CVSS: 7.1EPSS: 0%CPEs: 3EXPL: 0CVE-2019-0021 – Juniper ATP: secret CLI inputs are logged to /var/log/syslog in clear text
https://notcve.org/view.php?id=CVE-2019-0021
On Juniper ATP, secret passphrase CLI inputs, such as "set mcm", are logged to /var/log/syslog in clear text, allowing authenticated local user to be able to view these secret information. This issue affects Juniper ATP 5.0 versions prior to 5.0.4. En Juniper ATP, las entradas CLI de frase de contraseña, como "set mcm", se registran en /var/log/syslog en texto claro, lo que permite que un usuario local autenticado visualice esta información secreta. Este problema afecta a Juniper ATP en versiones 5.0 anteriores a la 5.0.4. • https://kb.juniper.net/JSA10918 • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 6.5EPSS: 0%CPEs: 27EXPL: 0CVE-2019-0011 – Junos OS: Kernel crash after processing specific incoming packet to the out of band management interface (CVE-2019-0011)
https://notcve.org/view.php?id=CVE-2019-0011
The Junos OS kernel crashes after processing a specific incoming packet to the out of band management interface (such as fxp0, me0, em0, vme0) destined for another address. By continuously sending this type of packet, an attacker can repeatedly crash the kernel causing a sustained Denial of Service. Affected releases are Juniper Networks Junos OS: 17.2 versions prior to 17.2R1-S7, 17.2R3; 17.3 versions prior to 17.3R3-S3; 17.4 versions prior to 17.4R1-S4, 17.4R2; 17.2X75 versions prior to 17.2X75-D110; 18.1 versions prior to 18.1R2. El kernel de Junos OS se cierra inesperadamente tras procesar un paquete entrante en concreto a la interfaz de gestión de banda (como fxp0, me0, em0, vme0) destinada a otra dirección. Mediante el envío continuo de este tipo de paquete, un atacante puede cerrar repetidamente el kernel, provocando una denegación de servicio (DoS) prolongada. • http://www.securityfocus.com/bid/106534 https://kb.juniper.net/JSA10911 •
CVSS: 7.2EPSS: 0%CPEs: 3EXPL: 0CVE-2019-0030 – Juniper ATP: Password hashing uses DES and a hardcoded salt
https://notcve.org/view.php?id=CVE-2019-0030
Juniper ATP uses DES and a hardcoded salt for password hashing, allowing for trivial de-hashing of the password file contents. This issue affects Juniper ATP 5.0 versions prior to 5.0.3. Juniper ATP emplea DES y una sal embebida para hashear contraseñas, lo que permite el "deshasheo" trivial del contenido del archivo de contraseñas. Este problema afecta a Juniper ATP en versiones 5.0 anteriores a la 5.0.3. • https://kb.juniper.net/JSA10918 • CWE-327: Use of a Broken or Risky Cryptographic Algorithm CWE-916: Use of Password Hash With Insufficient Computational Effort •
CVSS: 7.5EPSS: 0%CPEs: 164EXPL: 0CVE-2019-0003 – Junos OS: A flowspec BGP update with a specific term-order causes routing protocol daemon (rpd) process to crash with a core.
https://notcve.org/view.php?id=CVE-2019-0003
When a specific BGP flowspec configuration is enabled and upon receipt of a specific matching BGP packet meeting a specific term in the flowspec configuration, a reachable assertion failure occurs, causing the routing protocol daemon (rpd) process to crash with a core file being generated. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D77 on SRX Series; 12.3 versions prior to 12.3R12-S10; 12.3X48 versions prior to 12.3X48-D70 on SRX Series; 14.1X53 versions prior to 14.1X53-D47 on EX2200/VC, EX3200, EX3300/VC, EX4200, EX4300, EX4550/VC, EX4600, EX6200, EX8200/VC (XRE), QFX3500, QFX3600, QFX5100; 15.1 versions prior to 15.1R3; 15.1F versions prior to 15.1F3; 15.1X49 versions prior to 15.1X49-D140 on SRX Series; 15.1X53 versions prior to 15.1X53-D59 on EX2300/EX3400. Cuando una configuración BGP flowspec específica está habilitada y se recibe un paquete BGP coincidente determinado que coincide con un término específico en la configuración de flowspec, ocurre un fallo de aserción alcanzable que provoca que el proceso rpd (routing protocol daemon) se cierre inesperadamente y se genere un archivo core. Las versiones afectadas son Juniper Networks Junos OS: 12.1X46 en versiones anteriores a la 12.1X46-D77 en la serie SRX; 12.3 en versiones anteriores a la 12.3R12-S10; 12.3X48 en versiones anteriores a la 12.3X48-D70 en la serie SRX; 14.1X53 en versiones anteriores a la 14.1X53-D47 en EX2200/VC, EX3200, EX3300/VC, EX4200, EX4300, EX4550/VC, EX4600, EX6200, EX8200/VC (XRE), QFX3500, QFX3600, QFX5100; 15.1 en versiones anteriores a la 15.1R3; 15.1F en versiones anteriores a la 15.1F3; 15.1X49 en versiones anteriores a la 15.1X49-D140 en la serie SRX y 15.1X53 en versiones anteriores a la 15.1X53-D59 en EX2300/EX3400. • http://www.securityfocus.com/bid/106544 https://kb.juniper.net/JSA10902 • CWE-617: Reachable Assertion •
CVSS: 10.0EPSS: 0%CPEs: 3EXPL: 0CVE-2019-0020 – Juniper ATP: Hard coded credentials used in Web Collector
https://notcve.org/view.php?id=CVE-2019-0020
Juniper ATP ships with hard coded credentials in the Web Collector instance which gives an attacker the ability to take full control of any installation of the software. Affected releases are Juniper Networks Juniper ATP: 5.0 versions prior to 5.0.3. Juniper ATP se distribuye con credenciales embebidas en la instancia de Web Collector, que otorga a un atacante la capacidad de tomar el control total de cualquier instalación del software. Las versiones afectadas son Juniper Networks Junos ATP: versiones 5.0 anteriores a la 5.0.3. • https://kb.juniper.net/JSA10918 • CWE-798: Use of Hard-coded Credentials •