Page 16 of 271 results (0.005 seconds)

CVSS: 5.3EPSS: 0%CPEs: 128EXPL: 0

CVE-2018-0061 – Junos OS: Denial of service in telnetd

https://notcve.org/view.php?id=CVE-2018-0061

10 Oct 2018 — A denial of service vulnerability in the telnetd service on Junos OS allows remote unauthenticated users to cause high CPU usage which may affect system performance. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D81 on SRX Series; 12.3 versions prior to 12.3R12-S11; 12.3X48 versions prior to 12.3X48-D80 on SRX Series; 15.1 versions prior to 15.1R7; 15.1X49 versions prior to 15.1X49-D150, 15.1X49-D160 on SRX Series; 15.1X53 versions prior to 15.1X53-D59 on EX2300/EX3400 S... • http://www.securitytracker.com/id/1041859 • CWE-400: Uncontrolled Resource Consumption •

CVSS: 7.5EPSS: 0%CPEs: 122EXPL: 0

CVE-2018-0062 – Junos OS: Denial of Service in J-Web

https://notcve.org/view.php?id=CVE-2018-0062

10 Oct 2018 — A Denial of Service vulnerability in J-Web service may allow a remote unauthenticated user to cause Denial of Service which may prevent other users to authenticate or to perform J-Web operations. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D77 on SRX Series; 12.3 versions prior to 12.3R12-S10; 12.3X48 versions prior to 12.3X48-D60 on SRX Series; 15.1 versions prior to 15.1R7; 15.1F6; 15.1X49 versions prior to 15.1X49-D120 on SRX Series; 15.1X53 versions prior to 15.1X5... • http://www.securitytracker.com/id/1041860 • CWE-20: Improper Input Validation •

CVSS: 7.5EPSS: 0%CPEs: 459EXPL: 2

CVE-2018-15504

https://notcve.org/view.php?id=CVE-2018-15504

18 Aug 2018 — An issue was discovered in Embedthis GoAhead before 4.0.1 and Appweb before 7.0.2. The server mishandles some HTTP request fields associated with time, which results in a NULL pointer dereference, as demonstrated by If-Modified-Since or If-Unmodified-Since with a month greater than 11. Se ha descubierto un problema en Embedthis GoAhead en versiones anteriores a la 4.0.1 y Appweb anteriores a la 7.0.2. El servidor maneja incorrectamente algunos campos request HTTP asociados con time, lo que resulta en una de... • https://github.com/embedthis/appweb/commit/66067ae6d1fa08b37a270e7dc1821df52ed2daef • CWE-476: NULL Pointer Dereference •

CVSS: 7.5EPSS: 0%CPEs: 225EXPL: 2

CVE-2018-15505

https://notcve.org/view.php?id=CVE-2018-15505

18 Aug 2018 — An issue was discovered in Embedthis GoAhead before 4.0.1 and Appweb before 7.0.2. An HTTP POST request with a specially crafted "Host" header field may cause a NULL pointer dereference and thus cause a denial of service, as demonstrated by the lack of a trailing ']' character in an IPv6 address. Se ha descubierto un problema en Embedthis GoAhead en versiones anteriores a la 4.0.1 y Appweb anteriores a la 7.0.2. Una petición HTTP POST con un campo de cabecera "Host" especialmente manipulado puede causar una... • https://github.com/embedthis/appweb/commit/16e6979c82297d5fc4f8661e7ada975f51e4dfa9 • CWE-476: NULL Pointer Dereference •

CVSS: 7.8EPSS: 0%CPEs: 115EXPL: 0

CVE-2018-0024 – Junos OS: A privilege escalation vulnerability exists where authenticated users with shell access can become root

https://notcve.org/view.php?id=CVE-2018-0024

11 Jul 2018 — An Improper Privilege Management vulnerability in a shell session of Juniper Networks Junos OS allows an authenticated unprivileged attacker to gain full control of the system. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D45 on SRX Series; 12.3X48 versions prior to 12.3X48-D20 on SRX Series; 12.3 versions prior to 12.3R11 on EX Series; 14.1X53 versions prior to 14.1X53-D30 on EX2200/VC, EX3200, EX3300/VC, EX4200, EX4300, EX4550/VC, EX4600, EX6200, EX8200/VC (XRE), QFX3... • http://www.securityfocus.com/bid/104718 • CWE-269: Improper Privilege Management •

CVSS: 8.1EPSS: 0%CPEs: 82EXPL: 0

CVE-2018-0025 – Junos OS: SRX Series: Credentials exposed when using HTTP and HTTPS Firewall Pass-through User Authentication

https://notcve.org/view.php?id=CVE-2018-0025

11 Jul 2018 — When an SRX Series device is configured to use HTTP/HTTPS pass-through authentication services, a client sending authentication credentials in the initial HTTP/HTTPS session is at risk that these credentials may be captured during follow-on HTTP/HTTPS requests by a malicious actor through a man-in-the-middle attack or by authentic servers subverted by malicious actors. FTP, and Telnet pass-through authentication services are not affected. Affected releases are Juniper Networks SRX Series: 12.1X46 versions p... • http://www.securityfocus.com/bid/104719 • CWE-300: Channel Accessible by Non-Endpoint CWE-319: Cleartext Transmission of Sensitive Information •

CVSS: 5.9EPSS: 0%CPEs: 181EXPL: 0

CVE-2018-0031 – Junos OS: Receipt of specially crafted UDP packets over MPLS may bypass stateless IP firewall rules

https://notcve.org/view.php?id=CVE-2018-0031

11 Jul 2018 — Receipt of specially crafted UDP/IP packets over MPLS may be able to bypass a stateless firewall filter. The crafted UDP packets must be encapsulated and meet a very specific packet format to be classified in a way that bypasses IP firewall filter rules. The packets themselves do not cause a service interruption (e.g. RPD crash), but receipt of a high rate of UDP packets may be able to contribute to a denial of service attack. This issue only affects processing of transit UDP/IP packets over MPLS, received ... • http://www.securitytracker.com/id/1041326 • CWE-400: Uncontrolled Resource Consumption •

CVSS: 5.9EPSS: 0%CPEs: 262EXPL: 0

CVE-2018-0034 – Junos OS: A malicious crafted IPv6 DHCP packet may cause the JDHCPD daemon to core

https://notcve.org/view.php?id=CVE-2018-0034

11 Jul 2018 — A Denial of Service vulnerability exists in the Juniper Networks Junos OS JDHCPD daemon which allows an attacker to core the JDHCPD daemon by sending a crafted IPv6 packet to the system. This issue is limited to systems which receives IPv6 DHCP packets on a system configured for DHCP processing using the JDHCPD daemon. This issue does not affect IPv4 DHCP packet processing. Affected releases are Juniper Networks Junos OS: 12.3 versions prior to 12.3R12-S10 on EX Series; 12.3X48 versions prior to 12.3X48-D70... • http://www.securitytracker.com/id/1041338 • CWE-20: Improper Input Validation •

CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0

CVE-2018-0017 – SRX Series: Denial of service vulnerability in flowd daemon on devices configured with NAT-PT

https://notcve.org/view.php?id=CVE-2018-0017

11 Apr 2018 — A vulnerability in the Network Address Translation - Protocol Translation (NAT-PT) feature of Junos OS on SRX series devices may allow a certain valid IPv6 packet to crash the flowd daemon. Repeated crashes of the flowd daemon can result in an extended denial of service condition for the SRX device. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D72; 12.3X48 versions prior to 12.3X48-D55; 15.1X49 versions prior to 15.1X49-D90. Una vulnerabilidad en la característica Netwo... • http://www.securityfocus.com/bid/103749 • CWE-20: Improper Input Validation •

CVSS: 7.5EPSS: 0%CPEs: 85EXPL: 0

CVE-2018-0018 – SRX Series: A crafted packet may lead to information disclosure and firewall rule bypass during compilation of IDP policies.

https://notcve.org/view.php?id=CVE-2018-0018

11 Apr 2018 — On SRX Series devices during compilation of IDP policies, an attacker sending specially crafted packets may be able to bypass firewall rules, leading to information disclosure which an attacker may use to gain control of the target device or other internal devices, systems or services protected by the SRX Series device. This issue only applies to devices where IDP policies are applied to one or more rules. Customers not using IDP policies are not affected. Depending on if the IDP updates are automatic or no... • http://www.securityfocus.com/bid/103748 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •