CVSS: 7.5EPSS: 0%CPEs: 225EXPL: 2CVE-2018-15505
https://notcve.org/view.php?id=CVE-2018-15505
An issue was discovered in Embedthis GoAhead before 4.0.1 and Appweb before 7.0.2. An HTTP POST request with a specially crafted "Host" header field may cause a NULL pointer dereference and thus cause a denial of service, as demonstrated by the lack of a trailing ']' character in an IPv6 address. Se ha descubierto un problema en Embedthis GoAhead en versiones anteriores a la 4.0.1 y Appweb anteriores a la 7.0.2. Una petición HTTP POST con un campo de cabecera "Host" especialmente manipulado puede causar una desreferencia de puntero NULL y, por lo tanto, una denegación de servicio, tal y como queda demostrado con la falta de un carácter posterior ']' en una dirección IPv6. • https://github.com/embedthis/appweb/commit/16e6979c82297d5fc4f8661e7ada975f51e4dfa9 https://github.com/embedthis/appweb/issues/605 https://github.com/embedthis/goahead/issues/264 https://supportportal.juniper.net/s/article/2021-07-Security-Bulletin-Junos-OS-Multiple-J-Web-vulnerabilities-resolved?language=en_US • CWE-476: NULL Pointer Dereference •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-0042
https://notcve.org/view.php?id=CVE-2018-0042
Juniper Networks CSO versions prior to 4.0.0 may log passwords in log files leading to an information disclosure vulnerability. Juniper Networks CSO en versiones anteriores a la 4.0.0 podría registrar contraseñas en archivos de registro, lo que conduce a una vulnerabilidad de divulgación de información. • https://kb.juniper.net/JSA10872 • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2018-0040 – Contrail Service Orchestration: hardcoded cryptographic certificates and keys
https://notcve.org/view.php?id=CVE-2018-0040
Juniper Networks Contrail Service Orchestrator versions prior to 4.0.0 use hardcoded cryptographic certificates and keys in some cases, which may allow network based attackers to gain unauthorized access to services. Las versiones anteriores a la 4.0.0 de Juniper Networks Contrail Service Orchestrator emplean certificados criptográficos embebidos y claves en algunos casos, lo que podría permitir que atacantes en la red obtengan acceso no autorizado a los servicios. • https://kb.juniper.net/JSA10872 • CWE-321: Use of Hard-coded Cryptographic Key CWE-798: Use of Hard-coded Credentials •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-0038
https://notcve.org/view.php?id=CVE-2018-0038
Juniper Networks Contrail Service Orchestration releases prior to 3.3.0 have Cassandra service enabled by default with hardcoded credentials. These credentials allow network based attackers unauthorized access to information stored in Cassandra. Las versiones de Juniper Networks Contrail Service Orchestration anteriores a la 3.3.0 tienen el servicio Cassandra habilitado por defecto con credenciales embebidas. Estas credenciales permiten que atacantes en la red accedan de forma no autorizada a la información almacenada en Cassandra. • https://kb.juniper.net/JSA10872 • CWE-798: Use of Hard-coded Credentials •
CVSS: 6.5EPSS: 0%CPEs: 141EXPL: 0CVE-2018-0029 – Junos OS: Kernel crash (vmcore) during broadcast storm after enabling 'monitor traffic interface fxp0'
https://notcve.org/view.php?id=CVE-2018-0029
While experiencing a broadcast storm, placing the fxp0 interface into promiscuous mode via the 'monitor traffic interface fxp0' can cause the system to crash and restart (vmcore). This issue only affects Junos OS 15.1 and later releases, and affects both single core and multi-core REs. Releases prior to Junos OS 15.1 are unaffected by this vulnerability. Affected releases are Juniper Networks Junos OS: 15.1 versions prior to 15.1F6-S11, 15.1R4-S9, 15.1R6-S6, 15.1R7; 15.1X49 versions prior to 15.1X49-D140; 15.1X53 versions prior to 15.1X53-D59 on EX2300/EX3400; 15.1X53 versions prior to 15.1X53-D67 on QFX10K; 15.1X53 versions prior to 15.1X53-D233 on QFX5200/QFX5110; 15.1X53 versions prior to 15.1X53-D471, 15.1X53-D490 on NFX; 16.1 versions prior to 16.1R3-S8, 16.1R5-S4, 16.1R6-S1, 16.1R7; 16.2 versions prior to 16.2R1-S6, 16.2R2-S5, 16.2R3; 17.1 versions prior to 17.1R1-S7, 17.1R2-S7, 17.1R3; 17.2 versions prior to 17.2R1-S6, 17.2R2-S4, 17.2R3; 17.2X75 versions prior to 17.2X75-D90, 17.2X75-D110; 17.3 versions prior to 17.3R1-S4, 17.3R2; 17.4 versions prior to 17.4R1-S3, 17.4R2. Al experimentar una "tormenta de transmisiones" (broadcast storm), la colocación de la interfaz fxp0 en modo promiscuo mediante la "interfaz fxp0 de tráfico de monitorización" puede provocar que el sistema se cierre inesperadamente y se reinicie (vmcore). • http://www.securitytracker.com/id/1041319 https://kb.juniper.net/JSA10863 • CWE-400: Uncontrolled Resource Consumption •