Archive
15 January 2019
Vulnerabilities first published on this day (UTC), newest first.
60 results · Feed
-
Unscored —
Search Autocomplete
In Drupal's 3rd party module search auto complete prior to versions 7.x-4.8 there is a Cross Site Scripting vulnerability. This Search Autocomplete module enables you to autocomplete textfield using data from your website (nodes, comments, etc.). The module d…
-
Unscored —
The function number_format is vulnerable to a heap overflow issue when its second argument ($dec_points) is excessively…
-
Medium 5.9
File REST resource does not properly validate
In Drupal 8 prior to 8.3.4; The file REST resource does not properly validate some fields when manipulating files. A site is only affected by this if the site has the RESTful Web Services (rest) module enabled, the file REST resource is enabled and allows PAT…
-
Unscored —
The implementations of streams for bz2 and php://output improperly implemented their readImpl functions, returning -1 c…
-
Unscored —
Wangle's AcceptRoutingHandler incorrectly casts a socket when accepting a TLS 1.3 connection, leading to a potential de…
-
Low 3.5
It was found Ceph versions before 13.2.4 that authenticated ceph users with read only permissions could steal dm-crypt …
-
High 7.8
Juniper ATP: API and device keys are logged in a world-readable permissions file
On Juniper ATP, the API key and the device key are logged in a file readable by authenticated local users. These keys are used for performing critical operations on the WebUI interface. This issue affects Juniper ATP 5.0 versions prior to 5.0.3.
-
High 8.8
Juniper ATP: Splunk credentials are in logged in clear text
Juniper ATP Series Splunk credentials are logged in a file readable by authenticated local users. Using these credentials an attacker can access the Splunk server. This issue affects Juniper ATP 5.0 versions prior to 5.0.3.
-
Critical 9.3
Junos OS: vMX series: Predictable IP ID sequence numbers vulnerability
The vMX Series software uses a predictable IP ID Sequence Number. This leaves the system as well as clients connecting through the device susceptible to a family of attacks which rely on the use of predictable IP ID sequence numbers as their base method of at…
-
Medium 5.4
Juniper ATP: Persistent Cross-Site Scripting vulnerability in Snort Rules configuration
A persistent cross-site scripting (XSS) vulnerability in the Snort Rules configuration of Juniper ATP may allow authenticated user to inject arbitrary script and steal sensitive data and credentials from a web administration session, possibly tricking a follo…
-
Medium 5.4
Juniper ATP: Persistent Cross-Site Scripting (XSS) vulnerability in file upload menu
A persistent cross-site scripting (XSS) vulnerability in the file upload menu of Juniper ATP may allow an authenticated user to inject arbitrary scripts and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on …
-
Medium 6.7
Juniper ATP: Password hashing uses DES and a hardcoded salt
Juniper ATP uses DES and a hardcoded salt for password hashing, allowing for trivial de-hashing of the password file contents. This issue affects Juniper ATP 5.0 versions prior to 5.0.3.
-
High 7.5
Junos OS: MX Series: uncontrolled recursion and crash in Broadband Edge subscriber management daemon (bbe-smgd).
Receipt of a malformed packet on MX Series devices with dynamic vlan configuration can trigger an uncontrolled recursion loop in the Broadband Edge subscriber management daemon (bbe-smgd), and lead to high CPU usage and a crash of the bbe-smgd service. Repeat…
-
High 7.1
Juniper ATP: secret CLI inputs are logged to /var/log/syslog in clear text
On Juniper ATP, secret passphrase CLI inputs, such as "set mcm", are logged to /var/log/syslog in clear text, allowing authenticated local user to be able to view these secret information. This issue affects Juniper ATP 5.0 versions prior to 5.0.4.
-
Unscored —
On EX2300, EX3400, EX4600, QFX3K and QFX5K series, firewall filter configuration cannot perform packet matching on any …
-
Medium 5.4
Juniper ATP: Persistent Cross-Site Scripting vulnerability in the Golden VM menu
A persistent cross-site scripting (XSS) vulnerability in the Golden VM menu of Juniper ATP may allow authenticated user to inject arbitrary script and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on admini…
-
High 7.5
Junos OS: QFX and PTX Series: FPC process crashes after J-Flow processes a malformed packet
On QFX and PTX Series, receipt of a malformed packet for J-Flow sampling might crash the FPC (Flexible PIC Concentrator) process which causes all interfaces to go down. By continuously sending the offending packet, an attacker can repeatedly crash the FPC pro…
-
High 7.5
Junos OS: rpd crash on VPLS PE upon receipt of specific BGP message
A Denial of Service (DoS) vulnerability in BGP in Juniper Networks Junos OS configured as a VPLS PE allows an attacker to craft a specific BGP message to cause the routing protocol daemon (rpd) process to crash and restart. While rpd restarts after a crash, r…
-
Critical 10.0
Juniper ATP: Hard coded credentials used in Web Collector
Juniper ATP ships with hard coded credentials in the Web Collector instance which gives an attacker the ability to take full control of any installation of the software. Affected releases are Juniper Networks Juniper ATP: 5.0 versions prior to 5.0.3.
-
Medium 6.5
Junos OS: Kernel crash after processing specific incoming packet to the out of band management interface (CVE-2019-0011)
The Junos OS kernel crashes after processing a specific incoming packet to the out of band management interface (such as fxp0, me0, em0, vme0) destined for another address. By continuously sending this type of packet, an attacker can repeatedly crash the kern…
-
Critical 9.8
Junos OS: EX, QFX and MX series: Packet Forwarding Engine manager (FXPC) process crashes due to a crafted HTTP packet in a Virtual Chassis configuration
A certain crafted HTTP packet can trigger an uninitialized function pointer deference vulnerability in the Packet Forwarding Engine manager (fxpc) on all EX, QFX and MX Series devices in a Virtual Chassis configuration. This issue can result in a crash of the…
-
High 7.5
Junos OS: SRX Series: Crafted HTTP traffic may cause UTM to consume all mbufs, leading to Denial of Service
An SRX Series Service Gateway configured for Unified Threat Management (UTM) may experience a system crash with the error message "mbuf exceed" -- an indication of memory buffer exhaustion -- due to the receipt of crafted HTTP traffic. Each crafted HTTP packe…
-
Medium 5.5
Junos OS: EX2300 and EX3400: High disk I/O operations may disrupt the communication between RE and PFE
On EX2300 and EX3400 series, high disk I/O operations may disrupt the communication between the routing engine (RE) and the packet forwarding engine (PFE). In a virtual chassis (VC) deployment, this issue disrupts communication between the VC members. This is…
-
Medium 6.5
Junos Space: Unrestricted file upload vulnerability
The Junos Space application, which allows Device Image files to be uploaded, has insufficient validity checking which may allow uploading of malicious images or scripts, or other content types. Affected releases are Juniper Networks Junos Space versions prior…
-
High 7.5
Junos OS: A flowspec BGP update with a specific term-order causes routing protocol daemon (rpd) process to crash with a core.
When a specific BGP flowspec configuration is enabled and upon receipt of a specific matching BGP packet meeting a specific term in the flowspec configuration, a reachable assertion failure occurs, causing the routing protocol daemon (rpd) process to crash wi…
-
Medium 6.5
Junos OS: RPD crash upon receipt of malformed PIM packet
The routing protocol daemon (RPD) process will crash and restart when a specific invalid IPv4 PIM Join packet is received. While RPD restarts after a crash, repeated crashes can result in an extended Denial of Service (DoS) condition. This issue only affects …
-
Medium 5.8
Junos OS: EX2300 and EX3400 series: Certain stateless firewall filter rules might not take effect
On EX2300 and EX3400 series, stateless firewall filter configuration that uses the action 'policer' in combination with other actions might not take effect. When this issue occurs, the output of the command: show pfe filter hw summary will not show the entry …
-
Medium 5.4
Juniper ATP: Persistent Cross-Site Scripting vulnerability in Zone configuration
A persistent cross-site scripting (XSS) vulnerability in the Zone configuration of Juniper ATP may allow authenticated user to inject arbitrary script and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on ad…
-
Medium 5.4
Junos OS: SRX Series: Deleted dynamic VPN users are allowed to establish VPN connections until reboot
A vulnerability in the SRX Series Service Gateway allows deleted dynamic VPN users to establish dynamic VPN connections until the device is rebooted. A deleted dynamic VPN connection should be immediately disallowed from establishing new VPN connections. Due …
-
Medium 5.4
Juniper ATP: Persistent Cross-Site Scripting vulnerability in the Email Collectors menu
A persistent cross-site scripting (XSS) vulnerability in the Email Collectors menu of Juniper ATP may allow authenticated user to inject arbitrary script and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on…
-
Medium 5.4
Juniper ATP: Persistent Cross-Site Scripting vulnerability in RADIUS configuration menu
A persistent cross-site scripting (XSS) vulnerability in RADIUS configuration menu of Juniper ATP may allow authenticated user to inject arbitrary script and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on…
-
Critical 10.0
Juniper ATP: Two hard coded credentials sharing the same password give an attacker the ability to take control of any installation of the software.
Juniper ATP ships with hard coded credentials in the Cyphort Core instance which gives an attacker the ability to take full control of any installation of the software. Affected releases are Juniper Networks Juniper ATP: 5.0 versions prior to 5.0.3.
-
Medium 6.5
Junos Space: Authenticated user able to delete devices without delete device privileges
A malicious authenticated user may be able to delete a device from the Junos Space database without the necessary privileges through crafted Ajax interactions obtained from another legitimate delete action performed by another administrative user. Affected re…
-
Medium 6.1
Cisco Identity Services Engine Multiple Cross-Site Scripting Vulnerabilities
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web interface of an affected system. The …
-
Medium 6.1
Cisco Identity Services Engine Multiple Cross-Site Scripting Vulnerabilities
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web-based interface. The vulnerability…
-
High 7.4
REST API can bypass comment approval - Access Bypass - Moderately Critical
In Drupal 8 prior to 8.3.7; When using the REST API, users without the correct permission can post comments via REST that are approved even if the user does not have permission to post approved comments. This issue only affects sites that have the RESTful Web…
-
Unscored —
IBM SPSS Analytic Server 3.1.1.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitr…
-
Medium 6.5
It was found in Ceph versions before 13.2.4 that authenticated ceph RGW users can cause a denial of service against OMA…
-
Critical 9.8
Drupal Entity access bypass for entities that do not have UUIDs or have protected revisions
In versions of Drupal 8 core prior to 8.3.7; There is a vulnerability in the entity access system that could allow unwanted access to view, create, update, or delete entities. This only affects entities that do not use or do not have UUIDs, and entities that …
-
Unscored —CVE-2018-20718 Public exploit
In Pydio before 8.2.2, an attack is possible via PHP Object Injection because a user is allowed to use the $phpserial$a…