Archive
15 January 2021
Vulnerabilities first published on this day (UTC), newest first.
12 results · Clear filters · Feed
-
Medium 6.8
Junos Space: Shared secrets stored in recoverable format and directly exposed through the UI
The Junos Space Network Management Platform has been found to store shared secrets in a recoverable format that can be exposed through the UI. An attacker who is able to execute arbitrary code in the victim browser (for example via XSS) or access cached conte…
-
Medium 6.5
Junos OS: QFX Series: Traffic loop Denial of Service (DoS) upon receipt of specific IP multicast traffic
In an EVPN/VXLAN scenario, if an IRB interface with a virtual gateway address (VGA) is configured on a PE, a traffic loop may occur upon receipt of specific IP multicast traffic. The traffic loop will cause interface traffic to increase abnormally, ultimately…
-
Medium 6.7
Junos OS: Command injection vulnerability in 'request system software' CLI command
A command injection vulnerability in install package validation subsystem of Juniper Networks Junos OS that may allow a locally authenticated attacker with privileges to execute commands with root privilege. To validate a package in Junos before installation,…
-
Medium 6.5
Junos OS: EX Series, QFX Series, SRX Branch Series, MX Series: Memory leak in packet forwarding engine due to 802.1X authenticator port interface flaps
On Juniper Networks Junos EX series, QFX Series, MX Series and SRX branch series devices, a memory leak occurs every time the 802.1X authenticator port interface flaps which can lead to other processes, such as the pfex process, responsible for packet forward…
-
Medium 5.0
Contrail Networking: Administrator credentials are exposed in a plaintext file
An Information Exposure vulnerability in Juniper Networks Contrail Networking allows a locally authenticated attacker able to read files to retrieve administrator credentials stored in plaintext thereby elevating their privileges over the system. This issue a…
-
Medium 6.5
Junos OS Evolved: Receipt of certain valid BGP update packets from BGP peers may cause RPD to core when using REGEX.
In Juniper Networks Junos OS Evolved an attacker sending certain valid BGP update packets may cause Junos OS Evolved to access an uninitialized pointer causing RPD to core leading to a Denial of Service (DoS). Continued receipt of these types of valid BGP upd…
-
Medium 6.8
Junos OS: Privilege escalation in J-Web due to arbitrary command and code execution via information disclosure from another users active session
An Information Exposure vulnerability in J-Web of Juniper Networks Junos OS allows an unauthenticated attacker to elevate their privileges over the target system through opportunistic use of an authenticated users session. This issue affects: Juniper Networks…
-
Medium 5.8
Junos OS: MX Series: Dynamic filter fails to match IPv6 prefix
When the "Intrusion Detection Service" (IDS) feature is configured on Juniper Networks MX series with a dynamic firewall filter using IPv6 source or destination prefix, it may incorrectly match the prefix as /32, causing the filter to block unexpected traffic…
-
Medium 4.3
An issue has been discovered in GitLab affecting all versions starting from 12.4. The regex used for package names is w…
-
Medium 5.3
An attacker could cause a Prometheus denial of service in GitLab 13.7+ by sending an HTTP request with a malformed meth…
-
Medium 5.3
An issue has been discovered in GitLab affecting all versions starting from 12.1. Incorrect headers in specific project…
-
Medium 4.3
A regular expression denial of service issue has been discovered in NuGet API affecting all versions of GitLab starting…