Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-30624 State: PUBLISHED Published: 2025-06-06T12:54:24.591Z Last Updated: 2025-06-06T16:02:09.338Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: WordLift Products: WordLift Problem Types: CWE-862 Description: Missing Authorization vulnerability in WordLift WordLift allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WordLift: from n/a through 3.54.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wordlift/vulnerability/wordpress-wordlift-3-54-4-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-30625 State: PUBLISHED Published: 2025-06-06T12:54:24.142Z Last Updated: 2025-06-06T16:02:16.136Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Matt Pramschufer Products: AppBanners Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matt Pramschufer AppBanners allows Stored XSS. This issue affects AppBanners: from n/a through 1.5.14. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/appbanners/vulnerability/wordpress-appbanners-1-5-14-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-30626 State: PUBLISHED Published: 2025-08-14T10:34:30.974Z Last Updated: 2025-08-14T19:43:06.116Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: LambertGroup Products: Multimedia Playlist Slider Addon for WPBakery Page Builder Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Multimedia Playlist Slider Addon for WPBakery Page Builder allows Reflected XSS. This issue affects Multimedia Playlist Slider Addon for WPBakery Page Builder: from n/a through 2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/dat
ilder: from n/a through 2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/lbg_vp_youtube_vimeo_addon_visual_composer/vulnerability/wordpress-multimedia-playlist-slider-addon-for-wpbakery-page-builder-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-30627 State: PUBLISHED Published: 2025-06-06T12:54:23.683Z Last Updated: 2025-06-06T16:02:25.845Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: regolithsjk Products: Elegant Visitor Counter Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in regolithsjk Elegant Visitor Counter allows Stored XSS. This issue affects Elegant Visitor Counter: from n/a through 3.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/elegant-visitor-counter/vulnerability/wordpress-elegant-visitor-counter-3-1-cross-sit
tack.com/database/wordpress/plugin/elegant-visitor-counter/vulnerability/wordpress-elegant-visitor-counter-3-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-30629 State: PUBLISHED Published: 2025-06-06T12:54:23.205Z Last Updated: 2025-06-06T16:02:33.392Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Codehaveli Products: Bitly URL Shortener Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Codehaveli Bitly URL Shortener allows Cross Site Request Forgery. This issue affects Bitly URL Shortener: from n/a through 1.3.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/codehaveli-bitly-url-shortener/vulnerability/wordpress-bitly-url-shortener-1-3-3-cross-site-request-forgery-csrf-vulnerability?_s_i
bitly-url-shortener/vulnerability/wordpress-bitly-url-shortener-1-3-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-30630 State: PUBLISHED Published: 2025-06-06T12:54:22.736Z Last Updated: 2025-06-06T16:02:40.785Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: pozzad Products: Global Translator Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pozzad Global Translator allows Stored XSS. This issue affects Global Translator: from n/a through 2.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/global-translator/vulnerability/wordpress-global-translator-2-0-2-cross-site-scripting-xss-vulnerability?_s_id=
s/plugin/global-translator/vulnerability/wordpress-global-translator-2-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-30632 State: PUBLISHED Published: 2025-06-06T12:54:22.264Z Last Updated: 2025-06-06T16:02:49.479Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: pozzad Products: Global Translator Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in pozzad Global Translator allows Cross Site Request Forgery. This issue affects Global Translator: from n/a through 2.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/global-translator/vulnerability/wordpress-global-translator-2-0-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-30634 State: PUBLISHED Published: 2025-06-06T12:54:21.791Z Last Updated: 2025-06-06T16:02:57.563Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: IWEBIX Products: WP Featured Content Slider Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IWEBIX WP Featured Content Slider allows Stored XSS. This issue affects WP Featured Content Slider: from n/a through 2.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-featured-content-slider/vulnerability/wordpress-wp-featured-content-slider-2-6-cros
ack.com/database/wordpress/plugin/wp-featured-content-slider/vulnerability/wordpress-wp-featured-content-slider-2-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-30635 State: PUBLISHED Published: 2025-08-14T10:34:30.395Z Last Updated: 2025-08-14T15:03:39.186Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ThemeAtelier Products: IDonatePro Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeAtelier IDonatePro allows PHP Local File Inclusion. This issue affects IDonatePro: from n/a through 2.1.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/idonate-pro/vulnerability/wordpress-idonatepro-2-1-8-local-file-inclusion-vulnerability?_
.com/database/wordpress/plugin/idonate-pro/vulnerability/wordpress-idonatepro-2-1-8-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-30636 State: PUBLISHED Published: 2025-06-06T12:54:21.342Z Last Updated: 2025-06-06T16:03:05.473Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: Ability, Inc Products: Accessibility Suite Problem Types: CWE-862 Description: Missing Authorization vulnerability in Ability, Inc Accessibility Suite allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Accessibility Suite: from n/a through 4.19. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/online-accessibility/vulnerability/wordpress-accessibility-suite-4-19-broken-access-control-vulnerabil
/wordpress/plugin/online-accessibility/vulnerability/wordpress-accessibility-suite-4-19-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-30637 State: PUBLISHED Published: 2025-06-06T12:54:20.882Z Last Updated: 2025-06-06T15:07:30.642Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Deetronix Products: Booking Ultra Pro Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Deetronix Booking Ultra Pro allows Stored XSS. This issue affects Booking Ultra Pro: from n/a through 1.1.20. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/booking-ultra-pro/vulnerability/wordpress-booking-ultra-pro-1-1-20-cross-site-scripting-xss-vulnerabilit
ordpress/plugin/booking-ultra-pro/vulnerability/wordpress-booking-ultra-pro-1-1-20-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-30638 State: PUBLISHED Published: 2025-06-06T12:54:20.428Z Last Updated: 2025-06-06T15:07:48.296Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: PowieT Products: Powie's Uptime Robot Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PowieT Powie's Uptime Robot allows Stored XSS. This issue affects Powie's Uptime Robot: from n/a through 0.9.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/powies-uptime-robot/vulnerability/wordpress-powie-s-uptime-robot-0-9-7-cross-site-scripting-xss-vulner
/wordpress/plugin/powies-uptime-robot/vulnerability/wordpress-powie-s-uptime-robot-0-9-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-30639 State: PUBLISHED Published: 2025-08-14T10:34:29.865Z Last Updated: 2025-08-14T13:29:10.328Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: ThemeAtelier Products: IDonatePro Problem Types: CWE-862 Description: Missing Authorization vulnerability in ThemeAtelier IDonatePro allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects IDonatePro: from n/a through 2.1.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/idonate-pro/vulnerability/wordpress-idonatepro-plugin-2-1-9-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-30640 State: PUBLISHED Published: 2025-06-17T20:10:21.752Z Last Updated: 2025-06-20T13:12:39.593Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Trend Micro, Inc. Products: Trend Micro Deep Security Problem Types: CWE-59 Description: A link following vulnerability in Trend Micro Deep Security 20.0 agents could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://success.trendmicro.com/en-US/solution/KA-0019
. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://success.trendmicro.com/en-US/solution/KA-0019344 - https://www.zerodayinitiative.com/advisories/ZDI-25-239/
CVE ID: CVE-2025-30641 State: PUBLISHED Published: 2025-06-17T20:10:54.478Z Last Updated: 2025-06-20T13:12:33.740Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Trend Micro, Inc. Products: Trend Micro Deep Security Problem Types: CWE-59 Description: A link following vulnerability in the anti-malware solution portion of Trend Micro Deep Security 20.0 agents could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://success.
n order to exploit this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://success.trendmicro.com/en-US/solution/KA-0019344 - https://www.zerodayinitiative.com/advisories/ZDI-25-240/
CVE ID: CVE-2025-30642 State: PUBLISHED Published: 2025-06-17T20:11:03.855Z Last Updated: 2025-06-20T13:12:28.114Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Trend Micro, Inc. Products: Trend Micro Deep Security Problem Types: CWE-59 Description: A link following vulnerability in Trend Micro Deep Security 20.0 agents could allow a local attacker to create a denial of service (DoS) situation on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://success.trendmicro.c
xploit this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://success.trendmicro.com/en-US/solution/KA-0019344 - https://www.zerodayinitiative.com/advisories/ZDI-25-241/
CVE ID: CVE-2025-30644 State: PUBLISHED Published: 2025-04-09T19:52:16.737Z Last Updated: 2025-05-07T18:55:01.374Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Juniper Networks Products: Junos OS Problem Types: CWE-122 Description: A Heap-based Buffer Overflow vulnerability in the flexible PIC concentrator (FPC) of Juniper Networks Junos OS on EX2300, EX3400, EX4100, EX4300, EX4300MP, EX4400, EX4600, EX4650-48Y, and QFX5k Series allows an attacker to send a specific DHCP packet to the device, leading to an FPC crash and restart, resulting in a Denial of Service (DoS). Continued receipt and processing of this packet will create a sustained Denial of Service
in a Denial of Service (DoS). Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition. Under a rare timing scenario outside the attacker's control, memory corruption may be observed when DHCP Option 82 is enabled, leading to an FPC crash and affecting packet forwarding. Due to the nature of the heap-based overflow, exploitation of this vulnerability could also lead to remote code execution within the FPC, resulting in complete control of the vulnerable component. This issue affects Junos OS on EX2300, EX3400, EX4100, EX4300, EX4300MP, EX4400, EX4600, EX4650-48Y, and QFX5k Series: * All versions before 21.4R3-S9, * from 22.2 before 22.2R3-S5,
EX4300MP, EX4400, EX4600, EX4650-48Y, and QFX5k Series: * All versions before 21.4R3-S9, * from 22.2 before 22.2R3-S5, * from 22.4 before 22.4R3-S5, * from 23.2 before 23.2R2-S3, * from 23.4 before 23.4R2-S3, * from 24.2 before 24.2R2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://supportportal.juniper.net/JSA96453
CVE ID: CVE-2025-30645 State: PUBLISHED Published: 2025-04-09T19:52:51.730Z Last Updated: 2025-04-24T20:04:34.131Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Juniper Networks Products: Junos OS Problem Types: CWE-476 Description: A NULL Pointer Dereference vulnerability in the flow daemon (flowd) of Juniper Networks Junos OS on SRX Series allows an attacker causing specific, valid control traffic to be sent out of a Dual-Stack (DS) Lite tunnel to crash the flowd process, resulting in a Denial of Service (DoS). Continuous triggering of specific control traffic will create a sustained Denial of Service (DoS) condition. On all SRX platforms, when specific, v
ecific control traffic will create a sustained Denial of Service (DoS) condition. On all SRX platforms, when specific, valid control traffic needs to be sent out of a DS-Lite tunnel, a segmentation fault occurs within the flowd process, resulting in a network outage until the flowd process restarts. This issue affects Junos OS on SRX Series: * All versions before 21.2R3-S9, * from 21.4 before 21.4R3-S9, * from 22.2 before 22.2R3-S5, * from 22.4 before 22.4R3-S6, * from 23.2 before 23.2R2-S3, * from 23.4 before 23.4R2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://supportportal.juniper.net/JSA96455
CVE ID: CVE-2025-30646 State: PUBLISHED Published: 2025-04-09T19:53:27.087Z Last Updated: 2025-04-09T20:39:47.342Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Juniper Networks Products: Junos OS, Junos OS Evolved Problem Types: CWE-195 Description: A Signed to Unsigned Conversion Error vulnerability in the Layer 2 Control Protocol daemon (l2cpd) of Juniper Networks Junos OS and Juniper Networks Junos OS Evolved allows an unauthenticated adjacent attacker sending a specifically malformed LLDP TLV to cause the l2cpd process to crash and restart, causing a Denial of Service (DoS). Continued receipt and processing of this packet will create a sustained Denia
estart, causing a Denial of Service (DoS). Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition. When an LLDP telemetry subscription is active, receipt of a specifically malformed LLDP TLV causes the l2cpd process to crash and restart. This issue affects: Junos OS: * All versions before 21.2R3-S9, * from 21.4 before 21.4R3-S10, * from 22.2 before 22.2R3-S6, * from 22.4 before 22.4R3-S6, * from 23.2 before 23.2R2-S3, * from 23.4 before 23.4R2-S4, * from 24.2 before 24.2R2; Junos OS Evolved: * All versions before 21.4R3-S10-EVO, * from 22.2-EVO before 22.2R3-S6-EVO, * from 22.4-EVO before 22.4R3-S6-EVO, * from 23.2-EVO before 23.2R2-S3-EVO,
-EVO, * from 22.2-EVO before 22.2R3-S6-EVO, * from 22.4-EVO before 22.4R3-S6-EVO, * from 23.2-EVO before 23.2R2-S3-EVO, * from 23.4-EVO before 23.4R2-S4-EVO, * from 24.2-EVO before 24.2R2-EVO. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://supportportal.juniper.net/JSA96456
CVE ID: CVE-2025-30647 State: PUBLISHED Published: 2025-04-09T19:53:59.529Z Last Updated: 2025-04-09T20:07:25.649Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Juniper Networks Products: Junos OS Problem Types: CWE-401 Description: A Missing Release of Memory after Effective Lifetime vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS on MX Series allows an unauthenticated adjacent attacker to cause a Denial-of-Service (DoS). In a subscriber management scenario, login/logout activity triggers a memory leak, and the leaked memory gradually increments and eventually results in a crash. user@host> show chassis fpc Temp CPU Utiliz
nd the leaked memory gradually increments and eventually results in a crash. user@host> show chassis fpc Temp CPU Utilization (%) CPU Utilization (%) Memory Utilization (%) Slot State (C) Total Interrupt 1min 5min 15min DRAM (MB) Heap Buffer 2 Online 36 10 0 9 8 9 32768 26 0 This issue affects Junos OS on MX Series: * All versions before 21.2R3-S9 * from 21.4 before 21.4R3-S10 * from 22.2 before 22.2R3-S6 * from 22.4 before 22.4R3-S5 * from 23.2 before 23.2R2-S3 * from 23.4 before 23.4R2-S3 * from 24.2 before 24.2R2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://supportportal.juniper.net/JSA96457
CVE ID: CVE-2025-30648 State: PUBLISHED Published: 2025-04-09T19:54:41.339Z Last Updated: 2025-04-09T20:06:17.698Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: Juniper Networks Products: Junos OS, Junos OS Evolved Problem Types: CWE-20 Description: An Improper Input Validation vulnerability in the Juniper DHCP Daemon (jdhcpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to cause the jdhcpd process to crash resulting in a Denial of Service (DoS). When a specifically malformed DHCP packet is received from a DHCP client, the jdhcpd process crashes, which will lead to the unavailability of the DHCP service and t
received from a DHCP client, the jdhcpd process crashes, which will lead to the unavailability of the DHCP service and thereby resulting in a sustained DoS. The DHCP process will restart automatically to recover the service. This issue will occur when dhcp-security is enabled. This issue affects Junos OS: * All versions before 21.2R3-S9, * from 21.4 before 21.4R3-S10, * from 22.2 before 22.2R3-S6, * from 22.4 before 22.4R3-S6, * from 23.2 before 23.2R2-S3, * from 23.4 before 23.4R2-S4, * from 24.2 before 24.2R2; Junos OS Evolved: * from 22.4 before 22.4R3-S6-EVO, * from 23.2 before 23.2R2-S3-EVO, * from 23.4 before 23.4R2-S4-EVO, * from 24.2 before 24.2R2-EVO. . Additional Analyst Notes: - C
2 before 23.2R2-S3-EVO, * from 23.4 before 23.4R2-S4-EVO, * from 24.2 before 24.2R2-EVO. . Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://supportportal.juniper.net/JSA96458
CVE ID: CVE-2025-30649 State: PUBLISHED Published: 2025-04-09T19:55:37.363Z Last Updated: 2025-04-09T20:03:04.073Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Juniper Networks Products: Junos OS Problem Types: CWE-20 Description: An Improper Input Validation vulnerability in the syslog stream TCP transport of Juniper Networks Junos OS on MX240, MX480 and MX960 devices with MX-SPC3 Security Services Card allows an unauthenticated, network-based attacker, to send specific spoofed packets to cause a CPU Denial of Service (DoS) to the MX-SPC3 SPUs. Continued receipt and processing of these specific packets will sustain the DoS condition. This issue affects Jun
SPUs. Continued receipt and processing of these specific packets will sustain the DoS condition. This issue affects Junos OS: * All versions before 22.2R3-S6, * from 22.4 before 22.4R3-S4, * from 23.2 before 23.2R2-S3, * from 23.4 before 23.4R2-S4, * from 24.2 before 24.2R1-S2, 24.2R2 An indicator of compromise will indicate the SPC3 SPUs utilization has spiked. For example: user@device> show services service-sets summary Service sets CPU Interface configured Bytes used Session bytes used Policy bytes used utilization "interface" 1 "bytes" (percent%) "sessions" ("percent"%) "bytes" ("percent"%) 99.97 % OVLD <<<<<< look for high CPU usage Additional Analyst Notes: - CISA ADP Vulnrichment: Re
) "bytes" ("percent"%) 99.97 % OVLD <<<<<< look for high CPU usage Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://supportportal.juniper.net/JSA96459
CVE ID: CVE-2025-30651 State: PUBLISHED Published: 2025-04-09T19:56:28.305Z Last Updated: 2025-04-09T20:36:41.381Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Juniper Networks Products: Junos OS, Junos OS Evolved Problem Types: CWE-805 Description: A Buffer Access with Incorrect Length Value vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS). When an attacker sends a specific ICMPv6 packet to an interface with "protocols router-advertisement" configured, rpd crashes and restarts. Continued receipt of this packet will cause
with "protocols router-advertisement" configured, rpd crashes and restarts. Continued receipt of this packet will cause a sustained DoS condition. This issue only affects systems configured with IPv6. This issue affects Junos OS: * All versions before 21.2R3-S9, * from 21.4 before 21.4R3-S10, * from 22.2 before 22.2R3-S6, * from 22.4 before 22.4R3-S4, * from 23.2 before 23.2R2-S2, * from 23.4 before 23.4R2; and Junos OS Evolved: * All versions before 21.2R3-S9-EVO, * from 21.4-EVO before 21.4R3-S10-EVO, * from 22.2-EVO before 22.2R3-S6-EVO, * from 22.4-EVO before 22.4R3-S4-EVO, * from 23.2-EVO before 23.2R2-S2-EVO, * from 23.4-EVO before 23.4R2-EVO. Additional Analyst Notes: - CISA ADP Vulnr
EVO, * from 23.2-EVO before 23.2R2-S2-EVO, * from 23.4-EVO before 23.4R2-EVO. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://supportportal.juniper.net/JSA96461