Juniper Junos any version

Junos OS and Junos OS Evolved: Upon processing specific L2 traffic, rpd can hang in devices with EVPN/VXLAN configured

Junos OS: MX Series: Subscriber login/logout activity will lead to a memory leak

Junos OS and Junos OS Evolved: Receipt of a malformed LLDP TLV results in l2cpd crash

Junos OS and Junos OS Evolved: On SRv6 enabled devices, an attacker sending a malformed BGP update can cause the rpd to crash

Junos OS: ACX5448 & ACX710: Due to interface flaps the PFE process can crash

Junos OS and Junos OS Evolved: Loading a malicious certificate from the CLI may result in a stack-based overflow

Junos OS: EX4600 Series and QFX5000 Series: An attacker with physical access can open a persistent backdoor

Junos OS and Junos OS Evolved: Optional transitive BGP attribute is modified before propagation to peers causing sessions to flap

Junos OS: MX with SPC3, SRX Series: Repeated VPN negotiation failures will eventually cause iked to crash continuously

Junos OS: Processing of a specific BGP update causes the SRRD process to crash

Junos OS: MX Series: Web filtering doesn't block specifically formatted URLs

Junos OS: EX4300 Series: Loopback filter not blocking traffic despite having discard term.

Juniper Junos OS before 12.1X44-D50, 12.1X46 before 12.1X46-D35, 12.1X47 before 12.1X47-D25, 12.3 before 12.3R9, 12.3X48 before 12.3X48-D15, 13.2 before 13.2R7, 13.2X51 before 13.2X51-D35, 13.3 before 13.3R6, 14.1 before 14.1R5, 14.1X50 before 14.1X50-D105, 14.1X51 before 14.1X51-D70, 14.1X53 before 14.1X53-D25, 14.1X55 before 14.1X55-D20, 14.2 before 14.2R1, 15.1 before 15.1F2 or 15.1R1, and 15.1X49 before 15.1X49-D10 does not require a password for the root user when pam.conf is "corrupted," which allows local users to gain root privileges by modifying the file.

Junos OS: IPv6 firewall filter fails to match payload-protocol

Junos OS: SRX4600, SRX5000 Series: TCP packets with SYN/FIN or SYN/RST are transferred after enabling no-syn-check with Express Path

Junos OS: QFX5000 Series and EX4600 Series: Output firewall filter is not applied if certain match criteria are used

Junos OS: When a user with the name ftp or anonymous is configured unauthenticated filesystem access is allowed

Junos OS and Junos OS Evolved: BGP update message containing aggregator attribute with an ASN value of zero (0) is accepted

Junos OS: MX Series: Firewall filters on lo0.<non-0> in the default routing instance are not in effect

Junos OS: SRX Series: J-Web can be exposed on additional interfaces

Junos OS: MX Series: bbe-smgd process crash upon execution of specific CLI commands

Buffer overflow in the flow daemon (flowd) in Juniper Junos 10.4 before 10.4S14, 11.4 before 11.4R7-S2, 12.1.X44 before 12.1X44-D15, 12.1X45 before 12.1X45-D10 on SRX devices, when using telnet pass-through authentication on the firewall, might allow remote attackers to execute arbitrary code via a crafted telnet message.

DNS forwarders - cache poisoning vulnerability

Junos OS: SRX Series: Low privileged user able to access sensitive information on file system

Junos OS: MX304, MX with MPC10/11/LC9600, and EX9200 with EX9200-15C: In a VPLS or Junos Fusion scenario specific show commands cause FPCs to crash

Junos OS: MX Series: The PFE will crash on running specific command

Junos OS and Junos OS Evolved: A local, low privileged user can access sensitive information

Junos OS: EX4300 Series: If a specific CLI command is issued PFE crashes will occur

Junos OS: SRX Series: Low privileged user able to access highly sensitive information on file system

Junos OS and Junos OS Evolved: Executing a specific CLI command when asregex-optimized is configured causes an rpd crash

Junos OS: SRX1500,SRX4100,SRX4200: Execution of low-privileged CLI command results in chassisd crash

Junos OS: The 802.1X Authentication Daemon crashes on running a specific command

Junos OS: A specifically crafted 'show chassis' command causes chassisd to crash

Junos OS and Junos OS Evolved: Executing a specific show command leads to an rpd crash

Junos OS and Junos OS Evolved: A specific CLI command will cause an RPD crash when rib-sharding and update-threading is enabled

Junos OS and Junos OS Evolved: EX Series, QFX Series, MX Series: A specific 'show l2-learning/ethernet-switching' command causes l2ald crash

Junos OS: A low-privileged user can disable an interface

Junos OS and Junos OS Evolved: Unix socket used to control the jdhcpd process is world-writable

Junos OS and Junos OS Evolved: Specific low privileged CLI command exposes sensitive information

Junos OS and Junos OS Evolved: Annotate configuration command can be used to change the configuration