CVE Vulnerability Catalog

A Cross-site Scripting (XSS) vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the arbitrary device search field. When visited by another user, including an administrator, the attacker can execute commands with the target's permissions. This issue affects all versions of Junos Space before 24.1R4.

A Cross-site Scripting (XSS) vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the input fields in Model Devices. When visited by another user, including an administrator, the attacker can execute commands with the target's permissions. This issue affects all versions of Junos Space before 24.1R4.

A Cross-site Scripting (XSS) vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in a field on the Purging Policy page. When visited by another user, including an administrator, the attacker can execute commands with the target's permissions. This issue affects all versions of Junos Space before 24.1R4.

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in Global Search that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator. This issue affects all versions of Junos Space before 24.1R4.

A Cross-site Scripting vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the Template Definition page. When visited by another user, the attacker can execute commands with the target's permissions, including administrator. This issue affects all versions of Junos Space before 24.1R4.

A Cross-site Scripting vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the dashboard search field. When visited by another user, the attacker can execute commands with the target's permissions, including administrator. This issue affects all versions of Junos Space before 24.1R4.

A Cross-site Scripting vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the Device Template Definition page. When visited by another user, the attacker can execute commands with the target's permissions, including administrator. This issue affects all versions of Junos Space before 24.1R4.

An Authentication Bypass by Primary Weakness in the FTP server of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to get limited read-write access to files on the device. When the FTP server is enabled and a user named "ftp" or "anonymous" is configured, that user can login without providing the configured password and then has read-write access to their home directory.

A Cross-site Scripting (XSS) vulnerability in Juniper Networks Junos Space allows an attacker to store script tags directly in web pages. When another user views such a page, the attacker can execute commands with the target's administrative permissions. This issue affects all versions of Junos Space before 24.1R4.

A vulnerability has been found in Tenda W12 3.0.0.6(3948) in the wifiMacFilterSet function of the /goform/modules file in the HTTP Request Handler component. Manipulation of the mac argument leads to a stack-based buffer overflow. The attack can be carried out remotely, and the exploit has been publicly disclosed.

A Cross-Site Scripting (XSS) vulnerability has been found in code-projects Client Details System 1.0. Malicious JavaScript code can be injected into the username field when adding customer information.

An arbitrary file download vulnerability in the web interface of Juniper Networks Junos Space allows a network-based authenticated attacker using a crafted GET method to access any file on the file system. Using specially crafted GET methods, an attacker can gain access to files beyond the file path normally allowed by the JBoss daemon. These files could contain sensitive information restricted from access by low-privileged users.

Uncontrolled resource consumption in the HTTP daemon of Juniper Networks Junos Space allows an unauthenticated attacker to flood the system with API calls, leading to denial of service (DoS). After continuous flooding, all file handles are consumed, blocking SSH and web UI access. A manual reboot is required.

Junos Space Security Director contains a stored cross-site scripting (XSS) vulnerability allowing an attacker to inject malicious scripts into the application, which are then executed in other users' browsers when they access affected pages.

A NULL Pointer Dereference vulnerability in the PFE management daemon (evo-pfemand) of Juniper Networks Junos OS Evolved on ACX7024, ACX7024X, ACX7100-32C, ACX7100-48L, ACX7348, ACX7509 devices allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS). Whenever specific valid multicast traffic is received on any layer 3 interface, the evo-pfemand process crashes and restarts. Continued receipt of specific valid multicast traffic results in a sustained Denial-of-Service (DoS) attack. This issue affects Junos OS Evolved on ACX7024, ACX7024X, ACX7100-32C, ACX7100-48L, ACX7348, ACX7509: from 23.2R2-EVO before 23.2R2-S4-EVO, from 23.4R1-EVO before 23.4R2-EVO.

A vulnerability in Junos OS on SRX4700 devices involves use of an uninitialized resource in the PFE, allowing an unauthenticated network-based attacker to cause an FPC crash and restart, leading to DoS. The issue occurs when forwarding-options sampling is enabled and traffic destined to the RE is processed by the PFE line card.

A vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS Evolved on PTX Series allows an unauthenticated, network-based attacker to cause impact to confidentiality and availability. When an output firewall filter is configured with terms where the action is 'reject', matching packets are erroneously sent to the Routing Engine (RE) and processed there, consuming RE resources. Responses from the RE may reveal confidential information about the device. This issue only applies to firewall filters on WAN or revenue interfaces, not mgmt or lo0.

An Origin Validation Error vulnerability in an insufficiently protected file of Juniper Networks Junos OS on EX4600 Series and QFX5000 Series allows an unauthenticated attacker with physical access to the device to create a backdoor which allows complete control of the system. When a device isn't configured with a root password, an attacker can modify a specific file whose contents will be added to the Junos configuration without being visible, allowing the addition of any configuration unknown to the operator, including users and IP addresses. The exploit is persistent across reboots and even zeroization; the indicator of compromise is a modified /etc/config/<platform>-defaults[-flex].conf file.

An Uncontrolled Resource Consumption vulnerability in the Connectivity Fault Management (CFM) daemon and the Connectivity Fault Management Manager (cfmman) of Juniper Networks Junos OS Evolved on PTX10001-36MR, PTX10002-36QDD, PTX10004, PTX10008, and PTX10016 allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS). Sending specific valid traffic causes cfmd to spike CPU to 100% and cfmman's memory to leak, eventually causing the FPC to crash and restart. Continued receipt of these packets sustains the DoS condition.