Authorization

Due to a Missing Authorization weakness and Insufficient Granularity of Access Control in a specific device configuration, a vulnerability exists in Juniper Networks Junos OS on SRX Series whereby an attacker who attempts to access J-Web administrative interfaces can successfully do so from any...

CVE-2021-31384

CVE-2021-31384 affects Juniper Networks Junos OS on SRX Series. The vulnerability stems from a Missing Authorization weakness and insufficient granularity of access control in a specific device configuration, allowing an attacker to reach J-Web administrative interfaces from any device interface,...

CVE-2021-31373

Juniper Networks Junos OS SRX Series J-Web exposes a persistent XSS when authenticated users access the J-Web interface. An attacker could inject scripts to steal data or hijack sessions. Affected: SRX Series across multiple releases prior to specific fixed deployments (e.g., 18.2R3-S8; 18.3R3-S5...

CVE-2021-31373 Junos OS: SRX Series: Persistent XSS vulnerability in J-Web

A persistent Cross-Site Scripting XSS vulnerability in Juniper Networks Junos OS on SRX Series, J-Web interface may allow a remote authenticated user to inject persistent and malicious scripts. An attacker can exploit this vulnerability to steal sensitive data and credentials from a web...

CVE-2021-31364 Junos OS: SRX Series: The flowd process will crash if log session-close is configured and specific traffic is received

An Improper Check for Unusual or Exceptional Conditions vulnerability combined with a Race Condition in the flow daemon flowd of Juniper Networks Junos OS on SRX300 Series, SRX500 Series, SRX1500, and SRX5000 Series with SPC2 allows an unauthenticated network based attacker sending specific traff...

CVE-2021-31384

Due to a Missing Authorization weakness and Insufficient Granularity of Access Control in a specific device configuration, a vulnerability exists in Juniper Networks Junos OS on SRX Series whereby an attacker who attempts to access J-Web administrative interfaces can successfully do so from any...

CVE-2021-31373

A persistent Cross-Site Scripting XSS vulnerability in Juniper Networks Junos OS on SRX Series, J-Web interface may allow a remote authenticated user to inject persistent and malicious scripts. An attacker can exploit this vulnerability to steal sensitive data and credentials from a web...

The vulnerability of Juniper Networks Junos OS routers of the MX, EX9200, and SRX4600 series lies in deficiencies in handling exceptional states, which allows an attacker to trigger a service failure.

The vulnerability of Juniper Networks Junos OS routers of the MX, EX9200, and SRX4600 series is related to deficiencies in handling exceptional states during packet processing. Exploiting this vulnerability can allow a malicious actor to cause service interruptions...

CVE-2021-0289 Junos OS: User-defined ARP Policer isn't applied on Aggregated Ethernet (AE) interface until firewall process is restarted

When user-defined ARP Policer is configured and applied on one or more Aggregated Ethernet AE interface units, a Time-of-check Time-of-use TOCTOU Race Condition vulnerability between the Device Control Daemon DCD and firewall process dfwd daemons of Juniper Networks Junos OS allows an attacker to...

Juniper Networks Networks Junos OS SRX 资源管理错误漏洞

Juniper Networks Networks Junos OS SRX is a Juniper Networks network operating system designed for the company's hardware devices. The operating system provides a secure programming interface and the Junos SDK. A resource management error vulnerability exists in Junos OS. Details of the...

Juniper Junos OS Buffer Overflow (JSA11142)

The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA11142 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. TRUSTED...

Juniper Junos OS Information Disclosure (JSA11126)

The version of Junos OS installed on the remote host is affected by an information disclosure vulnerability. A path traversal vulnerability in the Juniper Networks SRX and vSRX Series may allow an authenticated J-web user to read sensitive system files as referenced in the JSA11126 advisory. Note...

CVE-2021-0249

On SRX Series devices configured with UTM services a buffer overflow vulnerability in the Packet Forwarding Engine PFE of Juniper Networks Junos OS may allow an attacker to arbitrarily execute code or commands on the target to take over or otherwise impact the device by sending crafted packets to...

CVE-2021-0246

On SRX1500, SRX4100, SRX4200, SRX4600, SRX5000 Series with SPC2/SPC3, devices using tenant services on Juniper Networks Junos OS, due to incorrect default permissions assigned to tenant system administrators a tenant system administrator may inadvertently send their network traffic to one or more...

CVE-2021-0249

On SRX Series devices configured with UTM services a buffer overflow vulnerability in the Packet Forwarding Engine PFE of Juniper Networks Junos OS may allow an attacker to arbitrarily execute code or commands on the target to take over or otherwise impact the device by sending crafted packets to...

CVE-2021-0227

An improper restriction of operations within the bounds of a memory buffer vulnerability in Juniper Networks Junos OS J-Web on SRX Series devices allows an attacker to cause Denial of Service DoS by sending certain crafted HTTP packets. Continued receipt and processing of these packets will creat...

CVE-2021-0230

On Juniper Networks SRX Series devices with link aggregation lag configured, executing any operation that fetches Aggregated Ethernet AE interface statistics, including but not limited to SNMP GET requests, causes a slow kernel memory leak. If all the available memory is consumed, the traffic wil...

CVE-2021-0230

On Juniper Networks SRX Series devices with link aggregation lag configured, executing any operation that fetches Aggregated Ethernet AE interface statistics, including but not limited to SNMP GET requests, causes a slow kernel memory leak. If all the available memory is consumed, the traffic wil...

CVE-2021-0235

On SRX1500, SRX4100, SRX4200, SRX4600, SRX5000 Series with SPC2/SPC3, vSRX Series devices using tenant services on Juniper Networks Junos OS, due to incorrect permission scheme assigned to tenant system administrators, a tenant system administrator may inadvertently send their network traffic to...

CVE-2021-0231

A path traversal vulnerability in the Juniper Networks SRX and vSRX Series may allow an authenticated J-web user to read sensitive system files. This issue affects Juniper Networks Junos OS on SRX and vSRX Series: 19.3 versions prior to 19.3R2-S6, 19.3R3-S1; 19.4 versions prior to 19.4R2-S4,...