deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-38433
Published: 2024-07-11
Description: Nuvoton - CWE-305: Authentication Bypass by Primary Weakness

An attacker with write access to the SPI-Flash on an NPCM7xx BMC subsystem that uses the Nuvoton BootBlock

reference code can modify the u-boot image header on flash parsed by the BootBlock which could lead to arbitrary code

execution.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-305, CWE-287
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2024-2602
Published: 2024-07-11
Description: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path
Traversal') vulnerability exists that could result in remote code execution when an authenticated
user executes a saved project file that has been tampered by a malicious actor.
CVSS Score: 7.3 (HIGH)
CWE: CWE-22
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-191-03&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-191-03.pdf; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-191-03&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-191-03.pdf
CVE: CVE-2024-5679
Published: 2024-07-11
Description: CWE-787: Out-of-Bounds Write vulnerability exists that could cause local denial-of-service, or
kernel memory leak when a malicious actor with local user access crafts a script/program using
an IOCTL call in the Foxboro.sys driver.
CVSS Score: 7.1 (HIGH)
CWE: CWE-787
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-191-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-191-02.pdf; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-191-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-191-02.pdf
CVE: CVE-2024-5680
Published: 2024-07-11
Description: CWE-129: Improper Validation of Array Index vulnerability exists that could cause local denial-of-service when a malicious actor with local user access crafts a script/program using an IOCTL
call in the Foxboro.sys driver.
CVSS Score: 7.1 (HIGH)
CWE: CWE-129
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-191-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-191-02.pdf; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-191-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-191-02.pdf
CVE: CVE-2024-5681
Published: 2024-07-11
Description: CWE-20: Improper Input Validation vulnerability exists that could cause local denial-of-service,
privilege escalation, and potentially kernel execution when a malicious actor with local user
access crafts a script/program using an IOCTL call in the Foxboro.sys driver.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-191-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-191-02.pdf; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-191-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-191-02.pdf
CVE: CVE-2024-6528
Published: 2024-07-11
Description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site
Scripting') vulnerability exists that could cause a vulnerability leading to a cross-site scripting
condition where attackers can have a victim’s browser run arbitrary JavaScript when they visit a
page containing the injected payload.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-191-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-191-04.pdf; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-191-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-191-04.pdf
CVE: CVE-2024-6407
Published: 2024-07-11
Description: CWE-200: Information Exposure vulnerability exists that could cause disclosure of
credentials when a specially crafted message is sent to the device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-191-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-191-01.pdf; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-191-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-191-01.pdf
CVE: CVE-2024-6643
Published: 2024-07-11
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2024-6035
Published: 2024-07-11
Description: A Stored Cross-Site Scripting (XSS) vulnerability exists in gaizhenbiao/chuanhuchatgpt version 20240410. This vulnerability allows an attacker to inject malicious JavaScript code into the chat history file. When a victim uploads this file, the malicious script is executed in the victim's browser. This can lead to user data theft, session hijacking, malware distribution, and phishing attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://huntr.com/bounties/e4e8da71-53a9-4540-8d70-6b670b076987; https://huntr.com/bounties/e4e8da71-53a9-4540-8d70-6b670b076987
CVE: CVE-2024-28872
Published: 2024-07-11
Description: The TLS certificate validation code is flawed. An attacker can obtain a TLS certificate from the Stork server and use it to connect to the Stork agent. Once this connection is established with the valid certificate, the attacker can send malicious commands to a monitored service (Kea or BIND 9), possibly resulting in confidential data loss and/or denial of service. It should be noted that this vulnerability is not related to BIND 9 or Kea directly, and only customers using the Stork management tool are potentially affected.
This issue affects Stork versions 0.15.0 through 1.15.0.
CVSS Score: 8.9 (HIGH)
CWE: CWE-295, CWE-295
References: https://kb.isc.org/docs/cve-2024-28872; https://kb.isc.org/docs/cve-2024-28872
CVE: CVE-2024-37151
Published: 2024-07-11
Description: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. 
Mishandling of multiple fragmented packets using the same IP ID value can lead to packet reassembly failure, which can lead to policy bypass. Upgrade to 7.0.6 or 6.0.20. When using af-packet, enable `defrag` to reduce the scope of the problem.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-754, CWE-754
References: https://github.com/OISF/suricata/commit/9d5c4273cb7e5ca65f195f7361f0d848c85180e0; https://github.com/OISF/suricata/commit/aab7f35c76721df19403a7c0c0025feae12f3b6b; https://github.com/OISF/suricata/security/advisories/GHSA-qrp7-g66m-px24
CVE: CVE-2024-38534
Published: 2024-07-11
Description: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Crafted modbus traffic can lead to unlimited resource accumulation within a flow. Upgrade to 7.0.6. Set a limited stream.reassembly.depth to reduce the issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770, CWE-770
References: https://github.com/OISF/suricata/commit/a753cdbe84caee3b66d0bf49b2712d29a50d67ae; https://github.com/OISF/suricata/security/advisories/GHSA-59qg-h357-69fq; https://redmine.openinfosecfoundation.org/issues/6987
CVE: CVE-2024-38535
Published: 2024-07-11
Description: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Suricata can run out of memory when parsing crafted HTTP/2 traffic. Upgrade to 6.0.20 or 7.0.6.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770, CWE-770
References: https://github.com/OISF/suricata/commit/62d5cac1b8483d5f9d2b79833a4e59f5d80129b7; https://github.com/OISF/suricata/commit/c82fa5ca0d1ce0bd8f936e0b860707a6571373b2; https://github.com/OISF/suricata/security/advisories/GHSA-cg8j-7mwm-v563
CVE: CVE-2024-38536
Published: 2024-07-11
Description: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. A memory allocation failure due to `http.memcap` being reached leads to a NULL-ptr reference leading to a crash. Upgrade to 7.0.6.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://github.com/OISF/suricata/security/advisories/GHSA-j32j-4w6g-94hh; https://redmine.openinfosecfoundation.org/issues/7029; https://redmine.openinfosecfoundation.org/issues/7033
CVE: CVE-2024-6679
Published: 2024-07-11
Description: A vulnerability classified as critical has been found in witmy my-springsecurity-plus up to 2024-07-04. Affected is an unknown function of the file /api/role. The manipulation of the argument params.dataScope leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-271152.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://gitee.com/witmy/my-springsecurity-plus/issues/IAAHCR; https://vuldb.com/?ctiid.271152; https://vuldb.com/?id.271152
CVE: CVE-2024-32753
Published: 2024-07-11
Description: Under certain circumstances the camera may be susceptible to known vulnerabilities associated with the JQuery versions prior to 3.5.0 third-party component
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-191-03; https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories; https://www.cisa.gov/news-events/ics-advisories/icsa-24-191-03
CVE: CVE-2024-39317
Published: 2024-07-11
Description: Wagtail is an open source content management system built on Django. A bug in Wagtail's `parse_query_string` would result in it taking a long time to process suitably crafted inputs. When used to parse sufficiently long strings of characters without a space, `parse_query_string` would take an unexpectedly large amount of time to process, resulting in a denial of service. In an initial Wagtail installation, the vulnerability can be exploited by any Wagtail admin user. It cannot be exploited by end users. If your Wagtail site has a custom search implementation which uses `parse_query_string`, it may be exploitable by other users (e.g. unauthenticated users). Patched versions have been released as Wagtail 5.2.6, 6.0.6 and 6.1.3.

CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1333, CWE-1333
References: https://github.com/wagtail/wagtail/commit/31b1e8532dfb1b70d8d37d22aff9cbde9109cdf2; https://github.com/wagtail/wagtail/commit/3c941136f79c48446e3858df46e5b668d7f83797; https://github.com/wagtail/wagtail/commit/b783c096b6d4fd2cfc05f9137a0be288850e99a2
CVE: CVE-2024-39519
Published: 2024-07-11
Description: An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS Evolved on ACX7000 Series allows an unauthenticated, adjacent attacker to cause a 

Denial-of-Service (DoS).

On all ACX 7000 Series platforms running 

Junos OS Evolved, and configured with IRBs, if a Customer Edge device (CE) device is dual homed to two Provider Edge devices (PE) a traffic loop will occur when the CE sends multicast packets. This issue can be triggered by IPv4 and IPv6 traffic.


This issue affects Junos OS Evolved: 

All versions from 22.2R1-EVO and later versions before 22.4R2-EVO,

This issue does not affect Junos OS Evolved versions before 22.1R1-EVO.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-754, CWE-754
References: https://supportportal.juniper.net/JSA82983; https://supportportal.juniper.net/JSA82983
CVE: CVE-2024-39520
Published: 2024-07-11
Description: An Improper Neutralization of Special Elements vulnerability in Juniper Networks Junos OS Evolved commands allows a local, authenticated attacker with low privileges to escalate their privileges to 'root' leading to a full compromise of the system.

The Junos OS Evolved CLI doesn't properly handle command options in some cases, allowing users which execute specific CLI commands with a crafted set of parameters to escalate their privileges to root on shell level.

This issue affects Junos OS Evolved:

  *  All version before 20.4R3-S6-EVO, 
  *  21.2-EVO versions before 21.2R3-S4-EVO,
  *  21.4-EVO versions before 21.4R3-S6-EVO, 
  *  22.2-EVO versions before 22.2R2-S1-EVO, 22.2R3-EVO, 
  *  22.3-EVO versions before 22.3R2-EVO.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://supportportal.juniper.net/JSA82975; https://supportportal.juniper.net/JSA82975
CVE: CVE-2024-39521
Published: 2024-07-11
Description: An Improper Neutralization of Special Elements vulnerability in Juniper Networks Junos OS Evolved commands allows a local, authenticated attacker with low privileges to escalate their privileges to 'root' leading to a full compromise of the system.

The Junos OS Evolved CLI doesn't properly handle command options in some cases, allowing users which execute specific CLI commands with a crafted set of parameters to escalate their privileges to root on shell level.


This issue affects Junos OS Evolved: 



  *  21.1-EVO versions 21.1R1-EVO and later before 21.2R3-S8-EVO, 
  *  21.4-EVO versions before 21.4R3-S7-EVO,
  *  22.1-EVO versions before 22.1R3-S6-EVO, 
  *  22.2-EVO versions before 22.2R3-EVO,
  *  22.3-EVO versions before 22.3R2-EVO.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://supportportal.juniper.net/JSA82975; https://supportportal.juniper.net/JSA82975
CVE: CVE-2024-39522
Published: 2024-07-11
Description: An Improper Neutralization of Special Elements vulnerability in Juniper Networks Junos OS Evolved commands allows a local, authenticated attacker with low privileges to escalate their privileges to 'root' leading to a full compromise of the system.

The Junos OS Evolved CLI doesn't properly handle command options in some cases, allowing users which execute specific CLI commands with a crafted set of parameters to escalate their privileges to root on shell level.


This issue affects Junos OS Evolved:



  *  22.3-EVO versions before 22.3R2-EVO,
  *  22.4-EVO versions before 22.4R1-S1-EVO, 22.4R2-EVO.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://supportportal.juniper.net/JSA82975; https://supportportal.juniper.net/JSA82975
CVE: CVE-2024-39523
Published: 2024-07-11
Description: An Improper Neutralization of Special Elements vulnerability in Juniper Networks Junos OS Evolved commands allows a local, authenticated attacker with low privileges to escalate their privileges to 'root' leading to a full compromise of the system.

The Junos OS Evolved CLI doesn't properly handle command options in some cases, allowing users which execute specific CLI commands with a crafted set of parameters to escalate their privileges to root on shell level.

This issue affects Junos OS Evolved: 

  *  All versions before 20.4R3-S7-EVO,
  *  21.2-EVO versions before 21.2R3-S8-EVO,
  *  21.4-EVO versions before 21.4R3-S7-EVO,
  *  22.1-EVO versions before 22.1R3-S6-EVO, 
  *  22.2-EVO versions before 22.2R3-EVO,
  *  22.3-EVO versions before 22.3R2-EVO,
  *  22.4-EVO versions before 22.4R2-EVO.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://supportportal.juniper.net/JSA82975; https://supportportal.juniper.net/JSA82975
CVE: CVE-2024-39524
Published: 2024-07-11
Description: An Improper Neutralization of Special Elements vulnerability in Juniper Networks Junos OS Evolved commands allows a local, authenticated attacker with low privileges to escalate their privileges to 'root' leading to a full compromise of the system.

The Junos OS Evolved CLI doesn't properly handle command options in some cases, allowing users which execute specific CLI commands with a crafted set of parameters to escalate their privileges to root on shell level.

This issue affects Junos OS Evolved:

All versions before 20.4R3-S7-EVO,

21.2-EVO versions before 21.2R3-S8-EVO,

21.4-EVO versions before 21.4R3-S7-EVO, 

22.2-EVO versions before 22.2R3-EVO,

22.3-EVO versions before 22.3R2-EVO,

22.4-EVO versions before 22.4R2-EVO.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://supportportal.juniper.net/JSA82975; https://supportportal.juniper.net/JSA82975
CVE: CVE-2024-39528
Published: 2024-07-11
Description: A Use After Free vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated, network-based attacker to cause a Denial of Service (DoS).On all Junos OS and Junos Evolved platforms, if a routing-instance deactivation is triggered, and at the same time a specific SNMP request is received, a segmentation fault occurs which causes rpd to crash and restart.




This issue affects:

   Junos OS:



  *  All versions before 21.2R3-S8, 
  *  21.4 versions before 21.4R3-S5,
  *  22.2 versions before 22.2R3-S3,
  *  22.3 versions before 22.3R3-S2,
  *  22.4 versions before 22.4R3,
  *  23.2 versions before 23.2R2.




   Junos OS Evolved:



  *  All versions before 21.2R3-S8-EVO,
  *  21.4-EVO versions before 21.4R3-S5-EVO,
  *  22.2-EVO versions before 22.2R3-S3-EVO, 
  *  22.3-EVO versions before 22.3R3-S2-EVO,
  *  22.4-EVO versions before 22.4R3-EVO,
  *  23.2-EVO versions before 23.2R2-EVO.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://supportportal.juniper.net/JSA82987; https://supportportal.juniper.net/JSA82987
CVE: CVE-2024-39529
Published: 2024-07-11
Description: A Use of Externally-Controlled Format String vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).



If DNS Domain Generation Algorithm (DGA) detection or tunnel detection, and DNS-filtering traceoptions are configured, and specific valid transit DNS traffic is received this causes a PFE crash and restart, leading to a Denial of Service.

This issue affects Junos OS: 
  *  All versions before 21.4R3-S6,
  *  22.2 versions before 22.2R3-S3,
  *  22.3 versions before 22.3R3-S3,
  *  22.4 versions before 22.4R3,
  *  23.2 versions before 23.2R2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-134, CWE-134
References: https://supportportal.juniper.net/JSA82988; https://supportportal.juniper.net/JSA82988
CVE: CVE-2024-39530
Published: 2024-07-11
Description: An Improper Check for Unusual or Exceptional Conditions vulnerability in the chassis management daemon (chassisd) of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to cause a 

Denial-of-Service (DoS).

If an attempt is made to access specific sensors on platforms not supporting these sensors, either via GRPC or netconf, chassisd will crash and restart leading to a restart of all FPCs and thereby a complete outage.

This issue affects Junos OS:



  *  21.4 versions from 21.4R3 before 21.4R3-S5,
  *  22.1 versions from 22.1R3 before 22.1R3-S4,
  *  22.2 versions from 22.2R2 before 22.2R3,
  *  22.3 versions from 22.3R1 before 22.3R2-S2, 22.3R3,
  *  22.4 versions from 22.4R1 before 22.4R2.


This issue does not affect Junos OS versions earlier than 21.4.
CVSS Score: 7.5 (HIGH)
CWE: CWE-754, CWE-754
References: https://supportportal.juniper.net/JSA82989; https://supportportal.juniper.net/JSA82989
CVE: CVE-2024-39904
Published: 2024-07-11
Description: VNote is a note-taking platform. Prior to 3.18.1, a code execution vulnerability existed in VNote, which allowed an attacker to execute arbitrary programs on the victim's system. A crafted URI can be used in a note to perform this attack using file:/// as a link. For example, file:///C:/WINDOWS/system32/cmd.exe. This allows attackers to execute arbitrary programs by embedding a reference to a local executable file such as file:///C:/WINDOWS/system32/cmd.exe and file:///C:/WINDOWS/system32/calc.exe. This vulnerability can be exploited by creating and sharing specially crafted notes. An attacker could send a crafted note file and perform further attacks. This vulnerability is fixed in 3.18.1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-73
References: https://github.com/vnotex/vnote/commit/3477469b669708ff547037fda9fc[PII_REDACTED]aa; https://github.com/vnotex/vnote/security/advisories/GHSA-vhh5-8wcv-68gj; https://github.com/vnotex/vnote/commit/3477469b669708ff547037fda9fc[PII_REDACTED]aa
CVE: CVE-2024-39905
Published: 2024-07-11
Description: Red is a fully modular Discord bot. Due to a bug in Red's Core API, 3rd-party cogs using the `@commands.can_manage_channel()` command permission check without additional permission controls may authorize a user to run a command even when that user doesn't have permissions to manage a channel. None of the core commands or core cogs are affected. The maintainers of the project are not aware of any _public_ 3rd-party cog utilizing this API at the time of writing this advisory. The problem was patched and released in version 3.5.10.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-863
References: https://github.com/Cog-Creators/Red-DiscordBot/commit/0b0b23b9717b40ed4f8715720b199417c8e89750; https://github.com/Cog-Creators/Red-DiscordBot/pull/6398; https://github.com/Cog-Creators/Red-DiscordBot/security/advisories/GHSA-5jq8-q6rj-9gq4
CVE: CVE-2024-6680
Published: 2024-07-11
Description: A vulnerability classified as critical was found in witmy my-springsecurity-plus up to 2024-07-04. Affected by this vulnerability is an unknown functionality of the file /api/dept/build. The manipulation of the argument params.dataScope leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-271153 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://gitee.com/witmy/my-springsecurity-plus/issues/IAAH8A; https://vuldb.com/?ctiid.271153; https://vuldb.com/?id.271153
CVE: CVE-2024-39531
Published: 2024-07-11
Description: An Improper Handling of Values vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS Evolved on ACX 7000 Series allows a network-based, unauthenticated attacker to cause a Denial-of-Service (DoS).

If a value is configured for DDoS bandwidth or burst parameters for any protocol in
a queue, all protocols which share the same queue will have
their bandwidth or burst value changed to the new value. If, for example, OSPF was configured with a certain bandwidth value, ISIS would also be limited to this value. So inadvertently either the control plane is open for a high level of specific traffic which was supposed to be limited to a lower value, or the limit for a certain protocol is so low that chances to succeed with a volumetric DoS attack are significantly increased. 




This issue affects Junos OS Evolved on ACX 7000 Series:



  *  All versions before 21.4R3-S7-EVO,
  *  22.1 versions before 22.1R3-S6-EVO, 
  *  22.2 versions before 22.2R3-S3-EVO,
  *  22.3 versions before 22.3R3-S3-EVO, 
  *  22.4 versions before 22.4R3-S2-EVO,
  *  23.2 versions before 23.2R2-EVO,
  *  23.4 

versions 

before 23.4R1-S1-EVO, 23.4R2-EVO.
CVSS Score: 7.5 (HIGH)
CWE: CWE-229
References: https://supportportal.juniper.net/JSA82991; https://supportportal.juniper.net/JSA82991
CVE: CVE-2024-39532
Published: 2024-07-11
Description: An Insertion of Sensitive Information into Log File vulnerability in Juniper Networks Junos OS and Junos OS Evolved allows a local, authenticated attacker with high privileges to access sensitive information.

When another user performs a specific operation, sensitive information is stored as plain text in a specific log file, so that a high-privileged attacker has access to this information.
This issue affects:

Junos OS:



  *  All versions before 21.2R3-S9;
  *  

21.4 versions before 21.4R3-S9;

  *  22.2 versions before 22.2R2-S1, 22.2R3;
  *  22.3 versions before 22.3R1-S1, 22.3R2;




Junos OS Evolved:



  *  All versions before before 22.1R3-EVO;
  *  22.2-EVO versions before 22.2R2-S1-EVO, 22.2R3-EVO;
  *  22.3-EVO versions before 22.3R1-S1-EVO, 22.3R2-EVO.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-532
References: https://supportportal.juniper.net/JSA82992; https://supportportal.juniper.net/JSA82992