Page 28 of 255 results (0.011 seconds)

CVSS: 7.1EPSS: 0%CPEs: 49EXPL: 0

CVE-2014-6447

https://notcve.org/view.php?id=CVE-2014-6447

Multiple vulnerabilities exist in Juniper Junos J-Web error handling that may lead to cross site scripting (XSS) issues or crash the J-Web service (DoS). This affects Juniper Junos OS 12.1X44 before 12.1X44-D45, 12.1X46 before 12.1X46-D30, 12.1X47 before 12.1X47-D20, 12.3 before 12.3R8, 12.3X48 before 12.3X48-D10, 13.1 before 13.1R5, 13.2 before 13.2R6, 13.3 before 13.3R4, 14.1 before 14.1R3, 14.1X53 before 14.1X53-D10, 14.2 before 14.2R1, and 15.1 before 15.1R1. Se presentan múltiples vulnerabilidades en el manejo de errores de Juniper Junos J-Web que pueden conllevar a problemas de tipo cross site scripting (XSS) o bloquear el servicio J-Web (DoS). Esto afecta a Juniper Junos OS versiones 12.1X44 anteriores a 12.1X44-D45, versiones 12.1X46 anteriores a 12.1X46-D30, versiones 12.1X47 anteriores a 12.1X47-D20, versiones 12.3 anteriores a 12.3R8, versiones 12.3X48 anteriores a 12.3X48-D10, versiones 13.1 anteriores a 13.1R5, versiones 13.2 anteriores a 13.2 R6, versiones 13.3 anteriores a 13.3R4, versiones 14.1 anteriores a 14.1R3, versiones 14.1X53 anteriores a 14.1X53-D10, versiones 14.2 anteriores a 14.2R1 y versiones 15.1 anteriores a 15.1R1. • http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10682 http://www.securitytracker.com/id/1032846 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 7.5EPSS: 0%CPEs: 278EXPL: 0

CVE-2020-1607 – Junos OS: Cross-Site Scripting (XSS) in J-Web

https://notcve.org/view.php?id=CVE-2020-1607

Insufficient Cross-Site Scripting (XSS) protection in J-Web may potentially allow a remote attacker to inject web script or HTML, hijack the target user's J-Web session and perform administrative actions on the Junos device as the targeted user. This issue affects Juniper Networks Junos OS 12.3 versions prior to 12.3R12-S15; 12.3X48 versions prior to 12.3X48-D86, 12.3X48-D90 on SRX Series; 14.1X53 versions prior to 14.1X53-D51 on EX and QFX Series; 15.1F6 versions prior to 15.1F6-S13; 15.1 versions prior to 15.1R7-S5; 15.1X49 versions prior to 15.1X49-D181, 15.1X49-D190 on SRX Series; 15.1X53 versions prior to 15.1X53-D238 on QFX5200/QFX5110 Series; 15.1X53 versions prior to 15.1X53-D592 on EX2300/EX3400 Series; 16.1 versions prior to 16.1R4-S13, 16.1R7-S5; 16.2 versions prior to 16.2R2-S10; 17.1 versions prior to 17.1R2-S11, 17.1R3-S1; 17.2 versions prior to 17.2R1-S9, 17.2R3-S2; 17.3 versions prior to 17.3R2-S5, 17.3R3-S5; 17.4 versions prior to 17.4R2-S6, 17.4R3; 18.1 versions prior to 18.1R3-S7; 18.2 versions prior to 18.2R2-S5, 18.2R3; 18.3 versions prior to 18.3R1-S6, 18.3R2-S1, 18.3R3; 18.4 versions prior to 18.4R1-S5, 18.4R2; 19.1 versions prior to 19.1R1-S2, 19.1R2. Una protección insuficiente contra ataques de tipo Cross-Site Scripting (XSS) en J-Web puede permitir potencialmente a un atacante remoto inyectar script web o HTML, secuestrar la sesión J-Web del usuario objetivo y llevar a cabo acciones administrativas en el dispositivo Junos como el usuario objetivo. Este problema afecta a las versiones de Juniper Networks Junos OS 12.3 anteriores a 12.3R12-S15; versiones 12.3X48 anteriores a 12.3X48-D86, 12.3X48-D90 en SRX Series; versiones 14.1X53 anteriores a 14.1X53-D51 en EX y QFX Series; versiones 15.1F6 anteriores a 15.1F6-S13; versiones 15.1 anteriores a 15.1R7-S5; versiones 15.1X49 anteriores a 15.1X49-D181, 15.1X49-D190 en SRX Series; versiones 15.1X53 anteriores a 15.1X53-D238 en QFX5200/QFX5110 Series; versiones 15.1X53 anteriores a 15.1X53-D592 en EX2300/EX3400 Series; versiones 16.1 anteriores a 16.1R4-S13, 16.1R7-S5; versiones 16.2 anteriores a 16.2R2-S10; versiones 17.1 anteriores a 17.1R2-S11, 17.1R3-S1; versiones 17.2 anteriores a 17.2R1-S9, 17.2R3-S2; versiones 17.3 anteriores a 17.3R2-S5, 17.3R3-S5; versiones 17.4 anteriores a 17.4R2-S6, 17.4R3; versiones 18.1 anteriores a 18.1R3-S7; versiones 18.2 anteriores a 18.2R2-S5, 18.2R3; versiones 18.3 anteriores a 18.3R1-S6, 18.3R2-S1, 18.3R3; versiones 18.4 anteriores a 18.4R1-S5, 18.4R2; versiones 19.1 anteriores a 19.1R1-S2, 19.1R2. • https://kb.juniper.net/JSA10986 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 8.1EPSS: 0%CPEs: 210EXPL: 0

CVE-2020-1606 – Junos OS: Path traversal vulnerability in J-Web

https://notcve.org/view.php?id=CVE-2020-1606

A path traversal vulnerability in the Juniper Networks Junos OS device may allow an authenticated J-web user to read files with 'world' readable permission and delete files with 'world' writeable permission. This issue does not affect system files that can be accessed only by root user. This issue affects Juniper Networks Junos OS: 12.3 versions prior to 12.3R12-S13; 12.3X48 versions prior to 12.3X48-D85 on SRX Series; 14.1X53 versions prior to 14.1X53-D51; 15.1F6 versions prior to 15.1F6-S13; 15.1 versions prior to 15.1R7-S5; 15.1X49 versions prior to 15.1X49-D180 on SRX Series; 15.1X53 versions prior to 15.1X53-D238 on QFX5200/QFX5110 Series; 16.1 versions prior to 16.1R4-S13, 16.1R7-S5; 16.2 versions prior to 16.2R2-S10; 17.1 versions prior to 17.1R3-S1; 17.2 versions prior to 17.2R1-S9, 17.2R3-S2; 17.3 versions prior to 17.3R2-S5, 17.3R3-S5; 17.4 versions prior to 17.4R2-S9, 17.4R3; 18.1 versions prior to 18.1R3-S8; 18.2 versions prior to 18.2R3; 18.3 versions prior to 18.3R2-S3, 18.3R3; 18.4 versions prior to 18.4R2; 19.1 versions prior to 19.1R1-S4, 19.1R2. Una vulnerabilidad de salto de ruta en el dispositivo Juniper Networks Junos OS puede permitir a un usuario de J-web autenticado leer archivos con permiso de lectura "world" y eliminar archivos con permiso de escritura "world". Este problema no afecta a los archivos de sistema a los que solo puede acceder el usuario root. • https://kb.juniper.net/JSA10985 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •

CVSS: 6.8EPSS: 0%CPEs: 156EXPL: 0

CVE-2020-1600 – Junos OS: A specific SNMP command can trigger a high CPU usage Denial of Service in the RPD daemon.

https://notcve.org/view.php?id=CVE-2020-1600

In a Point-to-Multipoint (P2MP) Label Switched Path (LSP) scenario, an uncontrolled resource consumption vulnerability in the Routing Protocol Daemon (RPD) in Juniper Networks Junos OS allows a specific SNMP request to trigger an infinite loop causing a high CPU usage Denial of Service (DoS) condition. This issue affects both SNMP over IPv4 and IPv6. This issue affects: Juniper Networks Junos OS: 12.3X48 versions prior to 12.3X48-D90; 15.1 versions prior to 15.1R7-S6; 15.1X49 versions prior to 15.1X49-D200; 15.1X53 versions prior to 15.1X53-D238, 15.1X53-D592; 16.1 versions prior to 16.1R7-S5; 16.2 versions prior to 16.2R2-S11; 17.1 versions prior to 17.1R3-S1; 17.2 versions prior to 17.2R3-S2; 17.3 versions prior to 17.3R3-S7; 17.4 versions prior to 17.4R2-S4, 17.4R3; 18.1 versions prior to 18.1R3-S5; 18.2 versions prior to 18.2R3; 18.2X75 versions prior to 18.2X75-D50; 18.3 versions prior to 18.3R2; 18.4 versions prior to 18.4R2; 19.1 versions prior to 19.1R2. En un escenario Point-to-Multipoint (P2MP) Label Switched Path (LSP), una vulnerabilidad de consumo de recursos no controlada en el Routing Protocol Daemon (RPD) en Juniper Networks Junos OS permite que una petición SNMP específica active un bucle infinito causando a una CPU en uso una alta condición de Denegación de Servicio (DoS). Este problema afecta tanto a SNMP sobre IPv4 como a IPv6. • https://kb.juniper.net/JSA10979 https://prsearch.juniper.net/InfoCenter/index?page=prcontent&id=PR1402185 • CWE-400: Uncontrolled Resource Consumption CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •

CVSS: 7.5EPSS: 0%CPEs: 230EXPL: 0

CVE-2019-0075 – Junos OS: SRX Series: Denial of Service vulnerability in srxpfe related to PIM

https://notcve.org/view.php?id=CVE-2019-0075

A vulnerability in the srxpfe process on Protocol Independent Multicast (PIM) enabled SRX series devices may lead to crash of the srxpfe process and an FPC reboot while processing (PIM) messages. Sustained receipt of these packets may lead to an extended denial of service condition. Affected releases are Juniper Networks Junos OS on SRX Series: 12.3X48 versions prior to 12.3X48-D80; 15.1X49 versions prior to 15.1X49-D160; 17.3 versions prior to 17.3R3-S7 17.4 versions prior to 17.4R2-S8, 17.4R3; 18.1 versions prior to 18.1R3-S8; 18.2 versions prior to 18.2R2; 18.3 versions prior to 18.3R2. Una vulnerabilidad en el proceso srxpfe en los dispositivos de la Serie SRX con Protocol Independent Multicast (PIM) habilitado, puede conllevar al bloqueo del proceso srxpfe y un reinicio de FPC durante el procesamiento de mensajes (PIM). La recepción sostenida de estos paquetes puede conllevar a una condición de denegación de servicio extendida. • https://kb.juniper.net/JSA10976 •