Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-31337 State: PUBLISHED Published: 2021-06-28T12:24:58 Last Updated: 2024-08-03T22:55:53.698Z Vendors: n/a Products: SINAMICS Medium Voltage Products Problem Types: CWE-306 Description: The Telnet service of the SIMATIC HMI Comfort Panels system component in affected products does not require authentication, which may allow a remote attacker to gain access to the device if the service is enabled. Telnet is disabled by default on the SINAMICS Medium Voltage Products (SINAMICS SL150: All versions, SINAMICS SM150: All versions, SINAMICS SM150i: All versions). Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-21-131-04
CVE ID: CVE-2021-31338 State: PUBLISHED Published: 2021-08-19T10:00:11 Last Updated: 2024-08-03T22:55:53.516Z Vendors: Siemens Products: SINEMA Remote Connect Client Problem Types: CWE-15 Description: A vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3.0 SP1). Affected devices allow to modify configuration settings over an unauthenticated channel. This could allow a local attacker to escalate privileges and execute own code on the device. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-816035.pdf
CVE ID: CVE-2021-31339 State: PUBLISHED Published: 2021-05-12T13:18:23 Last Updated: 2024-08-03T22:55:53.551Z Vendors: Siemens Products: Mendix Excel Importer Module Problem Types: CWE-209 Description: A vulnerability has been identified in Mendix Excel Importer Module (All versions < V9.0.3). Uploading a manipulated XML File results in an exception that could expose information about the Application-Server and the used XML-Framework. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-854248.pdf - https://us-cert.cisa.gov/ics/advisories/icsa-21-131-09
CVE ID: CVE-2021-31340 State: PUBLISHED Published: 2021-06-08T19:47:16 Last Updated: 2024-08-03T22:55:53.544Z Vendors: Siemens Products: SIMATIC RF166C, SIMATIC RF185C, SIMATIC RF186C, SIMATIC RF186CI, SIMATIC RF188C, SIMATIC RF188CI, SIMATIC RF360R, SIMATIC Reader RF610R CMIIT, SIMATIC Reader RF610R ETSI, SIMATIC Reader RF610R FCC, SIMATIC Reader RF615R CMIIT, SIMATIC Reader RF615R ETSI, SIMATIC Reader RF615R FCC, SIMATIC Reader RF650R ARIB, SIMATIC Reader RF650R CMIIT, SIMATIC Reader RF650R ETSI, SIMATIC Reader RF650R FCC, SIMATIC Reader RF680R ARIB, SIMATIC Reader RF680R CMIIT, SIMATIC Reader RF680R ETSI, SIMATIC Reader RF680R FCC, SIMATIC Reader RF685R ARIB, SIMATIC Reader RF685R CMIIT,
CMIIT, SIMATIC Reader RF680R ETSI, SIMATIC Reader RF680R FCC, SIMATIC Reader RF685R ARIB, SIMATIC Reader RF685R CMIIT, SIMATIC Reader RF685R ETSI, SIMATIC Reader RF685R FCC Problem Types: CWE-400 Description: A vulnerability has been identified in SIMATIC RF166C (All versions > V1.1 and < V1.3.2), SIMATIC RF185C (All versions > V1.1 and < V1.3.2), SIMATIC RF186C (All versions > V1.1 and < V1.3.2), SIMATIC RF186CI (All versions > V1.1 and < V1.3.2), SIMATIC RF188C (All versions > V1.1 and < V1.3.2), SIMATIC RF188CI (All versions > V1.1 and < V1.3.2), SIMATIC RF360R (All versions < V2.0), SIMATIC Reader RF610R CMIIT (All versions > V3.0 < V4.0), SIMATIC Reader RF610R ETSI (All versions > V3.0
sions < V2.0), SIMATIC Reader RF610R CMIIT (All versions > V3.0 < V4.0), SIMATIC Reader RF610R ETSI (All versions > V3.0 < V4.0), SIMATIC Reader RF610R FCC (All versions > V3.0 < V4.0), SIMATIC Reader RF615R CMIIT (All versions > V3.0 < V4.0), SIMATIC Reader RF615R ETSI (All versions > V3.0 < V4.0), SIMATIC Reader RF615R FCC (All versions > V3.0 < V4.0), SIMATIC Reader RF650R ARIB (All versions > V3.0 < V4.0), SIMATIC Reader RF650R CMIIT (All versions > V3.0 < V4.0), SIMATIC Reader RF650R ETSI (All versions > V3.0 < V4.0), SIMATIC Reader RF650R FCC (All versions > V3.0 < V4.0), SIMATIC Reader RF680R ARIB (All versions > V3.0 < V4.0), SIMATIC Reader RF680R CMIIT (All versions > V3.0 < V4.0),
.0), SIMATIC Reader RF680R ARIB (All versions > V3.0 < V4.0), SIMATIC Reader RF680R CMIIT (All versions > V3.0 < V4.0), SIMATIC Reader RF680R ETSI (All versions > V3.0 < V4.0), SIMATIC Reader RF680R FCC (All versions > V3.0 < V4.0), SIMATIC Reader RF685R ARIB (All versions > V3.0 < V4.0), SIMATIC Reader RF685R CMIIT (All versions > V3.0 < V4.0), SIMATIC Reader RF685R ETSI (All versions > V3.0 < V4.0), SIMATIC Reader RF685R FCC (All versions > V3.0 < V4.0). Affected devices do not properly handle large numbers of incoming connections. An attacker may leverage this to cause a Denial-of-Service situation. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.sieme
Denial-of-Service situation. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-787292.pdf
CVE ID: CVE-2021-31341 State: PUBLISHED Published: 2021-05-12T13:18:23 Last Updated: 2024-08-03T22:55:53.596Z Vendors: n/a Products: Mendix Database Replication Module Problem Types: CWE-209 Description: Uploading a table mapping using a manipulated XML file results in an exception that could expose information about the application-server and the used XML-framework on the Mendix Database Replication Module (All versions prior to v7.0.1). Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-21-131-05 - https://cert-portal.siemens.com/productcert/pdf/ssa-919955.pdf
CVE ID: CVE-2021-31342 State: PUBLISHED Published: 2021-06-08T19:47:16 Last Updated: 2024-08-03T22:55:53.569Z Vendors: n/a Products: Siemens Solid Edge Problem Types: CWE-787 Description: The ugeom2d.dll library in all versions of Solid Edge SE2020 before 2020MP14 and all versions of Solid Edge SE2021 before SE2021MP5 lack proper validation of user-supplied data when parsing DFT files. This could result in an out-of-bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-21-159-09 - http
onal Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-21-159-09 - https://www.zerodayinitiative.com/advisories/ZDI-21-998/
CVE ID: CVE-2021-31343 State: PUBLISHED Published: 2021-06-08T19:47:16 Last Updated: 2024-08-03T22:55:53.574Z Vendors: n/a Products: Siemens Solid Edge Problem Types: CWE-787 Description: The jutil.dll library in all versions of Solid Edge SE2020 before 2020MP14 and all versions of Solid Edge SE2021 before SE2021MP5 lack proper validation of user-supplied data when parsing DFT files. This could result in an out-of-bounds write past the end of an allocation structure. An attacker could leverage this vulnerability to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-21-159-09 - https
nal Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-21-159-09 - https://www.zerodayinitiative.com/advisories/ZDI-21-999/
CVE ID: CVE-2021-31344 State: PUBLISHED Published: 2021-11-09T11:31:51 Last Updated: 2025-03-11T09:47:36.591Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Siemens Products: Capital Embedded AR Classic 431-422, Capital Embedded AR Classic R20-11, PLUSCONTROL 1st Gen, SIMOTICS CONNECT 400 Problem Types: CWE-843 Description: A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), PLUSCONTROL 1st Gen (All versions), SIMOTICS CONNECT 400 (All versions < V0.5.0.0), SIMOTICS CONNECT 400 (All versions < V1.0.0.0). ICMP echo packets with fake IP options allow sending ICMP
s < V0.5.0.0), SIMOTICS CONNECT 400 (All versions < V1.0.0.0). ICMP echo packets with fake IP options allow sending ICMP echo reply messages to arbitrary hosts on the network. (FSMD-2021-0004) Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-114589.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-044112.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-620288.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-845392.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-223353.pdf - https://cert-portal.siemens.com/productcert/html/ssa-114589.html - https://cert-portal.siemens.com/productcert/html/s
- https://cert-portal.siemens.com/productcert/html/ssa-114589.html - https://cert-portal.siemens.com/productcert/html/ssa-044112.html - https://cert-portal.siemens.com/productcert/html/ssa-620288.html - https://cert-portal.siemens.com/productcert/html/ssa-845392.html - https://cert-portal.siemens.com/productcert/html/ssa-223353.html
CVE ID: CVE-2021-31345 State: PUBLISHED Published: 2021-11-09T11:31:52 Last Updated: 2025-03-11T09:47:37.991Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Siemens Products: Capital Embedded AR Classic 431-422, Capital Embedded AR Classic R20-11, PLUSCONTROL 1st Gen Problem Types: CWE-1284 Description: A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), PLUSCONTROL 1st Gen (All versions). The total length of an UDP payload (set in the IP header) is unchecked. This may lead to various side effects, including Information Leak and Denial-of-Service conditions, depe
) is unchecked. This may lead to various side effects, including Information Leak and Denial-of-Service conditions, depending on a user-defined applications that runs on top of the UDP protocol. (FSMD-2021-0006) Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-114589.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-044112.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-620288.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-845392.pdf - https://cert-portal.siemens.com/productcert/html/ssa-114589.html - https://cert-portal.siemens.com/productcert/html/ssa-044112.html - https://cert-portal.siemens.c
/html/ssa-114589.html - https://cert-portal.siemens.com/productcert/html/ssa-044112.html - https://cert-portal.siemens.com/productcert/html/ssa-620288.html - https://cert-portal.siemens.com/productcert/html/ssa-845392.html
CVE ID: CVE-2021-31346 State: PUBLISHED Published: 2021-11-09T11:31:53 Last Updated: 2025-03-11T09:47:39.488Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H) Vendors: Siemens Products: Capital Embedded AR Classic 431-422, Capital Embedded AR Classic R20-11, PLUSCONTROL 1st Gen, SIMOTICS CONNECT 400 Problem Types: CWE-1284 Description: A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), PLUSCONTROL 1st Gen (All versions), SIMOTICS CONNECT 400 (All versions < V0.5.0.0), SIMOTICS CONNECT 400 (All versions < V1.0.0.0). The total length of an ICMP payload (set in the IP header)
< V0.5.0.0), SIMOTICS CONNECT 400 (All versions < V1.0.0.0). The total length of an ICMP payload (set in the IP header) is unchecked. This may lead to various side effects, including Information Leak and Denial-of-Service conditions, depending on the network buffer organization in memory. (FSMD-2021-0007) Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-114589.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-044112.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-620288.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-845392.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-223353.pdf - ht
-portal.siemens.com/productcert/pdf/ssa-845392.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-223353.pdf - https://cert-portal.siemens.com/productcert/html/ssa-114589.html - https://cert-portal.siemens.com/productcert/html/ssa-044112.html - https://cert-portal.siemens.com/productcert/html/ssa-620288.html - https://cert-portal.siemens.com/productcert/html/ssa-845392.html - https://cert-portal.siemens.com/productcert/html/ssa-223353.html
CVE ID: CVE-2021-31347 State: PUBLISHED Published: 2021-04-16T17:32:30 Last Updated: 2024-08-03T22:55:53.699Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxml_parse_str() performs incorrect memory handling while parsing crafted XML files (writing outside a memory region created by mmap). Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/ezxml/bugs/27/ - https://lists.debian.org/debian-lts-announce/2021/07/msg00005.html
CVE ID: CVE-2021-31348 State: PUBLISHED Published: 2021-04-16T17:41:08 Last Updated: 2024-08-03T22:55:53.570Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxml_parse_str() performs incorrect memory handling while parsing crafted XML files (out-of-bounds read after a certain strcspn failure). Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/ezxml/bugs/27/ - https://lists.debian.org/debian-lts-announce/2021/07/msg00005.html
CVE ID: CVE-2021-31349 State: PUBLISHED Published: 2021-10-19T18:16:28.461957Z Last Updated: 2024-09-16T23:10:43.606Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Juniper Networks Products: 128 Technology Session Smart Router Problem Types: CWE-287 Description: The usage of an internal HTTP header created an authentication bypass vulnerability (CWE-287), allowing an attacker to view internal files, change settings, manipulate services and execute arbitrary code. This issue affects all Juniper Networks 128 Technology Session Smart Router versions prior to 4.5.11, and all versions of 5.0 up to and including 5.0.1. Additional Analyst Notes: - CVE Program C
r versions prior to 4.5.11, and all versions of 5.0 up to and including 5.0.1. Additional Analyst Notes: - CVE Program Container: References: - https://kb.juniper.net/JSA11256
CVE ID: CVE-2021-31350 State: PUBLISHED Published: 2021-10-19T18:16:30.117409Z Last Updated: 2024-09-16T18:49:28.144Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Juniper Networks Products: Junos OS, Junos OS Evolved Problem Types: CWE-269 Description: An Improper Privilege Management vulnerability in the gRPC framework, used by the Juniper Extension Toolkit (JET) API on Juniper Networks Junos OS and Junos OS Evolved, allows a network-based, low-privileged authenticated attacker to perform operations as root, leading to complete compromise of the targeted system. The issue is caused by the JET service daemon (jsd) process authenticating the user, then passi
of the targeted system. The issue is caused by the JET service daemon (jsd) process authenticating the user, then passing configuration operations directly to the management daemon (mgd) process, which runs as root. This issue affects Juniper Networks Junos OS: 18.4 versions prior to 18.4R1-S8, 18.4R2-S8, 18.4R3-S8; 19.1 versions prior to 19.1R2-S3, 19.1R3-S5; 19.2 versions prior to 19.2R1-S7, 19.2R3-S2; 19.3 versions prior to 19.3R2-S6, 19.3R3-S2; 19.4 versions prior to 19.4R1-S4, 19.4R2-S4, 19.4R3-S3; 20.1 versions prior to 20.1R2-S2, 20.1R3; 20.2 versions prior to 20.2R2-S3, 20.2R3; 20.3 versions prior to 20.3R2-S1, 20.3R3; 20.4 versions prior to 20.4R2. This issue does not affect Junipe
2-S3, 20.2R3; 20.3 versions prior to 20.3R2-S1, 20.3R3; 20.4 versions prior to 20.4R2. This issue does not affect Juniper Networks Junos OS versions prior to 18.4R1. Juniper Networks Junos OS Evolved: All versions prior to 20.4R2-EVO; 21.1-EVO versions prior to 21.1R2-EVO. Additional Analyst Notes: - CVE Program Container: References: - https://kb.juniper.net/JSA11215
CVE ID: CVE-2021-31351 State: PUBLISHED Published: 2021-10-19T18:16:31.714062Z Last Updated: 2024-09-17T01:26:12.258Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Juniper Networks Products: Junos OS Problem Types: CWE-754, Denial of Service (DoS) Description: An Improper Check for Unusual or Exceptional Conditions in packet processing on the MS-MPC/MS-MIC utilized by Juniper Networks Junos OS allows a malicious attacker to send a specific packet, triggering the MS-MPC/MS-MIC to reset, causing a Denial of Service (DoS). Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition. This issue only affects specific
d processing of this packet will create a sustained Denial of Service (DoS) condition. This issue only affects specific versions of Juniper Networks Junos OS on MX Series: 17.3R3-S11; 17.4R2-S13; 17.4R3 prior to 17.4R3-S5; 18.1R3-S12; 18.2R2-S8, 18.2R3-S7, 18.2R3-S8; 18.3R3-S4; 18.4R3-S7; 19.1R3-S4, 19.1R3-S5; 19.2R1-S6; 19.3R3-S2; 19.4R2-S4, 19.4R2-S5; 19.4R3-S2; 20.1R2-S1; 20.2R2-S2, 20.2R2-S3, 20.2R3; 20.3R2, 20.3R2-S1; 20.4R1, 20.4R1-S1, 20.4R2; 21.1R1; This issue does not affect any version of Juniper Networks Junos OS prior to 15.1X49-D240; Additional Analyst Notes: - CVE Program Container: References: - https://kb.juniper.net/JSA11216
CVE ID: CVE-2021-31352 State: PUBLISHED Published: 2021-10-19T18:16:33.308361Z Last Updated: 2024-09-16T19:20:18.621Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Juniper Networks Products: SRC Series Problem Types: CWE-200 Description: An Information Exposure vulnerability in Juniper Networks SRC Series devices configured for NETCONF over SSH permits the negotiation of weak ciphers, which could allow a remote attacker to obtain sensitive information. A remote attacker with read and write access to network data could exploit this vulnerability to display plaintext bits from a block of ciphertext and obtain sensitive information. This issue affects all Jun
bility to display plaintext bits from a block of ciphertext and obtain sensitive information. This issue affects all Juniper Networks SRC Series versions prior to 4.13.0-R6. Additional Analyst Notes: - CVE Program Container: References: - https://kb.juniper.net/JSA11217
CVE ID: CVE-2021-31353 State: PUBLISHED Published: 2021-10-19T18:16:34.884433Z Last Updated: 2024-09-16T17:37:46.150Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Juniper Networks Products: Junos OS, Junos OS Evolved Problem Types: CWE-755 Description: An Improper Handling of Exceptional Conditions vulnerability in Juniper Networks Junos OS and Junos OS Evolved allows an attacker to inject a specific BGP update, causing the routing protocol daemon (RPD) to crash and restart, leading to a Denial of Service (DoS). Continued receipt and processing of the BGP update will create a sustained Denial of Service (DoS) condition. This issue affects very specific vers
ssing of the BGP update will create a sustained Denial of Service (DoS) condition. This issue affects very specific versions of Juniper Networks Junos OS: 19.3R3-S2; 19.4R3-S3; 20.2 versions 20.2R2-S3 and later, prior to 20.2R3-S2; 20.3 versions 20.3R2 and later, prior to 20.3R3; 20.4 versions 20.4R2 and later, prior to 20.4R3; 21.1 versions prior to 21.1R2. Juniper Networks Junos OS 20.1 is not affected by this issue. This issue also affects Juniper Networks Junos OS Evolved: All versions prior to 20.4R2-S3-EVO, 20.4R3-EVO; 21.1-EVO versions prior to 21.1R2-EVO; 21.2-EVO versions prior to 21.2R2-EVO. Additional Analyst Notes: - CVE Program Container: References: - https://kb.juniper.net/JSA
ersions prior to 21.2R2-EVO. Additional Analyst Notes: - CVE Program Container: References: - https://kb.juniper.net/JSA11218
CVE ID: CVE-2021-31354 State: PUBLISHED Published: 2021-10-19T18:16:36.502579Z Last Updated: 2024-09-17T01:30:53.790Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L) Vendors: Juniper Networks Products: Junos OS, Junos OS Evolved Problem Types: CWE-125, Denial of Service (DoS) Description: An Out Of Bounds (OOB) access vulnerability in the handling of responses by a Juniper Agile License (JAL) Client in Juniper Networks Junos OS and Junos OS Evolved, configured in Network Mode (to use Juniper Agile License Manager) may allow an attacker to cause a partial Denial of Service (DoS), or lead to remote code execution (RCE). The vulnerability exists in the packet parsing logi
ial Denial of Service (DoS), or lead to remote code execution (RCE). The vulnerability exists in the packet parsing logic on the client that processes the response from the server using a custom protocol. An attacker with control of a JAL License Manager, or with access to the local broadcast domain, may be able to spoof a new JAL License Manager and/or craft a response to the Junos OS License Client, leading to exploitation of this vulnerability. This issue only affects Junos systems configured in Network Mode. Systems that are configured in Standalone Mode (the default mode of operation for all systems) are not vulnerable to this issue. This issue affects: Juniper Networks Junos OS: 19.2 v
de of operation for all systems) are not vulnerable to this issue. This issue affects: Juniper Networks Junos OS: 19.2 versions prior to 19.2R3-S3; 19.3 versions prior to 19.3R3-S3; 20.1 versions prior to 20.1R2-S2, 20.1R3-S1; 20.2 versions prior to 20.2R3-S2; 20.3 versions prior to 20.3R3; 20.4 versions prior to 20.4R3; 21.1 versions prior to 21.1R2. Juniper Networks Junos OS Evolved: version 20.1R1-EVO and later versions, prior to 21.2R2-EVO. This issue does not affect Juniper Networks Junos OS versions prior to 19.2R1. Additional Analyst Notes: - CVE Program Container: References: - https://kb.juniper.net/JSA11219
CVE ID: CVE-2021-31355 State: PUBLISHED Published: 2021-10-19T18:16:38.035097Z Last Updated: 2024-09-17T00:42:23.357Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Juniper Networks Products: Junos OS Problem Types: CWE-79 Description: A persistent cross-site scripting (XSS) vulnerability in the captive portal graphical user interface of Juniper Networks Junos OS may allow a remote authenticated user to inject web script or HTML and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on administrative user to perform administrative actions on the device. This issue affects Juniper Networks Junos OS: All versions, i
tive user to perform administrative actions on the device. This issue affects Juniper Networks Junos OS: All versions, including the following supported releases: 12.3X48 versions prior to 12.3X48-D105; 15.1X49 versions prior to 15.1X49-D220; 18.3 versions prior to 18.3R3-S5; 18.4 versions prior to 18.4R3-S9; 19.1 versions prior to 19.1R3-S7; 19.2 versions prior to 19.2R3-S3; 19.3 versions prior to 19.3R3-S4; 19.4 versions prior to 19.4R3-S6; 20.1 versions prior to 20.1R3; 20.2 versions prior to 20.2R1-S1, 20.2R2; 20.3 versions prior to 20.3R2; 20.4 versions prior to 20.4R2; 21.1 versions prior to 21.1R2. Additional Analyst Notes: - CVE Program Container: References: - https://kb.juniper.net
; 21.1 versions prior to 21.1R2. Additional Analyst Notes: - CVE Program Container: References: - https://kb.juniper.net/JSA11220
CVE ID: CVE-2021-31356 State: PUBLISHED Published: 2021-10-19T18:16:39.614593Z Last Updated: 2024-09-16T20:42:59.394Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Juniper Networks Products: Junos OS Evolved Problem Types: CWE-77 Description: A command injection vulnerability in command processing on Juniper Networks Junos OS Evolved allows an attacker with authenticated CLI access to be able to bypass configured access protections to execute arbitrary shell commands within the context of the current user. The vulnerability allows an attacker to bypass command authorization restrictions assigned to their specific user account and execute commands that are av