CVSS: 7.5EPSS: 0%CPEs: 48EXPL: 0CVE-2017-10614 – Junos OS: A remote unauthenticated attacker can consume large amounts of CPU and/or memory through telnetd
https://notcve.org/view.php?id=CVE-2017-10614
A vulnerability in telnetd service on Junos OS allows a remote attacker to cause a limited memory and/or CPU consumption denial of service attack. This issue was found during internal product security testing. Affected releases are Juniper Networks Junos OS 12.1X46 prior to 12.1X46-D45; 12.3X48 prior to 12.3X48-D30; 14.1 prior to 14.1R4-S9, 14.1R8; 14.2 prior to 14.2R6; 15.1 prior to 15.1F5, 15.1R3; 15.1X49 prior to 15.1X49-D40; 15.1X53 prior to 15.1X53-D232, 15.1X53-D47. Un vulnerabilidad en el servicio telnetd en Junos OS permite a un atacante remoto provocar un ataque de denegación de servicio por limitación de memoria o consumo de recursos de CPU. Se encontró el problema durante un análisis de seguridad interno del producto. • https://kb.juniper.net/JSA10817 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 8.0EPSS: 0%CPEs: 86EXPL: 0CVE-2016-4923 – Junos J-Web: Cross Site Scripting Vulnerability
https://notcve.org/view.php?id=CVE-2016-4923
Insufficient cross site scripting protection in J-Web component in Juniper Networks Junos OS may potentially allow a remote unauthenticated user to inject web script or HTML and steal sensitive data and credentials from a J-Web session and to perform administrative actions on the Junos device. Juniper SIRT is not aware of any malicious exploitation of this vulnerability. Affected releases are Juniper Networks Junos OS 11.4 prior to 11.4R13-S3; 12.1X44 prior to 12.1X44-D60; 12.1X46 prior to 12.1X46-D40; 12.1X47 prior to 12.1X47-D30; 12.3 prior to 12.3R11; 12.3X48 prior to 12.3X48-D20; 13.2X51 prior to 13.2X51-D39, 13.2X51-D40; 13.3 prior to 13.3R9; 14.1 prior to 14.1R6; 14.2 prior to 14.2R6; 15.1 prior to 15.1R3; 15.1X49 prior to 15.1X49-D20; 15.1X53 prior to 15.1X53-D57. Protección insuficiente contra Cross-Site Scripting (XSS) en el componente J-Web en Juniper Networks Junos OS podría permitir que un usuario remoto no autenticado inyecte scripts web o HTML, robe datos sensibles y credenciales de una sesión J-Web y realice acciones administrativos en el dispositivos Junos. Juniper SIRT no conoce ninguna explotación maliciosa de esta vulnerabilidad. • http://www.securityfocus.com/bid/93529 https://kb.juniper.net/JSA10764 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 74EXPL: 0CVE-2016-1261 – Junos: vulnerabilities in J-Web (CVE-2016-1261)
https://notcve.org/view.php?id=CVE-2016-1261
J-Web does not validate certain input that may lead to cross-site request forgery (CSRF) issues or cause a denial of J-Web service (DoS). J-Web no valida ciertas entradas que pueden pueden provocar problemas de Cross-Site Request Forgery (CSRF) o una denegación del servicio J-Web (DoS). • https://kb.juniper.net/JSA10723 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.3EPSS: 0%CPEs: 10EXPL: 0CVE-2017-10621 – Junos OS: Denial of service vulnerability in telnetd
https://notcve.org/view.php?id=CVE-2017-10621
A denial of service vulnerability in telnetd service on Juniper Networks Junos OS allows remote unauthenticated attackers to cause a denial of service. Affected Junos OS releases are: 12.1X46 prior to 12.1X46-D71; 12.3X48 prior to 12.3X48-D50; 14.1 prior to 14.1R8-S5, 14.1R9; 14.1X53 prior to 14.1X53-D50; 14.2 prior to 14.2R7-S9, 14.2R8; 15.1 prior to 15.1F2-S16, 15.1F5-S7, 15.1F6-S6, 15.1R5-S2, 15.1R6; 15.1X49 prior to 15.1X49-D90; 15.1X53 prior to 15.1X53-D47; 16.1 prior to 16.1R4-S1, 16.1R5; 16.2 prior to 16.2R1-S3, 16.2R2; Una vulnerabilidad de denegación de servicio (DoS) en el servicio telnetd en Juniper Networks Junos OS permite que atacantes remotos no autenticados provoquen una denegación de servicio (DoS). Las distribuciones afectadas Junos OS son: 12.1X46 anteriores a 12.1X46-D71; 12.3X48 anteriores a 12.3X48-D50; 14.1 anteriores a 14.1R8-S5, 14.1R9; 14.1X53 anteriores a 14.1X53-D50; 14.2 anteriores a 14.2R7-S9, 14.2R8; 15.1 anteriores a 15.1F2-S16, 15.1F5-S7, 15.1F6-S6, 15.1R5-S2, 15.1R6; 15.1X49 anteriores a 15.1X49-D90; 15.1X53 anteriores a 15.1X53-D47; 16.1 anteriores a 16.1R4-S1, 16.1R5; 16.2 anteriores a 16.2R1-S3, 16.2R2; • https://kb.juniper.net/JSA10817 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.5EPSS: 0%CPEs: 37EXPL: 0CVE-2017-10610 – SRX Series: Embedded ICMP may cause the flowd process to crash
https://notcve.org/view.php?id=CVE-2017-10610
On SRX Series devices, a crafted ICMP packet embedded within a NAT64 IPv6 to IPv4 tunnel may cause the flowd process to crash. Repeated crashes of the flowd process constitutes an extended denial of service condition for the SRX Series device. This issue only occurs if NAT64 is configured. Affected releases are Juniper Networks Junos OS 12.1X46 prior to 12.1X46-D71, 12.3X48 prior to 12.3X48-D55, 15.1X49 prior to 15.1X49-D100 on SRX Series. No other Juniper Networks products or platforms are affected by this issue. • https://kb.juniper.net/JSA10813 https://www.juniper.net/documentation/en_US/junos/topics/task/configuration/nat-stateful-nat64-configuring.html • CWE-20: Improper Input Validation •