CVSS: 4.3EPSS: 0%CPEs: 162EXPL: 0CVE-2022-22243 – Junos OS: XPath Injection vulnerability in J-Web
https://notcve.org/view.php?id=CVE-2022-22243
An XPath Injection vulnerability due to Improper Input Validation in the J-Web component of Juniper Networks Junos OS allows an authenticated attacker to add an XPath command to the XPath stream, which may allow chaining to other unspecified vulnerabilities, leading to a partial loss of confidentiality. This issue affects Juniper Networks Junos OS: all versions prior to 19.1R3-S9; 19.2 versions prior to 19.2R3-S6; 19.3 versions prior to 19.3R3-S7; 19.4 versions prior to 19.4R2-S7, 19.4R3-S8; 20.1 versions prior to 20.1R3-S5; 20.2 versions prior to 20.2R3-S5; 20.3 versions prior to 20.3R3-S5; 20.4 versions prior to 20.4R3-S4; 21.1 versions prior to 21.1R3-S2; 21.2 versions prior to 21.2R3-S1; 21.3 versions prior to 21.3R2-S2, 21.3R3; 21.4 versions prior to 21.4R1-S2, 21.4R2-S1, 21.4R3; 22.1 versions prior to 22.1R1-S1, 22.1R2. Una vulnerabilidad de inyección de XPath debida a una comprobación de entrada inapropiada en el componente J-Web del Juniper Networks Junos OS permite a un atacante autenticado añadir un comando XPath al flujo de XPath, lo que puede permitir el encadenamiento con otras vulnerabilidades no especificadas, conllevando a una pérdida parcial de confidencialidad. Este problema afecta a Juniper Networks Junos OS: todas las versiones anteriores a 19.1R3-S9; las versiones 19.2 anteriores a 19.2R3-S6; las versiones 19.3 anteriores a 19.3R3-S7; las versiones 19.4 anteriores a 19.4R2-S7, 19.4R3-S8; las versiones 20.1 anteriores a 20.1R3-S5; las versiones 20.2 anteriores a 20.2R3-S5; las versiones 20. 3 versiones anteriores a 20.3R3-S5; 20.4 versiones anteriores a 20.4R3-S4; 21.1 versiones anteriores a 21.1R3-S2; 21.2 versiones anteriores a 21.2R3-S1; 21.3 versiones anteriores a 21.3R2-S2, 21.3R3; 21.4 versiones anteriores a 21.4R1-S2, 21.4R2-S1, 21.4R3; 22.1 versiones anteriores a 22.1R1-S1, 22.1R2 • https://kb.juniper.net/JSA69899 • CWE-20: Improper Input Validation CWE-91: XML Injection (aka Blind XPath Injection) •
CVSS: 6.1EPSS: 46%CPEs: 160EXPL: 0CVE-2022-22242 – Junos OS: Cross-site Scripting (XSS) vulnerability in J-Web
https://notcve.org/view.php?id=CVE-2022-22242
A Cross-site Scripting (XSS) vulnerability in the J-Web component of Juniper Networks Junos OS allows an unauthenticated attacker to run malicious scripts reflected off of J-Web to the victim's browser in the context of their session within J-Web. This issue affects Juniper Networks Junos OS all versions prior to 19.1R3-S9; 19.2 versions prior to 19.2R3-S6; 19.3 versions prior to 19.3R3-S7; 19.4 versions prior to 19.4R2-S7, 19.4R3-S8; 20.1 versions prior to 20.1R3-S5; 20.2 versions prior to 20.2R3-S5; 20.3 versions prior to 20.3R3-S5; 20.4 versions prior to 20.4R3-S4; 21.1 versions prior to 21.1R3-S4; 21.2 versions prior to 21.2R3-S1; 21.3 versions prior to 21.3R3; 21.4 versions prior to 21.4R2; 22.1 versions prior to 22.1R2. Una vulnerabilidad de tipo Cross-site Scripting (XSS) en el componente J-Web del Juniper Networks Junos OS permite a un atacante no autenticado ejecute scripts maliciosos reflejados desde J-Web al navegador de la víctima en el contexto de su sesión dentro de J-Web. Este problema afecta a todas las versiones de Junos OS anteriores a 19.1R3-S9; a las versiones 19.2 anteriores a 19.2R3-S6; a las versiones 19.3 anteriores a 19.3R3-S7; a las versiones 19.4 anteriores a 19.4R2-S7, 19.4R3-S8; a las versiones 20.1 anteriores a 20.1R3-S5; a las versiones 20.2 anteriores a 20. 2R3-S5; 20.3 versiones anteriores a 20.3R3-S5; 20.4 versiones anteriores a 20.4R3-S4; 21.1 versiones anteriores a 21.1R3-S4; 21.2 versiones anteriores a 21.2R3-S1; 21.3 versiones anteriores a 21.3R3; 21.4 versiones anteriores a 21.4R2; 22.1 versiones anteriores a 22.1R2 • https://kb.juniper.net/JSA69899 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 161EXPL: 0CVE-2022-22241 – Junos OS: Vulnerability in J-Web may allow deserialization without authentication
https://notcve.org/view.php?id=CVE-2022-22241
An Improper Input Validation vulnerability in the J-Web component of Juniper Networks Junos OS may allow an unauthenticated attacker to access data without proper authorization. Utilizing a crafted POST request, deserialization may occur which could lead to unauthorized local file access or the ability to execute arbitrary commands. This issue affects Juniper Networks Junos OS: all versions prior to 19.1R3-S9; 19.2 versions prior to 19.2R3-S6; 19.3 versions prior to 19.3R3-S7; 19.4 versions prior to 19.4R2-S7, 19.4R3-S9; 20.1 versions prior to 20.1R3-S5; 20.2 versions prior to 20.2R3-S5; 20.3 versions prior to 20.3R3-S5; 20.4 versions prior to 20.4R3-S4; 21.1 versions prior to 21.1R3-S2; 21.2 versions prior to 21.2R3-S1; 21.3 versions prior to 21.3R2-S2, 21.3R3; 21.4 versions prior to 21.4R1-S2, 21.4R2-S1, 21.4R3; 22.1 versions prior to 22.1R1-S1, 22.1R2. Una vulnerabilidad de Comprobación de Entrada Inapropiada en el componente J-Web del Juniper Networks Junos OS puede permitir a un atacante no autenticado acceda a los datos sin la autorización adecuada. usando una petición POST diseñada, puede producirse una deserialización que podría conllevar a un acceso no autorizado a archivos locales o la capacidad de ejecutar comandos arbitrarios. Este problema afecta a Juniper Networks Junos OS: todas las versiones anteriores a 19.1R3-S9; las versiones 19.2 anteriores a 19.2R3-S6; las versiones 19.3 anteriores a 19.3R3-S7; las versiones 19.4 anteriores a 19.4R2-S7, 19.4R3-S9; las versiones 20.1 anteriores a 20.1R3-S5; las versiones 20.2 anteriores a 20.2R3-S5; las versiones 20. 3 versiones anteriores a 20.3R3-S5; 20.4 versiones anteriores a 20.4R3-S4; 21.1 versiones anteriores a 21.1R3-S2; 21.2 versiones anteriores a 21.2R3-S1; 21.3 versiones anteriores a 21.3R2-S2, 21.3R3; 21.4 versiones anteriores a 21.4R1-S2, 21.4R2-S1, 21.4R3; 22.1 versiones anteriores a 22.1R1-S1, 22.1R2 • https://kb.juniper.net/JSA69899 • CWE-20: Improper Input Validation CWE-502: Deserialization of Untrusted Data •
CVSS: 5.5EPSS: 0%CPEs: 89EXPL: 0CVE-2022-22240 – Junos OS and Junos OS Evolved: An rpd memory leak might be observed while running a specific cli command in a RIB sharding scenario
https://notcve.org/view.php?id=CVE-2022-22240
An Allocation of Resources Without Limits or Throttling and a Missing Release of Memory after Effective Lifetime vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a locally authenticated low privileged attacker to cause a Denial of Sevice (DoS). In a high-scaled BGP routing environment with rib-sharding enabled, two issues may occur when executing a specific CLI command. One is a memory leak issue with rpd where the leak rate is not constant, and the other is a temporary spike in rpd memory usage during command execution. This issue affects: Juniper Networks Junos OS 19.4 versions prior to 19.4R3-S9; 20.2 versions prior to 20.2R3-S5; 20.3 versions prior to 20.3R3-S2; 20.4 versions prior to 20.4R3-S1; 21.1 versions prior to 21.1R3; 21.2 versions prior to 21.2R1-S2, 21.2R2-S1, 21.2R3; 21.3 versions prior to 21.3R2. Juniper Networks Junos OS Evolved All versions prior to 20.4R3-S1-EVO; 21.1-EVO version 21.1R1-EVO and later versions; 21.2-EVO versions prior to 21.2R1-S2-EVO, 21.2R3-EVO; 21.3-EVO versions prior to 21.3R2-EVO. • https://kb.juniper.net/JSA69896 • CWE-401: Missing Release of Memory after Effective Lifetime CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 6.5EPSS: 0%CPEs: 147EXPL: 0CVE-2022-22238 – Junos OS and Junos OS Evolved: The rpd process will crash when a malformed incoming RESV message is processed
https://notcve.org/view.php?id=CVE-2022-22238
An Improper Check for Unusual or Exceptional Conditions vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to cause a Denial of Service (DoS). When an incoming RESV message corresponding to a protected LSP is malformed it causes an incorrect internal state resulting in an rpd core. This issue affects: Juniper Networks Junos OS All versions prior to 19.2R3-S6; 19.3 versions prior to 19.3R3-S6; 19.4 versions prior to 19.4R3-S8; 20.1 versions prior to 20.1R3-S2; 20.2 versions prior to 20.2R3-S3; 20.3 versions prior to 20.3R3-S2; 20.4 versions prior to 20.4R3-S1; 21.1 versions prior to 21.1R3; 21.2 versions prior to 21.2R1-S2, 21.2R3; 21.3 versions prior to 21.3R2. Juniper Networks Junos OS Evolved All versions prior to 20.2R3-S3-EVO; 20.3-EVO version 20.3R1-EVO and later versions; 20.4-EVO versions prior to 20.4R3-S1-EVO; 21.1-EVO version 21.1R1-EVO and later versions; 21.2-EVO version 21.2R1-EVO and later versions; 21.3-EVO versions prior to 21.3R2-EVO. Una vulnerabilidad de Comprobación Inapropiada de Condiciones Inusuales o Excepcionales en el demonio de protocolo de enrutamiento (rpd) de Juniper Networks Junos OS y Junos OS Evolved permite a un atacante adyacente no autenticado causar una Denegación de Servicio (DoS). • https://kb.juniper.net/JSA69894 • CWE-754: Improper Check for Unusual or Exceptional Conditions •