CVSS: 6.1EPSS: 46%CPEs: 160EXPL: 0CVE-2022-22242 – Junos OS: Cross-site Scripting (XSS) vulnerability in J-Web
https://notcve.org/view.php?id=CVE-2022-22242
A Cross-site Scripting (XSS) vulnerability in the J-Web component of Juniper Networks Junos OS allows an unauthenticated attacker to run malicious scripts reflected off of J-Web to the victim's browser in the context of their session within J-Web. This issue affects Juniper Networks Junos OS all versions prior to 19.1R3-S9; 19.2 versions prior to 19.2R3-S6; 19.3 versions prior to 19.3R3-S7; 19.4 versions prior to 19.4R2-S7, 19.4R3-S8; 20.1 versions prior to 20.1R3-S5; 20.2 versions prior to 20.2R3-S5; 20.3 versions prior to 20.3R3-S5; 20.4 versions prior to 20.4R3-S4; 21.1 versions prior to 21.1R3-S4; 21.2 versions prior to 21.2R3-S1; 21.3 versions prior to 21.3R3; 21.4 versions prior to 21.4R2; 22.1 versions prior to 22.1R2. Una vulnerabilidad de tipo Cross-site Scripting (XSS) en el componente J-Web del Juniper Networks Junos OS permite a un atacante no autenticado ejecute scripts maliciosos reflejados desde J-Web al navegador de la víctima en el contexto de su sesión dentro de J-Web. Este problema afecta a todas las versiones de Junos OS anteriores a 19.1R3-S9; a las versiones 19.2 anteriores a 19.2R3-S6; a las versiones 19.3 anteriores a 19.3R3-S7; a las versiones 19.4 anteriores a 19.4R2-S7, 19.4R3-S8; a las versiones 20.1 anteriores a 20.1R3-S5; a las versiones 20.2 anteriores a 20. 2R3-S5; 20.3 versiones anteriores a 20.3R3-S5; 20.4 versiones anteriores a 20.4R3-S4; 21.1 versiones anteriores a 21.1R3-S4; 21.2 versiones anteriores a 21.2R3-S1; 21.3 versiones anteriores a 21.3R3; 21.4 versiones anteriores a 21.4R2; 22.1 versiones anteriores a 22.1R2 • https://kb.juniper.net/JSA69899 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 161EXPL: 0CVE-2022-22241 – Junos OS: Vulnerability in J-Web may allow deserialization without authentication
https://notcve.org/view.php?id=CVE-2022-22241
An Improper Input Validation vulnerability in the J-Web component of Juniper Networks Junos OS may allow an unauthenticated attacker to access data without proper authorization. Utilizing a crafted POST request, deserialization may occur which could lead to unauthorized local file access or the ability to execute arbitrary commands. This issue affects Juniper Networks Junos OS: all versions prior to 19.1R3-S9; 19.2 versions prior to 19.2R3-S6; 19.3 versions prior to 19.3R3-S7; 19.4 versions prior to 19.4R2-S7, 19.4R3-S9; 20.1 versions prior to 20.1R3-S5; 20.2 versions prior to 20.2R3-S5; 20.3 versions prior to 20.3R3-S5; 20.4 versions prior to 20.4R3-S4; 21.1 versions prior to 21.1R3-S2; 21.2 versions prior to 21.2R3-S1; 21.3 versions prior to 21.3R2-S2, 21.3R3; 21.4 versions prior to 21.4R1-S2, 21.4R2-S1, 21.4R3; 22.1 versions prior to 22.1R1-S1, 22.1R2. Una vulnerabilidad de Comprobación de Entrada Inapropiada en el componente J-Web del Juniper Networks Junos OS puede permitir a un atacante no autenticado acceda a los datos sin la autorización adecuada. usando una petición POST diseñada, puede producirse una deserialización que podría conllevar a un acceso no autorizado a archivos locales o la capacidad de ejecutar comandos arbitrarios. Este problema afecta a Juniper Networks Junos OS: todas las versiones anteriores a 19.1R3-S9; las versiones 19.2 anteriores a 19.2R3-S6; las versiones 19.3 anteriores a 19.3R3-S7; las versiones 19.4 anteriores a 19.4R2-S7, 19.4R3-S9; las versiones 20.1 anteriores a 20.1R3-S5; las versiones 20.2 anteriores a 20.2R3-S5; las versiones 20. 3 versiones anteriores a 20.3R3-S5; 20.4 versiones anteriores a 20.4R3-S4; 21.1 versiones anteriores a 21.1R3-S2; 21.2 versiones anteriores a 21.2R3-S1; 21.3 versiones anteriores a 21.3R2-S2, 21.3R3; 21.4 versiones anteriores a 21.4R1-S2, 21.4R2-S1, 21.4R3; 22.1 versiones anteriores a 22.1R1-S1, 22.1R2 • https://kb.juniper.net/JSA69899 • CWE-20: Improper Input Validation CWE-502: Deserialization of Untrusted Data •
CVSS: 6.5EPSS: 0%CPEs: 20EXPL: 0CVE-2022-22237 – Junos OS: Peers not configured for TCP-AO can establish a BGP or LDP session even if authentication is configured locally
https://notcve.org/view.php?id=CVE-2022-22237
An Improper Authentication vulnerability in the kernel of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to cause an impact on confidentiality or integrity. A vulnerability in the processing of TCP-AO will allow a BGP or LDP peer not configured with authentication to establish a session even if the peer is locally configured to use authentication. This could lead to untrusted or unauthorized sessions being established. This issue affects Juniper Networks Junos OS: 21.2 versions prior to 21.2R3-S1; 21.3 versions prior to 21.3R2-S2, 21.3R3; 21.4 versions prior to 21.4R2-S1, 21.4R3; 22.1 versions prior to 22.1R1-S1, 22.1R2. This issue does not affect Juniper Networks Junos OS Evolved. • https://kb.juniper.net/JSA69893 • CWE-287: Improper Authentication •
CVSS: 7.5EPSS: 0%CPEs: 85EXPL: 0CVE-2022-22236 – Junos OS: SRX Series and MX Series: When specific valid SIP packets are received the PFE will crash
https://notcve.org/view.php?id=CVE-2022-22236
An Access of Uninitialized Pointer vulnerability in SIP Application Layer Gateway (ALG) of Juniper Networks Junos OS on SRX Series and MX Series allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS). When specific valid SIP packets are received the PFE will crash and restart. This issue affects Juniper Networks Junos OS on SRX Series and MX Series: 20.4 versions prior to 20.4R3-S4; 21.1 versions prior to 21.1R3-S2; 21.2 versions prior to 21.2R3-S2; 21.3 versions prior to 21.3R2-S2, 21.3R3; 21.4 versions prior to 21.4R1-S2, 21.4R2; 22.1 versions prior to 22.1R1-S1, 22.1R2. This issue does not affect Juniper Networks Junos OS versions prior to 20.4R1. Una vulnerabilidad de acceso de puntero no inicializado en SIP Application Layer Gateway (ALG) de Juniper Networks Junos OS en las series SRX y MX permite a un atacante no autenticado y basado en la red causar una Denegación de Servicio (DoS). • https://kb.juniper.net/JSA69892 • CWE-824: Access of Uninitialized Pointer •
CVSS: 7.5EPSS: 0%CPEs: 89EXPL: 0CVE-2022-22235 – Junos OS: SRX Series: A flowd core will be observed when malformed GPRS traffic is processed
https://notcve.org/view.php?id=CVE-2022-22235
An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based, attacker to cause Denial of Service (DoS). A PFE crash will happen when a GPRS Tunnel Protocol (GTP) packet is received with a malformed field in the IP header of GTP encapsulated General Packet Radio Services (GPRS) traffic. The packet needs to match existing state which is outside the attackers control, so the issue cannot be directly exploited. The issue will only be observed when endpoint address validation is enabled. This issue affects Juniper Networks Junos OS on SRX Series: 20.2 versions prior to 20.2R3-S5; 20.3 versions prior to 20.3R3-S4; 20.4 versions prior to 20.4R3-S3; 21.1 versions prior to 21.1R3-S2; 21.2 versions prior to 21.2R3-S1; 21.3 versions prior to 21.3R3; 21.4 versions prior to 21.4R1-S2, 21.4R2; 22.1 versions prior to 22.1R1-S1, 22.1R2. • https://kb.juniper.net/JSA69891 • CWE-754: Improper Check for Unusual or Exceptional Conditions •