Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-47461 State: PUBLISHED Published: 2024-11-05T22:54:12.794Z Last Updated: 2024-11-09T04:55:49.787Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: HPE Aruba Networking Access Points, Instant AOS-8, and AOS-10 Description: An authenticated command injection vulnerability exists in the Instant AOS-8 and AOS-10 command line interface. A successful exploitation of this vulnerability results in the ability to execute arbitrary commands as a privileged user on the underlying operating system. This allows an attacker to fully compromise the underlying host operating system. Additional Analyst Notes: - CISA AD
m. This allows an attacker to fully compromise the underlying host operating system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04722en_us&docLocale=en_US
CVE ID: CVE-2024-47462 State: PUBLISHED Published: 2024-11-05T22:57:44.838Z Last Updated: 2024-11-09T04:55:51.057Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: HPE Aruba Networking Access Points, Instant AOS-8, and AOS-10 Description: An arbitrary file creation vulnerability exists in the Instant AOS-8 and AOS-10 command line interface. Successful exploitation of this vulnerability could allow an authenticated remote attacker to create arbitrary files, which could lead to a remote command execution (RCE) on the underlying operating system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sup
n (RCE) on the underlying operating system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04722en_us&docLocale=en_US
CVE ID: CVE-2024-47463 State: PUBLISHED Published: 2024-11-05T22:59:04.966Z Last Updated: 2024-11-09T04:55:52.279Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: HPE Aruba Networking Access Points, Instant AOS-8, and AOS-10 Description: An arbitrary file creation vulnerability exists in the Instant AOS-8 and AOS-10 command line interface. Successful exploitation of this vulnerability could allow an authenticated remote attacker to create arbitrary files, which could lead to a remote command execution (RCE) on the underlying operating system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sup
CVE ID: CVE-2024-47464 State: PUBLISHED Published: 2024-11-05T23:02:58.693Z Last Updated: 2024-11-06T15:13:53.837Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: Hewlett Packard Enterprise (HPE) Products: HPE Aruba Networking Access Points, Instant AOS-8, and AOS-10 Description: An authenticated Path Traversal vulnerability exists in Instant AOS-8 and AOS-10. Successful exploitation of this vulnerability allows an attacker to copy arbitrary files to a user readable location from the command line interface of the underlying operating system, which could lead to a remote unauthorized access to files. Additional Analyst Notes: - CISA ADP Vulnrichment: Referenc
, which could lead to a remote unauthorized access to files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04722en_us&docLocale=en_US
CVE ID: CVE-2024-47475 State: PUBLISHED Published: 2025-01-06T17:08:56.655Z Last Updated: 2025-01-06T17:20:30.299Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H) Vendors: Dell Products: PowerScale OneFS Problem Types: CWE-732 Description: Dell PowerScale OneFS 8.2.2.x through 9.8.0.x contains an incorrect permission assignment for critical resource vulnerability. A locally authenticated attacker could potentially exploit this vulnerability, leading to denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000242681/dsa-2024-417-security-update-for-dell-powerscale-onefs-for-security-vulnerability
CVE ID: CVE-2024-47476 State: PUBLISHED Published: 2024-12-03T09:59:07.362Z Last Updated: 2024-12-03T14:31:23.670Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Dell Products: NetWorker Management Console Problem Types: CWE-347 Description: Dell NetWorker Management Console, version(s) 19.11, contain(s) an Improper Verification of Cryptographic Signature vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000255884/dsa-2024-477-security-update-for-dell-networker-runtime-env
rences: - https://www.dell.com/support/kbdoc/en-us/000255884/dsa-2024-477-security-update-for-dell-networker-runtime-environment-nre-multiple-component-vulnerabilities
CVE ID: CVE-2024-47480 State: PUBLISHED Published: 2024-12-18T01:05:52.229Z Last Updated: 2024-12-18T15:13:12.412Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: Inventory Collector Client Problem Types: CWE-61 Description: Dell Inventory Collector Client, versions prior to 12.7.0, contains an Improper Link Resolution Before File Access vulnerability. A low-privilege attacker with local access may exploit this vulnerability, potentially resulting in Elevation of Privileges and unauthorized file system access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000255700/dsa-2024-475
CVE ID: CVE-2024-47481 State: PUBLISHED Published: 2024-10-25T10:54:01.210Z Last Updated: 2024-10-25T13:54:06.486Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Dell Products: Dell Data Lakehouse Problem Types: CWE-284 Description: Dell Data Lakehouse, version(s) 1.0.0.0, 1.1.0., contain(s) an Improper Access Control vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000240535/dsa-2024-419-security-update-for-dell-data-lakehouse-system-software-for-multiple
dell.com/support/kbdoc/en-us/000240535/dsa-2024-419-security-update-for-dell-data-lakehouse-system-software-for-multiple-third-party-component-vulnerabilities
CVE ID: CVE-2024-47483 State: PUBLISHED Published: 2024-10-25T10:59:45.160Z Last Updated: 2024-10-25T13:53:16.503Z Severity: LOW (CVSS 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Dell Products: Data Lakehouse Problem Types: CWE-89 Description: Dell Data Lakehouse, version(s) 1.0.0.0 and 1.1.0.0, contain(s) an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Information disclosure. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000240535/dsa-2024-419-security-update-fo
CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000240535/dsa-2024-419-security-update-for-dell-data-lakehouse-system-software-for-multiple-third-party-component-vulnerabilities
CVE ID: CVE-2024-47484 State: PUBLISHED Published: 2024-12-10T10:21:56.484Z Last Updated: 2025-08-04T18:38:34.491Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L) Vendors: Dell Products: Avamar Problem Types: CWE-89 Description: Dell Avamar, versions prior to 19.12 with patch 338905, excluding 19.10 and 19.10SP1 with patch 338869, contains an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Command execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000
execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000258636/dsa-2024-489-security-update-for-dell-avamar-and-dell-avamar-virtual-edition-security-update-for-multiple-vulnerabilities
CVE ID: CVE-2024-47485 State: PUBLISHED Published: 2024-10-18T08:29:38.392Z Last Updated: 2025-03-13T15:44:47.391Z Vendors: Hikvision Products: HikCentral Master Lite Description: There is a CSV injection vulnerability in some HikCentral Master Lite versions. If exploited, an attacker could build malicious data to generate executable commands in the CSV file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerabilities-in-hikcentral-product-series/
CVE ID: CVE-2024-47486 State: PUBLISHED Published: 2024-10-18T08:33:07.095Z Last Updated: 2024-11-21T14:54:17.043Z Vendors: Hikvision Products: HikCentral Master Lite Description: There is an XSS vulnerability in some HikCentral Master Lite versions. If exploited, an attacker could inject scripts into certain pages by building malicious data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerabilities-in-hikcentral-product-series/
CVE ID: CVE-2024-47487 State: PUBLISHED Published: 2024-10-18T08:32:45.182Z Last Updated: 2025-03-19T17:46:20.453Z Vendors: Hikvision Products: HikCentral Professional Description: There is a SQL injection vulnerability in some HikCentral Professional versions. This could allow an authenticated user to execute arbitrary SQL queries. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerabilities-in-hikcentral-product-series/
CVE ID: CVE-2024-47489 State: PUBLISHED Published: 2024-10-11T15:22:00.413Z Last Updated: 2024-10-11T18:00:33.801Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L) Vendors: Juniper Networks Products: Junos OS Evolved Problem Types: CWE-755 Description: An Improper Handling of Exceptional Conditions vulnerability in the Packet Forwarding Engine (pfe) of the Juniper Networks Junos OS Evolved on ACX Series devices allows an unauthenticated, network based attacker sending specific transit protocol traffic to cause a partial Denial of Service (DoS) to downstream devices. Receipt of specific transit protocol packets is incorrectly processed by the Routing Engine (RE), filli
nstream devices. Receipt of specific transit protocol packets is incorrectly processed by the Routing Engine (RE), filling up the DDoS protection queue which is shared between routing protocols. This influx of transit protocol packets causes DDoS protection violations, resulting in protocol flaps which can affect connectivity to networking devices. This issue affects both IPv4 and IPv6. This issue does not require any specific routing protocol to be configured or enabled. The following commands can be used to monitor the DDoS protection queue: labuser@re0> show evo-pfemand host pkt-stats labuser@re0> show host-path ddos all-policers This issue affects Junos OS Evolved: * All versions before
host pkt-stats labuser@re0> show host-path ddos all-policers This issue affects Junos OS Evolved: * All versions before 21.4R3-S8-EVO, * from 22.2 before 22.2R3-S4-EVO, * from 22.3 before 22.3R3-S4-EVO, * from 22.4 before 22.4R3-S3-EVO, * from 23.2 before 23.2R2-EVO, * from 23.4 before 23.4R1-S1-EVO, 23.4R2-EVO, * from 24.2 before 24.2R2-EVO. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://supportportal.juniper.net/
CVE ID: CVE-2024-47490 State: PUBLISHED Published: 2024-10-11T15:22:39.517Z Last Updated: 2024-10-11T17:57:25.544Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: Juniper Networks Products: Junos OS Evolved Problem Types: CWE-923 Description: An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS Evolved on ACX 7000 Series allows an unauthenticated, network based attacker to cause increased consumption of resources, ultimately resulting in a Denial of Service (DoS). When specific transit MPLS packets are received by the PFE, these packets are internally forwarded t
l of Service (DoS). When specific transit MPLS packets are received by the PFE, these packets are internally forwarded to the Routing Engine (RE), rather than being handled appropriately. Continuous receipt of these MPLS packets causes resources to be exhausted. MPLS config is not required to be affected by this issue. This issue affects Junos OS Evolved ACX 7000 Series: * All versions before 21.4R3-S9-EVO, * 22.2-EVO before 22.2R3-S4-EVO, * 22.3-EVO before 22.3R3-S3-EVO, * 22.4-EVO before 22.4R3-S2-EVO, * 23.2-EVO before 23.2R2-EVO, * 23.4-EVO before 23.4R1-S1-EVO, 23.4R2-EVO. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://supportportal.juniper.net/JSA83009
CVE ID: CVE-2024-47491 State: PUBLISHED Published: 2024-10-11T15:23:08.762Z Last Updated: 2024-10-22T19:12:09.407Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Juniper Networks Products: Junos OS, Junos OS Evolved Problem Types: CWE-755 Description: An Improper Handling of Exceptional Conditions vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-based, unauthenticated attacker to cause Denial of Service (DoS). When a BGP UPDATE with malformed path attribute is received over an established BGP session, rpd crashes and restarts. Continuous receipt of a BGP UPDATE with a specifically malforme
er an established BGP session, rpd crashes and restarts. Continuous receipt of a BGP UPDATE with a specifically malformed path attribute will create a sustained Denial of Service (DoS) condition for impacted devices. While this issue affects systems running 32-bit and 64-bit systems, the probability of impact on 64-bit system is extremely low. According to KB25803 https://supportportal.juniper.net/s/article/Junos-How-to-check-if-Junos-OS-is-64-or-32-bit-on-a-router , customers can confirm 32-bit or 64-bit system via the ' show version detail ' command: lab@router> show version detail| match 32 JUNOS 32-bit kernel Software Suite lab@router> show version detail| match 64 JUNOS 64-bit kernel So
ion detail| match 32 JUNOS 32-bit kernel Software Suite lab@router> show version detail| match 64 JUNOS 64-bit kernel Software Suite This issue affects: Juniper Networks Junos OS: * All versions before 21.4R3-S8, * from 22.2 before 22.2R3-S4, * from 22.4 before 22.4R3-S3, * from 23.2 before 23.2R2-S1, * from 23.4 before 23.4R1-S2, 23.4R2. Juniper Networks Junos OS Evolved: * All versions before 21.4R3-S8-EVO, * from 22.2 before 22.2R3-S4-EVO, * from 22.4 before 22.4R3-S3-EVO, * from 23.2 before 23.2R2-S1-EVO, * from 23.4 before 23.4R1-S2-EVO, 23.4R2-EVO. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://supportportal.juniper.net/
CVE ID: CVE-2024-47493 State: PUBLISHED Published: 2024-10-11T15:24:02.438Z Last Updated: 2024-11-08T17:17:27.242Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Juniper Networks Products: Junos OS Problem Types: CWE-401 Description: A Missing Release of Memory after Effective Lifetime vulnerability in the Packet Forwarding Engine (PFE) of the Juniper Networks Junos OS on the MX Series platforms with Trio-based FPCs allows an unauthenticated, adjacent attacker to cause a Denial of Service (DoS). In case of channelized Modular Interface Cards (MICs), every physical interface flap operation will leak heap memory. Over a period of time, continuous physical int
ds (MICs), every physical interface flap operation will leak heap memory. Over a period of time, continuous physical interface flap operations causes local FPC to eventually run out of memory and crash. Below CLI command can be used to check the memory usage over a period of time: user@host> show chassis fpc Temp CPU Utilization (%) CPU Utilization (%) Memory Utilization (%) Slot State (C) Total Interrupt 1min 5min 15min DRAM (MB) Heap Buffer 0 Online 43 41 2 2048 49 14 1 Online 43 41 2 2048 49 14 2 Online 43 41 2 2048 49 14 This issue affects Junos OS on MX Series: * All versions before 21.2R3-S7, * from 21.4 before 21.4R3-S6, * from 22.1 before 22.1R3-S5, * from 22.2 before 22.2R3-S3, * fr
ersions before 21.2R3-S7, * from 21.4 before 21.4R3-S6, * from 22.1 before 22.1R3-S5, * from 22.2 before 22.2R3-S3, * from 22.3 before 22.3R3-S2, * from 22.4 before 22.4R3, * from 23.2 before 23.2R2, * from 23.4 before 23.4R2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://supportportal.juniper.net/ - https://www.juniper.net/documentation/us/en/software/junos/interfaces-link-multilink/topics/topic-map/link-multilink-services-understanding.html#id-multilink-interfaces-on-channelized-mics-overview
CVE ID: CVE-2024-47494 State: PUBLISHED Published: 2024-10-11T15:24:35.820Z Last Updated: 2024-10-11T17:48:37.447Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Juniper Networks Products: Junos OS Problem Types: CWE-367 Description: A Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in the AgentD process of Juniper Networks Junos OS allows an attacker who is already causing impact to established sessions which generates counter changes picked up by the AgentD process during telemetry polling, to move the AgentD process into a state where AgentD attempts to reap an already destroyed sensor. This reaping attempt then leads to memory corruption
a state where AgentD attempts to reap an already destroyed sensor. This reaping attempt then leads to memory corruption causing the FPC to crash which is a Denial of Service (DoS). The FPC will recover automatically without user intervention after the crash. This issue affects Junos OS: * All versions before 21.4R3-S9 * From 22.2 before 22.2R3-S5, * From 22.3 before 22.3R3-S4, * From 22.4 before 22.4R3-S3, * From 23.2 before 23.2R2-S2, * From 23.4 before 23.4R2. This issue does not affect Junos OS Evolved. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://supportportal.juniper.net/JSA88121
CVE ID: CVE-2024-47495 State: PUBLISHED Published: 2024-10-11T15:27:08.344Z Last Updated: 2024-10-11T17:46:59.833Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Juniper Networks Products: Junos OS Evolved Problem Types: CWE-639 Description: An Authorization Bypass Through User-Controlled Key vulnerability allows a locally authenticated attacker with shell access to gain full control of the device when Dual Routing Engines (REs) are in use on Juniper Networks Junos OS Evolved devices. This issue affects: Juniper Networks Junos OS Evolved with dual-REs: * All versions before 21.2R3-S8-EVO, * from 21.4-EVO before 21.4R3-S8-EVO, * from 22.2-EVO before 22.2R3-S
ith dual-REs: * All versions before 21.2R3-S8-EVO, * from 21.4-EVO before 21.4R3-S8-EVO, * from 22.2-EVO before 22.2R3-S4-EVO, * from 22.3-EVO before 22.3R3-S4-EVO, * from 22.4-EVO before 22.4R3-S3-EVO, * from 23.2-EVO before 23.2R2-S1-EVO, * from 23.4-EVO before 23.4R2-S1-EVO. This issue does not affect Juniper Networks Junos OS. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://kb.juniper.net/JSA88122
CVE ID: CVE-2024-47496 State: PUBLISHED Published: 2024-10-11T15:28:13.727Z Last Updated: 2024-10-11T17:42:39.299Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Juniper Networks Products: Junos OS Problem Types: CWE-476 Description: A NULL Pointer Dereference vulnerability in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS allows a local, low-privileged attacker to cause a Denial-of-Service (DoS). When a specific command is executed, the pfe crashes. This will cause traffic forwarding to be interrupted until the system self-recovers. Repeated execution will create a sustained DoS condition. This issue only affects MX Series devices with Lin
f-recovers. Repeated execution will create a sustained DoS condition. This issue only affects MX Series devices with Line cards MPC1-MPC9. This issue affects: Junos OS on MX Series: * All versions before 21.4R3-S9, * from 22.2 before 22.2R3-S5, * from 22.3 before 22.3R3-S4, * from 22.4 before 22.4R3-S2, * from 23.2 before 23.2R2-S1, * from 23.4 before 23.4R2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://supportportal.juniper.net/
CVE ID: CVE-2024-47497 State: PUBLISHED Published: 2024-10-11T15:28:49.424Z Last Updated: 2024-10-11T17:41:24.159Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Juniper Networks Products: Junos OS Problem Types: CWE-400 Description: An Uncontrolled Resource Consumption vulnerability in the http daemon (httpd) of Juniper Networks Junos OS on SRX Series, QFX Series, MX Series and EX Series allows an unauthenticated, network-based attacker to cause Denial-of-Service (DoS). An attacker can send specific HTTPS connection requests to the device, triggering the creation of processes that are not properly terminated. Over time, this leads to resource exhaustion, ult
triggering the creation of processes that are not properly terminated. Over time, this leads to resource exhaustion, ultimately causing the device to crash and restart. The following command can be used to monitor the resource usage: user@host> show system processes extensive | match mgd | count This issue affects Junos OS on SRX Series and EX Series: All versions before 21.4R3-S7, from 22.2 before 22.2R3-S4, from 22.3 before 22.3R3-S3, from 22.4 before 22.4R3-S2, from 23.2 before 23.2R2-S1, from 23.4 before 23.4R1-S2, 23.4R2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://supportportal.juniper.net/
CVE ID: CVE-2024-47498 State: PUBLISHED Published: 2024-10-11T15:30:02.282Z Last Updated: 2024-10-11T17:38:01.248Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Juniper Networks Products: Junos OS Evolved Problem Types: CWE 447 Unimplemented or Unsupported Feature in UI Description: An Unimplemented or Unsupported Feature in UI vulnerability in the CLI of Juniper Networks Junos OS Evolved on QFX5000 Series allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS). Several configuration statements meant to enforce limits on MAC learning and moves can be configured but do not take effect. This can lead to control plane overload situatio
its on MAC learning and moves can be configured but do not take effect. This can lead to control plane overload situations which will severely impact the ability of the device to processes legitimate traffic. This issue affects Junos OS Evolved on QFX5000 Series: * All versions before 21.4R3-S8-EVO, * 22.2-EVO versions before 22.2R3-S5-EVO, * 22.4-EVO versions before 22.4R3-EVO, * 23.2-EVO versions before 23.2R2-EVO. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://supportportal.juniper.net/JSA88128
CVE ID: CVE-2024-47499 State: PUBLISHED Published: 2024-10-11T15:30:36.930Z Last Updated: 2024-10-11T17:37:24.608Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Juniper Networks Products: Junos OS, Junos OS Evolved Problem Types: CWE-754 Description: An Improper Check for Unusual or Exceptional Conditions vulnerability in the routing protocol daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network based attacker to cause a Denial of Service (DoS). In a scenario where BGP Monitoring Protocol (BMP) is configured with rib-in pre-policy monitoring, receiving a BGP update with a specifically malformed AS PATH attribute ov