CVE Vulnerability Catalog

A vulnerability in the pluggable authentication module (PAM) of Juniper Networks Junos OS may allow an unauthenticated network based attacker to potentially execute arbitrary code or crash daemons such as telnetd or sshd that make use of PAM.

A persistent site scripting vulnerability in Juniper Networks Junos Space allows users who can change certain configuration to implant malicious Javascript or HTML. This may be used to steal information or perform actions as other Junos Space users or administrators.

On SRX Series devices, a crafted ICMP packet embedded within a NAT64 IPv6 to IPv4 tunnel may cause the flowd process to crash. Repeated crashes of the flowd process constitutes an extended denial of service condition for the SRX Series device.

Juniper Networks SRX series devices with ALG enabled may experience a flowd crash when processing traffic through the Sun/MS-RPC ALGs. This vulnerability allows an attacker to cause repeated denial of service, potentially halting traffic on all nodes in a cluster.

Junos OS 16.1R1 and service releases based on this version are vulnerable to the receipt of a crafted BGP Protocol Data Unit (PDU), which can cause the RPD routing process to crash and restart. This issue can only be triggered by a packet sent directly to the router's IP address.

Receipt of a specifically malformed IPv6 packet processed by the router may trigger a line card reset, leading to service outages. This issue only affects E Series routers with IPv6 licensed and enabled.

CVE-2016-4924 describes an incorrect permissions vulnerability in Junos OS on vMX that may allow local unprivileged users to access vMX or vPFE images and obtain sensitive information such as private cryptographic keys.

Insufficient cross site scripting protection in J-Web component in Juniper Networks Junos OS may potentially allow a remote unauthenticated user to inject web script or HTML and steal sensitive data and credentials from a J-Web session and to perform administrative actions on the Junos device.

A vulnerability in Junos OS allows unauthorized access to the operating system through certain combinations of CLI commands. Users with the appropriate permissions can achieve elevated privileges and gain complete control of the device.

CVE-2016-4921 affects Juniper Networks routers running Junos OS that can be flooded with specially crafted IPv6 traffic. This can lead to the inability to store next hop information for legitimate traffic, and in extreme cases, total resource exhaustion and kernel panic.

CVE-2016-1265 allows a remote unauthenticated attacker with access to Junos Space to execute arbitrary code or gain access to devices managed by Junos Space. It exploits attack vectors such as CSRF, default authentication credentials, information leak, and command injection.

J-Web does not validate certain input, which may lead to cross-site request forgery (CSRF) issues or cause a denial of J-Web service (DoS).

OpenText Documentum Content Server up to version 7.3 contains a design gap that allows an authenticated user to gain superuser privileges. The issue arises from the failure to verify the contents of TAR archives during unpacking, leading to a path traversal vulnerability via symlinks.

OpenText Documentum Content Server up to version 7.3 contains a design gap that allows an authenticated user to gain superuser privileges. Users can edit dmr_content objects, enabling them to replace the content of security-sensitive dmr_content objects.

OpenText Documentum Content Server versions up to 7.3 improperly validate the input of the PUT_FILE RPC command, allowing any authenticated user to hijack an arbitrary file from the Content Server filesystem. Since some files are security-sensitive, this leads to privilege escalation.

A vulnerability in Microsoft Windows Text Services Framework allows an attacker to execute arbitrary code in the context of the current user. This affects multiple versions of Windows, including Windows Server 2008, Windows 7, Windows 8.1, and Windows 10.

The Microsoft JET Database Engine in various versions of Windows allows an attacker to take control of an affected system due to improper handling of objects in memory.

The Microsoft JET Database Engine in various versions of Windows allows an attacker to take control of an affected system due to improper handling of objects in memory.

The vulnerability in the Windows kernel mode driver allows for privilege escalation due to improper handling of objects in memory. It affects multiple versions of Windows, including Windows Server 2008, Windows 7, Windows 8.1, Windows 10, and Windows Server 2016.

The vulnerability in the Windows kernel mode driver allows for privilege escalation due to improper handling of objects in memory. It affects multiple versions of Windows, including Windows Server 2008, Windows 7, Windows 8.1, and Windows 10.