Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2018-1951
IBM Publishing Engine 2.1.2, 6.0.5, and 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 153494.
Affected Products: Rational Publishing Engine
References: [{'name': 'ibm-rpe-cve20181951-xss(153494)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/153494'}, {'name': '106460', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/106460'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.ibm.com/support/docview.wss?uid=ibm10792081'}]
CVE State: PUBLISHED
Explain CVE-2018-1952
IBM Jazz Foundation (IBM Rational Engineering Lifecycle Manager 5.0 through 6.0.6) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 153495.
Affected Products: Rational Collaborative Lifecycle Management
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ibm.com/support/docview.wss?uid=ibm10875340'}, {'name': 'ibm-jazz-cve20181952-xss(153495)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/153495'}, {'name': '107435', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/107435'}]
CVE State: PUBLISHED
Explain CVE-2018-1956
IBM Security Identity Manager 6.0.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 153628.
Affected Products: Security Identity Manager
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.ibm.com/support/docview.wss?uid=ibm10794615'}, {'name': 'ibm-sim-cve20181956-info-disc(153628)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/153628'}, {'name': '106554', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/106554'}]
CVE State: PUBLISHED
Explain CVE-2018-1957
IBM WebSphere Application Server 9 could allow sensitive information to be available caused by mishandling of data by the application based on an incorrect return by the httpServletRequest#authenticate() API when an unprotected URI is accessed. IBM X-Force ID: 153629.
Affected Products: WebSphere Application Server
References: [{'name': '106203', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/106203'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.ibm.com/support/docview.wss?uid=ibm10744247'}, {'name': 'ibm-websphere-cve20181957-info-disc(153629)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/153629'}]
CVE State: PUBLISHED
Explain CVE-2018-1959
IBM Security Identity Manager 7.0.1 Virtual Appliance contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 153633.
Affected Products: Security Identity Manager
References: [{'name': '106726', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/106726'}, {'name': 'ibm-sim-cve20181959-info-disc(153633)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/153633'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.ibm.com/support/docview.wss?uid=ibm10796380'}]
CVE State: PUBLISHED
Explain CVE-2018-1961
IBM Emptoris Contract Management 10.0.0 and 10.1.3.0 could disclose sensitive information from detailed information from error messages. IBM X-Force ID: 153657.
Affected Products: Emptoris Contract Management
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.ibm.com/support/docview.wss?uid=ibm10731107'}, {'name': 'ibm-emptoris-cve20181961-info-disc (153657)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/153657'}]
CVE State: PUBLISHED
Explain CVE-2018-1962
IBM Security Identity Manager 7.0.1 Virtual Appliance does not invalidate session tokens when the logout button is pressed. The lack of proper session termination may allow attackers with local access to login into a closed browser session. IBM X-Force ID: 153658.
Affected Products: Security Identity Manager
References: [{'name': '106854', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/106854'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ibm.com/support/docview.wss?uid=ibm10796380'}, {'name': 'ibm-sim-cve20181962-info-disc(153658)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/153658'}]
CVE State: PUBLISHED
Explain CVE-2018-1967
IBM Security Identity Manager 6.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 153748.
Affected Products: Security Identity Manager
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.ibm.com/support/docview.wss?uid=ibm10794615'}, {'name': 'ibm-sim-cve20181967-xss(153748)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/153748'}, {'name': '106554', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/106554'}]
CVE State: PUBLISHED
Explain CVE-2018-1968
IBM Security Identity Manager 7.0.1 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 153749.
Affected Products: Security Identity Manager
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ibm.com/support/docview.wss?uid=ibm10958077'}, {'name': 'ibm-sim-cve20181968-info-disc (153749)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/153749'}]
CVE State: PUBLISHED
Explain CVE-2018-1969
IBM Security Identity Manager 6.0.0 allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. IBM X-Force ID: 153750.
Affected Products: Security Identity Manager
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.ibm.com/support/docview.wss?uid=ibm10794615'}, {'name': 'ibm-sim-cve20181969-file-upload(153750)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/153750'}, {'name': '106554', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/106554'}]
CVE State: PUBLISHED
Explain CVE-2018-1970
IBM Security Identity Manager 7.0.1 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 153751.
Affected Products: Security Identity Manager
References: [{'name': 'ibm-sim-cve20181970-info-disc(153751)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/153751'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ibm.com/support/docview.wss?uid=ibm10796380'}]
CVE State: PUBLISHED
Explain CVE-2018-1973
IBM API Connect 5.0.0.0 through 5.0.8.4 allows a user with limited 'API Administrator level access to give themselves full 'Administrator' level access through the members functionality. IBM X-Force ID: 153914.
Affected Products: API Connect
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.ibm.com/support/docview.wss?uid=ibm10788339'}, {'name': '106281', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/106281'}, {'name': 'ibm-api-cve20181973-priv-escalation(153914)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/153914'}]
CVE State: PUBLISHED
Explain CVE-2018-1974
IBM WebSphere 8.0.0.0 through 9.1.1 could allow an authenticated attacker to escalate their privileges when using multiplexed channels. IBM X-Force ID: 153915.
Affected Products: MQ
References: [{'name': 'ibm-websphere-cve20181974-priv-escalation(153915)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/153915'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.ibm.com/support/docview.wss?uid=ibm10792043'}]
CVE State: PUBLISHED
Explain CVE-2018-1975
IBM Rational DOORS Web Access 9.5.1 through 9.5.2.9, and 9.6 through 9.6.1.9 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 153916.
Affected Products: Rational DOORS Web Access
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ibm.com/support/docview.wss?uid=ibm10883198'}, {'name': 'ibm-dwa-cve20181975-xss (153916)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/153916'}]
CVE State: PUBLISHED
Explain CVE-2018-1976
IBM API Connect 5.0.0.0 through 5.0.8.4 is impacted by sensitive information disclosure via a REST API that could allow a user with administrative privileges to obtain highly sensitive information. IBM X-Force ID: 154031.
Affected Products: API Connect
References: [{'name': 'ibm-api-cve20181976-info-disc(154031)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/154031'}, {'name': '106792', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/106792'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.ibm.com/support/docview.wss?uid=ibm10843130'}]
CVE State: PUBLISHED
Explain CVE-2018-1977
IBM DB2 for Linux, UNIX and Windows 11.1 (includes DB2 Connect Server) contains a denial of service vulnerability. A remote, authenticated DB2 user could exploit this vulnerability by issuing a specially-crafted SELECT statement with TRUNCATE function. IBM X-Force ID: 154032.
Affected Products: DB2 for Linux, UNIX and Windows
References: [{'name': '106222', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/106222'}, {'name': 'ibm-db2-cve20181977-dos(154032)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/154032'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ibm.com/support/docview.wss?uid=ibm10788089'}]
CVE State: PUBLISHED
Explain CVE-2018-1978
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 is vulnerable to a buffer overflow, which could allow an authenticated local attacker to execute arbitrary code on the system as root. IBM X-ForceID: 154069.
Affected Products: DB2 for Linux, UNIX and Windows
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.ibm.com/support/docview.wss?uid=ibm10740413'}, {'name': '107398', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/107398'}, {'name': 'ibm-db2-cve20181978-bo(154069)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/154069'}]
CVE State: PUBLISHED
Explain CVE-2018-1980
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 is vulnerable to a buffer overflow, which could allow an authenticated local attacker to execute arbitrary code on the system as root. IBM X-ForceID: 154078.
Affected Products: DB2 for Linux, UNIX and Windows
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.ibm.com/support/docview.wss?uid=ibm10740413'}, {'name': 'ibm-db2-cve20181980-bo(154078)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/154078'}, {'name': '107398', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/107398'}]
CVE State: PUBLISHED
Explain CVE-2018-1982
IBM Rational Team Concert 5.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 154135.
Affected Products: Rational Team Concert
References: [{'name': 'ibm-rtc-cve20181982-xss(154135)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/154135'}, {'name': '107419', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/107419'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ibm.com/support/docview.wss?uid=ibm10875364'}]
CVE State: PUBLISHED
Explain CVE-2018-1983
IBM Rational Team Concert 5.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 154136.
Affected Products: Rational Team Concert
References: [{'name': 'ibm-rtc-cve20181983-xss(154136)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/154136'}, {'name': '107419', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/107419'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ibm.com/support/docview.wss?uid=ibm10875364'}]
CVE State: PUBLISHED
Explain CVE-2018-1984
IBM Rational Team Concert 5.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 154137.
Affected Products: Rational Team Concert
References: [{'name': '107419', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/107419'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ibm.com/support/docview.wss?uid=ibm10875364'}, {'name': 'ibm-rtc-cve20181984-xss(154137)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/154137'}]
CVE State: PUBLISHED
Explain CVE-2018-1985
IBM Trusteer Rapport/Apex 3.6.1908.22 contains an unused legacy driver which could allow a user with administrator privileges to cause a buffer overflow that would result in a kernel panic. IBM X-Force ID: 154207.
Affected Products: Security Trusteer Rapport
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.ibm.com/support/docview.wss?uid=ibm10869212'}, {'name': 'ibm-trusteer-cve20181985-dos (154207)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/154207'}]
CVE State: PUBLISHED
Explain CVE-2018-1987
IBM Spectrum Protect for Enterprise Resource Planning 7.1 and 8.1, if tracing is activated, the IBM Spectrum Protect node password may be displayed in plain text in the ERP trace file. IBM X-Force ID: 154280.
Affected Products: Spectrum Protect for Enterprise Resource Planning
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ibm.com/support/docview.wss?uid=ibm10883782'}, {'name': 'ibm-tivoli-cve20181987-info-disc (154280)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/154280'}]
CVE State: PUBLISHED
Explain CVE-2018-1990
IBM Cloud App Management V2018.2.0, V2018.4.0, and V2018.4.1 could allow an attacker to obtain sensitive configuration information using a specially crafted HTTP request. IBM X-Force ID: 154283.
Affected Products: Cloud App Management
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.ibm.com/support/docview.wss?uid=ibm10883350'}, {'name': 'ibm-cam-cve20181990-info-disc (154283)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/154283'}, {'name': '108327', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/108327'}]
CVE State: PUBLISHED
Explain CVE-2018-1991
IBM API Connect 5.0.0.0, and 5.0.8.6 could could return sensitive information that could provide critical information as to the underlying software stack in CMC UI headers. IBM X-Force ID: 154284.
Affected Products: API Connect
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.ibm.com/support/docview.wss?uid=ibm10871970'}, {'name': 'ibm-api-cve20181991-info-disc (154284)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/154284'}]
CVE State: PUBLISHED
Explain CVE-2018-1992
The IBM Power 9 OP910, OP920, and FW910 boot firmware's bootloader is responsible for loading and validating the initial boot firmware image that drives the rest of the system's hardware initialization. The bootloader firmware contains a buffer overflow vulnerability such that, if an attacker were able to replace the initial boot firmware image with a very carefully crafted and sufficiently large, malicious replacement, it could cause the bootloader, during the load of that image, to overwrite its own instruction memory and circumvent secure boot protections, install trojans, etc. IBM X-Force ID: 154345.
Affected Products: Power 9 Systems
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.ibm.com/support/docview.wss?uid=ibm10868992'}, {'name': 'ibm-power9-cve20181992-code-exec (154345)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/154345'}]
CVE State: PUBLISHED
Explain CVE-2018-1993
IBM Spectrum Scale (GPFS) 4.1.1, 4.2.0, 4.2.1, 4.2.2, 4.2.3, and 5.0.0 where the use of Local Read Only Cache (LROC) is enabled may caused read operation on a file to return data from a different file. IBM X-Force ID: 154440.
Affected Products: Spectrum Scale
References: [{'name': 'ibm-gpfs-cve20181993-info-disc(154440)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/154440'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.ibm.com/support/docview.wss?uid=ibm10793719'}, {'name': '106485', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/106485'}]
CVE State: PUBLISHED
Explain CVE-2018-1994
IBM InfoSphere Information Server 11.5 and 11.7 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 154494.
Affected Products: InfoSphere Information Server
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.ibm.com/support/docview.wss?uid=ibm10793871'}, {'name': 'ibm-infosphere-cve20181994-sql-injection (154494)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/154494'}]
CVE State: PUBLISHED
Explain CVE-2018-1996
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could provide weaker than expected security, caused by the improper TLS configuration. A remote attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 154650.
Affected Products: WebSphere Application Server
References: [{'name': 'ibm-websphere-cve20181996-info-disc(154650)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/154650'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.ibm.com/support/docview.wss?uid=ibm10793421'}, {'name': '107155', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/107155'}]
CVE State: PUBLISHED
Explain CVE-2018-1997
IBM Business Automation Workflow and Business Process Manager 18.0.0.0, 18.0.0.1, and 18.0.0.2 are vulnerable to a denial of service attack. An authenticated attacker might send a specially crafted request that exhausts server-side memory. IBM X-Force ID: 154774.
Affected Products: Business Automation Workflow
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.ibm.com/support/docview.wss?uid=ibm10794831'}, {'name': 'ibm-baw-cve20181997-dos (154774)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/154774'}]
CVE State: PUBLISHED
Explain CVE-2018-1998
IBM WebSphere MQ 8.0.0.0 through 9.1.1 could allow a local user to inject code that could be executed with root privileges. This is due to an incomplete fix for CVE-2018-1792. IBM X-ForceID: 154887.
Affected Products: MQ
References: [{'name': 'ibm-websphere-cve20181998-priv-escalation(154887)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/154887'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.ibm.com/support/docview.wss?uid=ibm10870488'}]
CVE State: PUBLISHED
Explain CVE-2018-1999
IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could reveal sensitive version information about the server from error pages that could aid an attacker in further attacks against the system. IBM X-Force ID: 154889.
Affected Products: Business Automation Workflow
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.ibm.com/support/docview.wss?uid=ibm10870502'}, {'name': 'ibm-bpm-cve20181999-info-disc (154889)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/154889'}]
CVE State: PUBLISHED
Explain CVE-2019-0001
Receipt of a malformed packet on MX Series devices with dynamic vlan configuration can trigger an uncontrolled recursion loop in the Broadband Edge subscriber management daemon (bbe-smgd), and lead to high CPU usage and a crash of the bbe-smgd service. Repeated receipt of the same packet can result in an extended denial of service condition for the device. Affected releases are Juniper Networks Junos OS: 16.1 versions prior to 16.1R7-S1; 16.2 versions prior to 16.2R2-S7; 17.1 versions prior to 17.1R2-S10, 17.1R3; 17.2 versions prior to 17.2R3; 17.3 versions prior to 17.3R3-S1; 17.4 versions prior to 17.4R2; 18.1 versions prior to 18.1R3; 18.2 versions prior to 18.2R2.
Affected Products: Junos OS
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://kb.juniper.net/JSA10900'}, {'name': '106541', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/106541'}, {'name': 'FEDORA-2019-5f14b810f8', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RMKFSHPMOZL7MDWU5RYOTIBTRWSZ4Z6X/'}, {'name': 'FEDORA-2019-815807c020', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W7CPKBW4QZ4VIY4UXIUVUSHRJ4R2FROE/'}]
CVE State: PUBLISHED
Explain CVE-2019-0002
On EX2300 and EX3400 series, stateless firewall filter configuration that uses the action 'policer' in combination with other actions might not take effect. When this issue occurs, the output of the command: show pfe filter hw summary will not show the entry for: RACL group Affected releases are Junos OS on EX2300 and EX3400 series: 15.1X53 versions prior to 15.1X53-D590; 18.1 versions prior to 18.1R3; 18.2 versions prior to 18.2R2. This issue affect both IPv4 and IPv6 firewall filter.
Affected Products: Junos OS
References: [{'name': '106669', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/106669'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.juniper.net/documentation/en_US/junos/topics/reference/command-summary/show-pfe-filter.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://kb.juniper.net/JSA10901'}]
CVE State: PUBLISHED
Explain CVE-2019-0003
When a specific BGP flowspec configuration is enabled and upon receipt of a specific matching BGP packet meeting a specific term in the flowspec configuration, a reachable assertion failure occurs, causing the routing protocol daemon (rpd) process to crash with a core file being generated. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D77 on SRX Series; 12.3 versions prior to 12.3R12-S10; 12.3X48 versions prior to 12.3X48-D70 on SRX Series; 14.1X53 versions prior to 14.1X53-D47 on EX2200/VC, EX3200, EX3300/VC, EX4200, EX4300, EX4550/VC, EX4600, EX6200, EX8200/VC (XRE), QFX3500, QFX3600, QFX5100; 15.1 versions prior to 15.1R3; 15.1F versions prior to 15.1F3; 15.1X49 versions prior to 15.1X49-D140 on SRX Series; 15.1X53 versions prior to 15.1X53-D59 on EX2300/EX3400.
Affected Products: Junos OS
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://kb.juniper.net/JSA10902'}, {'name': '106544', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/106544'}]
CVE State: PUBLISHED
Explain CVE-2019-0004
On Juniper ATP, the API key and the device key are logged in a file readable by authenticated local users. These keys are used for performing critical operations on the WebUI interface. This issue affects Juniper ATP 5.0 versions prior to 5.0.3.
Affected Products: Juniper ATP
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://kb.juniper.net/JSA10918'}]
CVE State: PUBLISHED
Explain CVE-2019-0005
On EX2300, EX3400, EX4600, QFX3K and QFX5K series, firewall filter configuration cannot perform packet matching on any IPv6 extension headers. This issue may allow IPv6 packets that should have been blocked to be forwarded. IPv4 packet filtering is unaffected by this vulnerability. Affected releases are Juniper Networks Junos OS on EX and QFX series;: 14.1X53 versions prior to 14.1X53-D47; 15.1 versions prior to 15.1R7; 15.1X53 versions prior to 15.1X53-D234 on QFX5200/QFX5110 series; 15.1X53 versions prior to 15.1X53-D591 on EX2300/EX3400 series; 16.1 versions prior to 16.1R7; 17.1 versions prior to 17.1R2-S10, 17.1R3; 17.2 versions prior to 17.2R3; 17.3 versions prior to 17.3R3; 17.4 versions prior to 17.4R2; 18.1 versions prior to 18.1R2.
Affected Products: n/a
References: [{'name': '106665', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/106665'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://kb.juniper.net/JSA10905'}]
CVE State: PUBLISHED
Explain CVE-2019-0006
A certain crafted HTTP packet can trigger an uninitialized function pointer deference vulnerability in the Packet Forwarding Engine manager (fxpc) on all EX, QFX and MX Series devices in a Virtual Chassis configuration. This issue can result in a crash of the fxpc daemon or may potentially lead to remote code execution. This issue only occurs when the crafted packet it destined to the device. Affected releases are Juniper Networks Junos OS: 14.1X53 versions prior to 14.1X53-D47 on EX and QFX Virtual Chassis Platforms; 15.1 versions prior to 15.1R7-S3 all Virtual Chassis Platforms 15.1X53 versions prior to 15.1X53-D50 on EX and QFX Virtual Chassis Platforms.
Affected Products: Junos OS
References: [{'name': '106666', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/106666'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://kb.juniper.net/JSA10906'}]
CVE State: PUBLISHED
Explain CVE-2019-0007
The vMX Series software uses a predictable IP ID Sequence Number. This leaves the system as well as clients connecting through the device susceptible to a family of attacks which rely on the use of predictable IP ID sequence numbers as their base method of attack. This issue was found during internal product security testing. Affected releases are Juniper Networks Junos OS: 15.1 versions prior to 15.1F5 on vMX Series.
Affected Products: Junos OS
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://kb.juniper.net/JSA10903'}, {'name': '106564', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/106564'}]
CVE State: PUBLISHED
Explain CVE-2019-0008
A certain sequence of valid BGP or IPv6 BFD packets may trigger a stack based buffer overflow in the Junos OS Packet Forwarding Engine manager (FXPC) process on QFX5000 series, EX4300, EX4600 devices. This issue can result in a crash of the fxpc daemon or may potentially lead to remote code execution. Affected releases are Juniper Networks Junos OS on QFX 5000 series, EX4300, EX4600 are: 14.1X53; 15.1X53 versions prior to 15.1X53-D235; 17.1 versions prior to 17.1R3; 17.2 versions prior to 17.2R3; 17.3 versions prior to 17.3R3-S2, 17.3R4; 17.4 versions prior to 17.4R2-S1, 17.4R3; 18.1 versions prior to 18.1R3-S1, 18.1R4; 18.2 versions prior to 18.2R2; 18.2X75 versions prior to 18.2X75-D30; 18.3 versions prior to 18.3R2.
Affected Products: Junos OS
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://kb.juniper.net/JSA10930'}, {'name': '107897', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/107897'}]
CVE State: PUBLISHED
Explain CVE-2019-0009
On EX2300 and EX3400 series, high disk I/O operations may disrupt the communication between the routing engine (RE) and the packet forwarding engine (PFE). In a virtual chassis (VC) deployment, this issue disrupts communication between the VC members. This issue does not affect other Junos platforms. Affected releases are Junos OS on EX2300 and EX3400 series: 15.1X53 versions prior to 15.1X53-D590; 18.1 versions prior to 18.1R2-S2, 18.1R3; 18.2 versions prior to 18.2R2.
Affected Products: Junos OS
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://kb.juniper.net/JSA10909'}, {'name': '106548', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/106548'}]
CVE State: PUBLISHED
Explain CVE-2019-0010
An SRX Series Service Gateway configured for Unified Threat Management (UTM) may experience a system crash with the error message "mbuf exceed" -- an indication of memory buffer exhaustion -- due to the receipt of crafted HTTP traffic. Each crafted HTTP packet inspected by UTM consumes mbufs which can be identified through the following log messages: all_logs.0:Jun 8 03:25:03 srx1 node0.fpc4 : SPU3 jmpi mbuf stall 50%. all_logs.0:Jun 8 03:25:13 srx1 node0.fpc4 : SPU3 jmpi mbuf stall 51%. all_logs.0:Jun 8 03:25:24 srx1 node0.fpc4 : SPU3 jmpi mbuf stall 52%. ... Eventually the system runs out of mbufs and the system crashes (fails over) with the error "mbuf exceed". This issue only occurs when HTTP AV inspection is configured. Devices configured for Web Filtering alone are unaffected by this issue. Affected releases are Junos OS on SRX Series: 12.1X46 versions prior to 12.1X46-D81; 12.3X48 versions prior to 12.3X48-D77; 15.1X49 versions prior to 15.1X49-D101, 15.1X49-D110.
Affected Products: Junos OS
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://kb.juniper.net/JSA10910'}, {'name': '106535', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/106535'}]
CVE State: PUBLISHED
Explain CVE-2019-0011
The Junos OS kernel crashes after processing a specific incoming packet to the out of band management interface (such as fxp0, me0, em0, vme0) destined for another address. By continuously sending this type of packet, an attacker can repeatedly crash the kernel causing a sustained Denial of Service. Affected releases are Juniper Networks Junos OS: 17.2 versions prior to 17.2R1-S7, 17.2R3; 17.3 versions prior to 17.3R3-S3; 17.4 versions prior to 17.4R1-S4, 17.4R2; 17.2X75 versions prior to 17.2X75-D110; 18.1 versions prior to 18.1R2.
Affected Products: Junos OS
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://kb.juniper.net/JSA10911'}, {'name': '106534', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/106534'}]
CVE State: PUBLISHED
Explain CVE-2019-0012
A Denial of Service (DoS) vulnerability in BGP in Juniper Networks Junos OS configured as a VPLS PE allows an attacker to craft a specific BGP message to cause the routing protocol daemon (rpd) process to crash and restart. While rpd restarts after a crash, repeated crashes can result in an extended DoS condition. This issue only affects PE routers configured with BGP Auto discovery for LDP VPLS. Other BGP configurations are unaffected by this vulnerability. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D81; 12.3 versions prior to 12.3R12-S12; 12.3X48 versions prior to 12.3X48-D76; 14.1X53 versions prior to 14.1X53-D48; 15.1 versions prior to 15.1F6-S12, 15.1R7-S2; 15.1X49 versions prior to 15.1X49-D150; 15.1X53 versions prior to 15.1X53-D235, 15.1X53-D495, 15.1X53-D590, 15.1X53-D68; 16.1 versions prior to 16.1R3-S10, 16.1R4-S12, 16.1R6-S6, 16.1R7-S1; 16.2 versions prior to 16.2R2-S7; 17.1 versions prior to 17.1R2-S9, 17.1R3; 17.2 versions prior to 17.2R1-S7, 17.2R2-S6, 17.2R3; 17.3 versions prior to 17.3R2-S4, 17.3R3; 17.4 versions prior to 17.4R1-S5, 17.4R2; 18.1 versions prior to 18.1R2-S3, 18.1R3.
Affected Products: Junos OS
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://kb.juniper.net/JSA10912'}, {'name': '106536', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/106536'}]
CVE State: PUBLISHED
Explain CVE-2019-0013
The routing protocol daemon (RPD) process will crash and restart when a specific invalid IPv4 PIM Join packet is received. While RPD restarts after a crash, repeated crashes can result in an extended Denial of Service (DoS) condition. This issue only affects IPv4 PIM. IPv6 PIM is unaffected by this vulnerability. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D77; 12.3X48 versions prior to 12.3X48-D77; 15.1 versions prior to 15.1F6-S10, 15.1R6-S6, 15.1R7; 15.1X49 versions prior to 15.1X49-D150; 15.1X53 versions prior to 15.1X53-D233, 15.1X53-D59; 16.1 versions prior to 16.1R3-S8, 16.1R4-S8, 16.1R7; 16.2 versions prior to 16.2R2-S6; 17.1 versions prior to 17.1R2-S6, 17.1R3; 17.2 versions prior to 17.2R2-S3, 17.2R3; 17.3 versions prior to 17.3R2-S4, 17.3R3; 17.4 versions prior to 17.4R2.
Affected Products: Junos OS
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://kb.juniper.net/JSA10913'}, {'name': '106519', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/106519'}]
CVE State: PUBLISHED
Explain CVE-2019-0014
On QFX and PTX Series, receipt of a malformed packet for J-Flow sampling might crash the FPC (Flexible PIC Concentrator) process which causes all interfaces to go down. By continuously sending the offending packet, an attacker can repeatedly crash the FPC process causing a sustained Denial of Service (DoS). This issue affects both IPv4 and IPv6 packet processing. Affected releases are Juniper Networks Junos OS on QFX and PTX Series: 17.4 versions prior to 17.4R2-S1, 17.4R3; 18.1 versions prior to 18.1R3-S1; 18.2 versions prior to 18.2R1-S3, 18.2R2; 17.2X75 versions prior to 17.2X75-D91, 17.2X75-D100.
Affected Products: Junos OS
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://kb.juniper.net/JSA10914'}, {'name': '106556', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/106556'}]
CVE State: PUBLISHED
Explain CVE-2019-0015
A vulnerability in the SRX Series Service Gateway allows deleted dynamic VPN users to establish dynamic VPN connections until the device is rebooted. A deleted dynamic VPN connection should be immediately disallowed from establishing new VPN connections. Due to an error in token caching, deleted users are allowed to connect once a previously successful dynamic VPN connection has been established. A reboot is required to clear the cached authentication token. Affected releases are Junos OS on SRX Series: 12.3X48 versions prior to 12.3X48-D75; 15.1X49 versions prior to 15.1X49-D150; 17.3 versions prior to 17.3R3; 17.4 versions prior to 17.4R2; 18.1 versions prior to 18.1R3; 18.2 versions prior to 18.2R2.
Affected Products: Junos OS
References: [{'name': '106668', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/106668'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://kb.juniper.net/JSA10915'}]
CVE State: PUBLISHED
Explain CVE-2019-0016
A malicious authenticated user may be able to delete a device from the Junos Space database without the necessary privileges through crafted Ajax interactions obtained from another legitimate delete action performed by another administrative user. Affected releases are Juniper Networks Junos Space versions prior to 18.3R1.
Affected Products: Junos Space
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://kb.juniper.net/JSA10917'}]
CVE State: PUBLISHED
Explain CVE-2019-0017
The Junos Space application, which allows Device Image files to be uploaded, has insufficient validity checking which may allow uploading of malicious images or scripts, or other content types. Affected releases are Juniper Networks Junos Space versions prior to 18.3R1.
Affected Products: Junos Space
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://kb.juniper.net/JSA10917'}]
CVE State: PUBLISHED
Explain CVE-2019-0018
A persistent cross-site scripting (XSS) vulnerability in the file upload menu of Juniper ATP may allow an authenticated user to inject arbitrary scripts and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on administrative user to perform administrative actions on the device. This issue affects Juniper ATP 5.0 versions prior to 5.0.3.
Affected Products: Juniper ATP
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://kb.juniper.net/JSA10918'}]
CVE State: PUBLISHED
Explain CVE-2019-0019
When BGP tracing is enabled an incoming BGP message may cause the Junos OS routing protocol daemon (rpd) process to crash and restart. While rpd restarts after a crash, repeated crashes can result in an extended DoS condition. Affected releases are Juniper Networks Junos OS: 16.1 versions prior to 16.1R7-S4, 16.1R7-S5; 16.2 versions prior to 16.2R2-S9, 16.2R3; 17.1 versions prior to 17.1R3; 17.2 versions prior to 17.2R3-S1; 17.3 versions prior to 17.3R3-S3, 17.3R3-S4, 17.3R4; 17.4 versions prior to 17.4R1-S7, 17.4R2-S3, 17.4R2-S4, 17.4R3; 18.1 versions prior to 18.1R2-S4, 18.1R3-S4, 18.1R4; 18.2 versions prior to 18.2R2-S2, 18.2R2-S3, 18.2R3; 18.2X75 versions prior to 18.2X75-D40; 18.3 versions prior to 18.3R1-S3, 18.3R2; 18.4 versions prior to 18.4R1-S2, 18.4R2. This issue does not affect Junos releases prior to 16.1R1.
Affected Products: Junos OS
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://kb.juniper.net/JSA10931'}, {'name': '107893', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/107893'}]
CVE State: PUBLISHED
Explain CVE-2019-0020
Juniper ATP ships with hard coded credentials in the Web Collector instance which gives an attacker the ability to take full control of any installation of the software. Affected releases are Juniper Networks Juniper ATP: 5.0 versions prior to 5.0.3.
Affected Products: Juniper ATP
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://kb.juniper.net/JSA10918'}]
CVE State: PUBLISHED
Explain CVE-2019-0021
On Juniper ATP, secret passphrase CLI inputs, such as "set mcm", are logged to /var/log/syslog in clear text, allowing authenticated local user to be able to view these secret information. This issue affects Juniper ATP 5.0 versions prior to 5.0.4.
Affected Products: Juniper ATP
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://kb.juniper.net/JSA10918'}]
CVE State: PUBLISHED
Explain CVE-2019-0022
Juniper ATP ships with hard coded credentials in the Cyphort Core instance which gives an attacker the ability to take full control of any installation of the software. Affected releases are Juniper Networks Juniper ATP: 5.0 versions prior to 5.0.3.
Affected Products: Juniper ATP
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://kb.juniper.net/JSA10918'}]
CVE State: PUBLISHED
Explain CVE-2019-0023
A persistent cross-site scripting (XSS) vulnerability in the Golden VM menu of Juniper ATP may allow authenticated user to inject arbitrary script and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on administrative user to perform administrative actions on the device. This issue affects Juniper ATP 5.0 versions prior to 5.0.3.
Affected Products: Juniper ATP
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://kb.juniper.net/JSA10918'}]
CVE State: PUBLISHED
Explain CVE-2019-0024
A persistent cross-site scripting (XSS) vulnerability in the Email Collectors menu of Juniper ATP may allow authenticated user to inject arbitrary script and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on administrative user to perform administrative actions on the device. This issue affects Juniper ATP 5.0 versions prior to 5.0.3.
Affected Products: Juniper ATP
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://kb.juniper.net/JSA10918'}]
CVE State: PUBLISHED
Explain CVE-2019-0025
A persistent cross-site scripting (XSS) vulnerability in RADIUS configuration menu of Juniper ATP may allow authenticated user to inject arbitrary script and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on administrative user to perform administrative actions on the device. This issue affects Juniper ATP 5.0 versions prior to 5.0.3.
Affected Products: Juniper ATP
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://kb.juniper.net/JSA10918'}]
CVE State: PUBLISHED
Explain CVE-2019-0026
A persistent cross-site scripting (XSS) vulnerability in the Zone configuration of Juniper ATP may allow authenticated user to inject arbitrary script and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on administrative user to perform administrative actions on the device. This issue affects Juniper ATP 5.0 versions prior to 5.0.3.
Affected Products: Juniper ATP
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://kb.juniper.net/JSA10918'}]
CVE State: PUBLISHED
Explain CVE-2019-0027
A persistent cross-site scripting (XSS) vulnerability in the Snort Rules configuration of Juniper ATP may allow authenticated user to inject arbitrary script and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on administrative user to perform administrative actions on the device. This issue affects Juniper ATP 5.0 versions prior to 5.0.3.
Affected Products: Juniper ATP
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://kb.juniper.net/JSA10918'}]
CVE State: PUBLISHED
Explain CVE-2019-0028
On Junos devices with the BGP graceful restart helper mode enabled or the BGP graceful restart mechanism enabled, a BGP session restart on a remote peer that has the graceful restart mechanism enabled may cause the local routing protocol daemon (RPD) process to crash and restart. By simulating a specific BGP session restart, an attacker can repeatedly crash the RPD process causing prolonged denial of service (DoS). Graceful restart helper mode for BGP is enabled by default. No other Juniper Networks products or platforms are affected by this issue. Affected releases are Juniper Networks Junos OS: 16.1 versions prior to 16.1R7; 16.1X65 versions prior to 16.1X65-D48; 16.2 versions prior to 16.2R2-S8; 17.1 versions prior to 17.1R2-S7, 17.1R3; 17.2 versions prior to 17.2R1-S7, 17.2R3; 17.2X75 versions prior to 17.2X75-D92, 17.2X75-D102, 17.2X75-D110; 17.3 versions prior to 17.3R2-S2, 17.3R3; 17.4 versions prior to 17.4R1-S4, 17.4R2; 18.1 versions prior to 18.1R2. Junos OS releases prior to 16.1R1 are not affected.
Affected Products: Junos OS
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://kb.juniper.net/JSA10932'}, {'name': '107892', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/107892'}]
CVE State: PUBLISHED
Explain CVE-2019-0029
Juniper ATP Series Splunk credentials are logged in a file readable by authenticated local users. Using these credentials an attacker can access the Splunk server. This issue affects Juniper ATP 5.0 versions prior to 5.0.3.
Affected Products: Juniper ATP
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://kb.juniper.net/JSA10918'}]
CVE State: PUBLISHED
Explain CVE-2019-0030
Juniper ATP uses DES and a hardcoded salt for password hashing, allowing for trivial de-hashing of the password file contents. This issue affects Juniper ATP 5.0 versions prior to 5.0.3.
Affected Products: Juniper ATP
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://kb.juniper.net/JSA10918'}]
CVE State: PUBLISHED
Explain CVE-2019-0031
Specific IPv6 DHCP packets received by the jdhcpd daemon will cause a memory resource consumption issue to occur on a Junos OS device using the jdhcpd daemon configured to respond to IPv6 requests. Once started, memory consumption will eventually impact any IPv4 or IPv6 request serviced by the jdhcpd daemon, thus creating a Denial of Service (DoS) condition to clients requesting and not receiving IP addresses. Additionally, some clients which were previously holding IPv6 addresses will not have their IPv6 Identity Association (IA) address and network tables agreed upon by the jdhcpd daemon after the failover event occurs, which leads to more than one interface, and multiple IP addresses, being denied on the client. Affected releases are Juniper Networks Junos OS: 17.4 versions prior to 17.4R2; 18.1 versions prior to 18.1R2.
Affected Products: Junos OS
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://kb.juniper.net/JSA10920'}, {'name': '107874', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/107874'}]
CVE State: PUBLISHED
Explain CVE-2019-0032
A password management issue exists where the Organization authentication username and password were stored in plaintext in log files. A locally authenticated attacker who is able to access these stored plaintext credentials can use them to login to the Organization. Affected products are: Juniper Networks Service Insight versions from 15.1R1, prior to 18.1R1. Service Now versions from 15.1R1, prior to 18.1R1.
Affected Products: Service Insight
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://kb.juniper.net/JSA10921'}, {'tags': ['x_refsource_MISC'], 'url': 'https://kb.juniper.net/KB27572'}, {'name': '107885', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/107885'}]
CVE State: PUBLISHED
Explain CVE-2019-0033
A firewall bypass vulnerability in the proxy ARP service of Juniper Networks Junos OS allows an attacker to cause a high CPU condition leading to a Denial of Service (DoS). This issue affects only IPv4. Affected releases are Juniper Networks Junos OS: 12.1X46 versions above and including 12.1X46-D25 prior to 12.1X46-D71, 12.1X46-D73 on SRX Series; 12.3X48 versions prior to 12.3X48-D50 on SRX Series; 15.1X49 versions prior to 15.1X49-D75 on SRX Series.
Affected Products: Junos OS
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://kb.juniper.net/JSA10922'}, {'name': '107882', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/107882'}]
CVE State: PUBLISHED