CVSS: 7.1EPSS: 0%CPEs: 76EXPL: 0CVE-2018-0004 – Junos OS: Kernel Denial of Service Vulnerability
https://notcve.org/view.php?id=CVE-2018-0004
A sustained sequence of different types of normal transit traffic can trigger a high CPU consumption denial of service condition in the Junos OS register and schedule software interrupt handler subsystem when a specific command is issued to the device. This affects one or more threads and conversely one or more running processes running on the system. Once this occurs, the high CPU event(s) affects either or both the forwarding and control plane. As a result of this condition the device can become inaccessible in either or both the control and forwarding plane and stops forwarding traffic until the device is rebooted. The issue will reoccur after reboot upon receiving further transit traffic. • http://www.securitytracker.com/id/1040183 https://kb.juniper.net/JSA10832 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-0013 – Junos Space: Local File Inclusion Vulnerability
https://notcve.org/view.php?id=CVE-2018-0013
A local file inclusion vulnerability in Juniper Networks Junos Space Network Management Platform may allow an authenticated user to retrieve files from the system. Una vulnerabilidad de inclusión de archivos locales en Juniper Networks Junos Space Network Management Platform podría permitir que un usuario autenticado recupere archivos del sistema. • http://www.securitytracker.com/id/1040189 https://kb.juniper.net/JSA10838 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0CVE-2017-10616 – Contrail: hard coded credentials
https://notcve.org/view.php?id=CVE-2017-10616
The ifmap service that comes bundled with Juniper Networks Contrail releases uses hard coded credentials. Affected releases are Contrail releases 2.2 prior to 2.21.4; 3.0 prior to 3.0.3.4; 3.1 prior to 3.1.4.0; 3.2 prior to 3.2.5.0. CVE-2017-10616 and CVE-2017-10617 can be chained together and have a combined CVSSv3 score of 5.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N). El servicio ifmap que viene incorporado en las distribuciones de Juniper Networks Contrail utiliza credenciales embebidas. Las distribuciones afectadas son Contrail 2.2 anteriores a la 2.21.4; 3.0 anteriores a la 3.0.3.4; 3.1 anteriores a la 3.1.4.0; 3.2 anteriores a la 3.2.5.0. • https://github.com/orangecertcc/security-research/security/advisories/GHSA-qx9c-49m4-f3vj https://kb.juniper.net/JSA10819 • CWE-798: Use of Hard-coded Credentials •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2017-10607 – Junos: rpd core due to receipt of specially crafted BGP packet
https://notcve.org/view.php?id=CVE-2017-10607
Juniper Networks Junos OS 16.1R1, and services releases based off of 16.1R1, are vulnerable to the receipt of a crafted BGP Protocol Data Unit (PDU) sent directly to the router, which can cause the RPD routing process to crash and restart. Unlike BGP UPDATEs, which are transitive in nature, this issue can only be triggered by a packet sent directly to the IP address of the router. Repeated crashes of the rpd daemon can result in an extended denial of service condition. This issue only affects devices running Junos OS 16.1R1 and services releases based off of 16.1R1 (e.g. 16.1R1-S1, 16.1R1-S2, 16.1R1-S3). No prior versions of Junos OS are affected by this vulnerability, and this issue was resolved in Junos OS 16.2 prior to 16.2R1. • https://kb.juniper.net/JSA10810 •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2017-10624 – Junos Space: Insufficient verification of node certificates.
https://notcve.org/view.php?id=CVE-2017-10624
Insufficient verification of node certificates in Juniper Networks Junos Space may allow a man-in-the-middle type of attacker to make unauthorized modifications to Space database or add nodes. Affected releases are Juniper Networks Junos Space all versions prior to 17.1R1. Verificación insuficiente de los certificados de los nodos en Juniper Networks Junos Space puede permitir que un tipo de atacante Man-in-the-Middle (MitM) realice modificaciones no autorizadas a la base de datos Space o añada nodos. Las distribuciones afectadas son: Juniper Networks Junos Space en todas sus versiones anteriores a la 17.1R1. • http://www.securityfocus.com/bid/101255 https://kb.juniper.net/JSA10826 • CWE-345: Insufficient Verification of Data Authenticity •