unauthenticated, remote attacker can exploit this, via a specially crafted SNMP...

Juniper Junos SRX Integrated User Firewall Hardcoded Credentials (JSA10791)

According to its self-reported version and configuration, the remote Juniper Junos device has hardcoded credentials for the Integrated User Firewall UserFW services authentication API. An unauthenticated, remote attacker can exploit this to gain administrative access to the device. TRUSTED...

Juniper Junos Protocol Daemon (RPD) BGP OPEN Message Handling DoS (JSA10779)

According to its self-reported version number and configuration, the remote Juniper Junos device is affected by a denial of service vulnerability in the routing protocol daemon rpd due to improper handling of BGP OPEN messages. An unauthenticated, remote attacker can exploit this, via a specially...

Juniper Junos Sockets Library Buffer Overflow Privilege Escalation (JSA10792)

According to its self-reported version number, the remote Juniper Junos device is affected by a privilege escalation vulnerability in the sockets library due to a buffer overflow condition. A local attacker can exploit this to cause a denial of service kernel panic or the execution of arbitrary...

Juniper Junos SRX DHCP flowd DHCP Packet Handling DoS (JSA10789)

According to its self-reported version number and configuration, the remote Juniper Junos device is affected by a denial of service vulnerability in flowd due to improper handling of DHCP packets. An unauthenticated, remote attacker can exploit this, via a specially crafted DHCP packet, to crash...

Juniper Junos Multiple OpenSSL Vulnerabilities (JSA10775)

According to its self-reported version number, the remote Juniper Junos device is affected by multiple vulnerabilities : - A carry propagation error exists in the OpenSSL component in the Broadwell-specific Montgomery multiplication procedure when handling input lengths divisible by but longer th...

Juniper Junos rpd MPLS Ping Packet Handling DoS (JSA10795)

According to its self-reported version number and configuration, the remote Juniper Junos device is affected by a denial of service vulnerability in the rpd daemon due to improper handling of MPLS ping packets. An unauthenticated, remote attacker can exploit this, via a specially crafted MPLS pin...