CVSS: 6.5EPSS: 0%CPEs: 81EXPL: 0CVE-2021-0271 – Junos OS: EX2200-C Series, EX3200 Series, EX3300 Series, EX4200 Series, EX4500 Series, EX4550 Series, EX6210 Series, EX8208 Series, EX8216 Series: Receipt of a crafted ARP packet by an adjacent attacker will cause the sfid process to core.
https://notcve.org/view.php?id=CVE-2021-0271
A Double Free vulnerability in the software forwarding interface daemon (sfid) process of Juniper Networks Junos OS allows an adjacently-connected attacker to cause a Denial of Service (DoS) by sending a crafted ARP packet to the device. Continued receipt and processing of the crafted ARP packets will create a sustained Denial of Service (DoS) condition. This issue affects: Juniper Networks Junos OS on EX2200-C Series, EX3200 Series, EX3300 Series, EX4200 Series, EX4500 Series, EX4550 Series, EX6210 Series, EX8208 Series, EX8216 Series. 12.3 versions prior to 12.3R12-S17; 15.1 versions prior to 15.1R7-S8. This issue only affects the listed Marvell-chipset based EX Series devices. No other products or platforms are affected. • https://kb.juniper.net/JSA11162 • CWE-415: Double Free •
CVSS: 7.5EPSS: 0%CPEs: 324EXPL: 0CVE-2021-0261 – Junos OS: Denial of Service vulnerability in J-Web and web based (HTTP/HTTPS) services caused by a high number of specific requests
https://notcve.org/view.php?id=CVE-2021-0261
A vulnerability in the HTTP/HTTPS service used by J-Web, Web Authentication, Dynamic-VPN (DVPN), Firewall Authentication Pass-Through with Web-Redirect, and Captive Portal allows an unauthenticated attacker to cause an extended Denial of Service (DoS) for these services by sending a high number of specific requests. This issue affects: Juniper Networks Junos OS 12.3 versions prior to 12.3R12-S17 on EX Series; 12.3X48 versions prior to 12.3X48-D105 on SRX Series; 15.1 versions prior to 15.1R7-S8; 15.1X49 versions prior to 15.1X49-D230 on SRX Series; 16.1 versions prior to 16.1R7-S8; 17.4 versions prior to 17.4R2-S12, 17.4R3-S3; 18.1 versions prior to 18.1R3-S11; 18.2 versions prior to 18.2R3-S6; 18.3 versions prior to 18.3R2-S4, 18.3R3-S3; 18.4 versions prior to 18.4R2-S5, 18.4R3-S4; 19.1 versions prior to 19.1R2-S2, 19.1R3-S2; 19.2 versions prior to 19.2R1-S5, 19.2R3; 19.3 versions prior to 19.3R2-S4, 19.3R3; 19.4 versions prior to 19.4R1-S3, 19.4R2-S2, 19.4R3; 20.1 versions prior to 20.1R1-S3, 20.1R2; 20.2 versions prior to 20.2R1-S1, 20.2R2. Una vulnerabilidad en el servicio HTTP/HTTPS utilizado por -Web, Web Authentication, Dynamic-VPN (DVPN), Firewall Authentication Pass-Through con Web-Redirect, y Captive Portal, permite a un atacante no autenticado causar una Denegación de Servicio extendida (DoS) para estos servicios mediante el envío de un gran número de peticiones específicas. Este problema afecta a: Juniper Networks Junos OS versiones 12.3 anteriores a 12.3R12-S17 en la serie EX; Versiones de 12.3X48 anteriores a 12.3X48-D105 en la serie SRX; versiones 15.1 anteriores a 15.1R7-S8; Versiones de 15.1X49 anteriores a 15.1X49-D230 en la serie SRX; versiones 16.1 anteriores a 16.1R7-S8; versiones 17.4 anteriores a 17.4R2-S12, 17.4R3-S3; versiones 18.1 anteriores a 18.1R3-S11; versiones 18.2 anteriores a 18.2R3-S6; versiones 18.3 anteriores a 18.3R2-S4, 18.3R3-S3; versiones 18.4 anteriores a 18.4R2-S5, 18.4R3-S4; versiones 19.1 anteriores a 19.1R2-S2, 19.1R3-S2; versiones 19. 2 anteriores a 19.2R1-S5, 19.2R3; versiones 19.3 anteriores a 19.3R2-S4, 19.3R3; versiones 19.4 anteriores a 19.4R1-S3, 19.4R2-S2, 19.4R3; versiones 20.1 anteriores a 20.1R1-S3, 20.1R2; Versiones 20.2 anteriores a 20.2R1-S1, 20.2R2 • https://kb.juniper.net/JSA11152 • CWE-125: Out-of-bounds Read CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 10.0EPSS: 0%CPEs: 5EXPL: 0CVE-2021-0248 – NFX Series: Hard-coded credentials allow an attacker to take control of any instance through administrative interfaces.
https://notcve.org/view.php?id=CVE-2021-0248
This issue is not applicable to NFX NextGen Software. On NFX Series devices the use of Hard-coded Credentials in Juniper Networks Junos OS allows an attacker to take over any instance of an NFX deployment. This issue is only exploitable through administrative interfaces. This issue affects: Juniper Networks Junos OS versions prior to 19.1R1 on NFX Series. No other platforms besides NFX Series devices are affected. • https://kb.juniper.net/JSA11141 • CWE-798: Use of Hard-coded Credentials •
CVSS: 6.8EPSS: 0%CPEs: 44EXPL: 0CVE-2021-0220 – Junos Space: Shared secrets stored in recoverable format and directly exposed through the UI
https://notcve.org/view.php?id=CVE-2021-0220
The Junos Space Network Management Platform has been found to store shared secrets in a recoverable format that can be exposed through the UI. An attacker who is able to execute arbitrary code in the victim browser (for example via XSS) or access cached contents may be able to obtain a copy of credentials managed by Junos Space. The impact of a successful attack includes, but is not limited to, obtaining access to other servers connected to the Junos Space Management Platform. This issue affects Juniper Networks Junos Space versions prior to 20.3R1. Se ha encontrado que Junos Space Network Management Platform almacena secretos compartidos en un formato recuperable que puede ser expuesto por medio de la Interfaz de Usuario. • https://kb.juniper.net/JSA11110 • CWE-257: Storing Passwords in a Recoverable Format CWE-522: Insufficiently Protected Credentials •
CVSS: 6.8EPSS: 0%CPEs: 158EXPL: 0CVE-2021-0210 – Junos OS: Privilege escalation in J-Web due to arbitrary command and code execution via information disclosure from another users active session
https://notcve.org/view.php?id=CVE-2021-0210
An Information Exposure vulnerability in J-Web of Juniper Networks Junos OS allows an unauthenticated attacker to elevate their privileges over the target system through opportunistic use of an authenticated users session. This issue affects: Juniper Networks Junos OS 12.3 versions prior to 12.3R12-S17; 17.3 versions prior to 17.3R3-S10; 17.4 versions prior to 17.4R2-S12, 17.4R3-S3; 18.1 versions prior to 18.1R3-S11; 18.2 versions prior to 18.2R3-S6; 18.3 versions prior to 18.3R2-S4, 18.3R3-S4; 18.4 versions prior to 18.4R2-S5, 18.4R3-S5; 19.1 versions prior to 19.1R1-S6, 19.1R2-S2, 19.1R3-S3; 19.2 versions prior to 19.2R1-S5, 19.2R3, 19.2R3-S1; 19.3 versions prior to 19.3R2-S4, 19.3R3; 19.4 versions prior to 19.4R1-S3, 19.4R2-S2, 19.4R3; 20.1 versions prior to 20.1R1-S4, 20.1R2; 20.2 versions prior to 20.2R1-S1, 20.2R2. Una vulnerabilidad de exposición de la información en J-Web de Juniper Networks Junos OS permite a un atacante no autenticado elevar sus privilegios sobre el sistema objetivo mediante el uso oportunista de una sesión de usuarios autenticados. Este problema afecta a: Juniper Networks Junos OS versiones 12.3 anteriores a 12.3R12-S17; versiones 17.3 anteriores a 17.3R3-S10; versiones 17.4 anteriores a 17.4R2-S12, 17.4R3-S3; versiones 18.1 anteriores a 18.1R3-S11; versiones 18.2 anteriores a 18.2R3-S6; versiones 18.3 anteriores a 18.3R2-S4, 18.3R3-S4; versiones 18.4 anteriores a 18.4R2-S5, 18.4R3-S5; versiones 19.1 anteriores a 19.1R1-S6, 19.1R2-S2, 19.1R3-S3; versiones 19.2 anteriores a 19.2R1-S5, 19.2R3, 19.2R3-S1; versiones 19.3 anteriores a 19.3R2-S4, 19.3R3; versiones 19.4 anteriores a 19.4R1-S3, 19.4R2-S2, 19.4R3; versiones 20.1 anteriores a 20.1R1-S4, 20.1R2; versiones 20.2 anteriores a 20.2R1-S1, 20.2R2 • https://kb.juniper.net/JSA11100 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •