Juniper EX2300-C any version

Junos OS and Junos OS Evolved: Upon receipt of a specific BGP FlowSpec message network traffic may be disrupted.

Junos OS: EX, QFX and MX series: Packet Forwarding Engine manager (FXPC) process crashes due to a crafted HTTP packet in a Virtual Chassis configuration

Junos OS: J-Web: Cross-site scripting attack allows an attacker to gain control of another users session.

Junos OS: RPD daemon crashes upon receipt of specific MPLS packet

Junos OS: Session fixation vulnerability in J-Web

Junos OS: SRX Series and EX Series: J-Web doesn't sufficiently sanitize input to prevent XSS

Security Bulletin: Junos OS: MAC move limit configured to drop traffic may forward traffic.

Junos OS: J-Web: An unauthenticated, network-based attacker can perform XPATH injection attack against a device.

Junos OS: SRX Series, QFX Series, MX Series and EX Series: Receiving specific HTTPS traffic causes resource exhaustion

Junos OS: BGP session termination upon receipt of specific BGP FlowSpec advertisement.

Junos OS: EX and QFX5K Series: Storm Control does not work as expected when Redundant Trunk Group is configured

Junos OS: EX2300 Series, EX3400 Series, and ACX710 might become unresponsive if the out-of-band management port receives a flood of traffic

Junos OS: A privilege escalation vulnerability exists where authenticated users with shell access can become root

Junos OS: SRX and EX Series: Local privilege escalation flaw in "download" functionality

Junos OS: EX2300, EX3400 Series: Veriexec signature checking not enforced in specific versions of Junos OS

An issue was discovered in Embedthis GoAhead before 4.0.1 and Appweb before 7.0.2. The server mishandles some HTTP request fields associated with time, which results in a NULL pointer dereference, as demonstrated by If-Modified-Since or If-Unmodified-Since with a month greater than 11.

Junos OS: RPD process crashes upon receipt of a specific SNMP packet

Junos OS: Denial of Service vulnerability in J-Web and web based (HTTP/HTTPS) services caused by a high number of specific requests

Junos OS: EX2300 Series, EX2300-MP Series, EX3400 Series: A slow memory leak due to processing of specific IPv6 packets

Junos OS: SRX Series and EX Series: J-Web - unauthenticated access to temporary files containing sensitive information

Junos OS: Cross-Site Scripting (XSS) in J-Web

Junos OS: QFX5000 Series and EX4000 Series: Denial of Service (DoS) on a large scale VLAN due to PFE hogging

Junos OS: EX Series and QFX Series: Memory leak issue processing specific DHCP packets

Junos OS: A race condition in the storm control profile may allow an attacker to cause a Denial of Service condition

Junos OS: EX Series: Subscribing to an unsupported telemetry sensor path causes fxpc process crash

Junos OS: EX and QFX Series: Console port authentication bypass vulnerability

Junos OS: EX Series, QFX Series: If the same egress filter is configured on both an IRB and a physical interface one of those is not applied

Junos OS: A specifically crafted 'show chassis' command causes chassisd to crash

Junos OS and Junos OS Evolved: EX Series, QFX Series, MX Series: A specific 'show l2-learning/ethernet-switching' command causes l2ald crash

Junos OS: QFX5000 Series, EX2300, EX3400, EX4100, EX4400 and EX4600: Packet flooding will occur when IGMP traffic is sent to an isolated VLAN

Junos OS: User-defined ARP Policer isn't applied on Aggregated Ethernet (AE) interface until firewall process is restarted

Junos OS: EX2300 and EX3400 Series: One of more SFPs might become unavailable when the system is very busy

Junos OS: EX Series: A PHP vulnerability in J-Web allows an unauthenticated attacker to control important environment variables

Junos OS: EX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload arbitrary files

On EX2300, EX3400, EX4600, QFX3K and QFX5K series, firewall filter configuration cannot perform packet matching on any IPv6 extension headers. This issue may allow IPv6 packets that should have been blocked to be forwarded. IPv4 packet filtering is unaffected by this vulnerability. Affected releases are Juniper Networks Junos OS on EX and QFX series;: 14.1X53 versions prior to 14.1X53-D47; 15.1 versions prior to 15.1R7; 15.1X53 versions prior to 15.1X53-D234 on QFX5200/QFX5110 series; 15.1X53 versions prior to 15.1X53-D591 on EX2300/EX3400 series; 16.1 versions prior to 16.1R7; 17.1 versions prior to 17.1R2-S10, 17.1R3; 17.2 versions prior to 17.2R3; 17.3 versions prior to 17.3R3; 17.4 versions prior to 17.4R2; 18.1 versions prior to 18.1R2.

Junos OS: SRX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload and download arbitrary files

Junos OS: jdhcpd process crash when forwarding a malformed DHCP packet.

Embedthis Appweb before 4.6.6 and 5.x before 5.2.1 allows remote attackers to cause a denial of service (NULL pointer dereference) via a Range header with an empty value, as demonstrated by "Range: x=,".