deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-8755
Published: 2024-10-11
Description: Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection.This issue affects:





 Product 





Affected Versions 





LoadMaster 





From 7.2.55.0 to 7.2.60.1 (inclusive) 





  





From 7.2.49.0 to 7.2.54.12 (inclusive) 





  





7.2.48.12 and all prior versions 








Multi-Tenant Hypervisor 





7.1.35.12 and all prior versions 










ECS





All prior versions to 7.2.60.1 (inclusive)
CVSS Score: 8.4 (HIGH)
CWE: CWE-20, CWE-78
References: https://support.kemptechnologies.com/hc/en-us/articles/[PII_REDACTED]5661-LoadMaster-Security-Vulnerability-CVE-2024-8755
CVE: CVE-2024-9869
Published: 2024-10-11
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2024-33578
Published: 2024-10-11
Description: A DLL hijack vulnerability was reported in Lenovo Leyun that could allow a local attacker to execute code with elevated privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://iknow.lenovo.com.cn/detail/423563
CVE: CVE-2024-33579
Published: 2024-10-11
Description: A DLL hijack vulnerability was reported in Lenovo Baiying that could allow a local attacker to execute code with elevated privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://iknow.lenovo.com.cn/detail/423563
CVE: CVE-2024-33580
Published: 2024-10-11
Description: A DLL hijack vulnerability was reported in Lenovo Personal Cloud that could allow a local attacker to execute code with elevated privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://iknow.lenovo.com.cn/detail/423563
CVE: CVE-2024-33581
Published: 2024-10-11
Description: A DLL hijack vulnerability was reported in Lenovo PC Manager AI intelligent scenario that could allow a local attacker to execute code with elevated privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://iknow.lenovo.com.cn/detail/423563
CVE: CVE-2024-33582
Published: 2024-10-11
Description: A DLL hijack vulnerability was reported in Lenovo Service Framework that could allow a local attacker to execute code with elevated privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://iknow.lenovo.com.cn/detail/423563
CVE: CVE-2024-39526
Published: 2024-10-11
Description: An Improper Handling of Exceptional Conditions vulnerability in packet processing of Juniper Networks Junos OS on MX Series with MPC10/MPC11/LC9600 line cards, EX9200 with EX9200-15C lines cards, MX304 devices, and Juniper Networks Junos OS Evolved on PTX Series, allows an attacker sending malformed DHCP packets to cause ingress packet processing to stop, leading to a Denial of Service (DoS).  Continued receipt and processing of these packets will create a sustained Denial of Service (DoS) condition.

This issue only occurs if DHCP snooping is enabled. See configuration below.

This issue can be detected using following commands. Their output will display the interface status going down:


user@device>show interfaces <if--x/x/x>
user@device>show log messages | match <if--x/x/x>
user@device>show log messages ==> will display the "[Error] Wedge-Detect : Host Loopback Wedge Detected: PFE: no," logs.

This issue affects:
Junos OS on 

MX Series 

with MPC10/MPC11/LC9600 line cards, EX9200 with EX9200-15C line cards, and MX304: 


  *  All versions before 21.2R3-S7, 
  *  from 21.4 before 21.4R3-S6, 
  *  from 22.2 before 22.2R3-S3, 
  *  all versions of 22.3,
  *  from 22.4 before 22.4R3, 
  *  from 23.2 before 23.2R2; 



Junos OS Evolved on PTX Series: 
  *  from 19.3R1-EVO before 21.2R3-S8-EVO,

  *  from 21.4-EVO before 21.4R3-S7-EVO, 
  *  from 22.1-EVO before 22.1R3-S6-EVO, 
  *  from 22.2-EVO before 22.2R3-S5-EVO, 
  *  from 22.3-EVO before 22.3R3-S3-EVO, 
  *  from 22.4-EVO before 22.4R3-S1-EVO, 
  *  from 23.2-EVO before 23.2R2-S2-EVO, 
  *  from 23.4-EVO before 23.4R2-EVO.



Junos OS Evolved releases prior to 19.3R1-EVO are unaffected by this vulnerability
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-755
References: https://supportportal.juniper.net/JSA88103
CVE: CVE-2024-39527
Published: 2024-10-11
Description: An Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the command-line interface (CLI) of Juniper Networks Junos OS on SRX Series devices allows a local, low-privileged user with access to the Junos CLI to view the contents of protected files on the file system.

Through the execution of crafted CLI commands, a user with limited permissions (e.g., a low privilege login class user) can access protected files that should not be accessible to the user. These files may contain sensitive information that can be used to cause further impact to the system.

This issue affects Junos OS on SRX Series: 



  *  All versions before 21.4R3-S8, 
  *  22.2 before 22.2R3-S5, 
  *  22.3 before 22.3R3-S4, 
  *  22.4 before 22.4R3-S4, 
  *  23.2 before 23.2R2-S2, 
  *  23.4 before 23.4R2.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://supportportal.juniper.net/JSA88104
CVE: CVE-2024-39534
Published: 2024-10-11
Description: An Incorrect Comparison vulnerability in the local address verification API of Juniper Networks Junos OS Evolved allows an unauthenticated network-adjacent attacker to create sessions or send traffic to the device using the network and broadcast address of the subnet assigned to an interface. This is unintended and unexpected behavior and can allow an attacker to bypass certain compensating controls, such as stateless firewall filters.

This issue affects Junos OS Evolved: 



  *  All versions before 21.4R3-S8-EVO, 
  *  22.2-EVO before 22.2R3-S4-EVO, 
  *  22.3-EVO before 22.3R3-S4-EVO, 
  *  22.4-EVO before 22.4R3-S3-EVO, 
  *  23.2-EVO before 23.2R2-S1-EVO, 
  *  23.4-EVO before 23.4R1-S2-EVO, 23.4R2-EVO.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-697
References: https://supportportal.juniper.net/JSA88105
CVE: CVE-2024-39544
Published: 2024-10-11
Description: An Incorrect Default Permissions vulnerability in the command line interface (CLI) of Juniper Networks Junos OS Evolved allows a low privileged local attacker to view NETCONF traceoptions files, representing an exposure of sensitive information.



On all Junos OS Evolved platforms, when NETCONF traceoptions are configured, NETCONF traceoptions files get created with an incorrect group permission, which allows 

a low-privileged user can access sensitive information compromising the confidentiality of the system.



Junos OS Evolved: 




  *  All versions before 20.4R3-S9-EVO, 
  *  21.2-EVO before 21.2R3-S7-EVO, 
  *  21.4-EVO before 21.4R3-S5-EVO, 
  *  22.1-EVO before 22.1R3-S5-EVO, 
  *  22.2-EVO before 22.2R3-S3-EVO, 
  *  22.3-EVO before 22.3R3-EVO, 22.3R3-S2-EVO, 
  *  22.4-EVO before 22.4R3-EVO, 
  *  23.2-EVO before 23.2R1-S2-EVO, 23.2R2-EVO.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-276
References: https://supportportal.juniper.net/JSA88106
CVE: CVE-2024-39547
Published: 2024-10-11
Description: An Improper Handling of Exceptional Conditions vulnerability in the rpd-server of Juniper Networks Junos OS and Junos OS Evolved within cRPD allows an unauthenticated network-based attacker sending crafted TCP traffic to the routing engine (RE) to cause a CPU-based Denial of Service (DoS).

If specially crafted TCP traffic is received by the control plane, or a TCP session terminates unexpectedly, it will cause increased control plane CPU utilization by the rpd-server process.

While not explicitly required, the impact is more severe when RIB sharding is enabled.

Task accounting shows unexpected reads by the RPD Server jobs for shards:

user@junos> show task accounting detail
...
read:RPD Server.0.0.0.0+780.192.168.0.78+48886 TOT:00[PII_REDACTED]9787 MAX:00[PII_REDACTED]0516 RUNS: 233888\
read:RPD Server.0.0.0.0+780.192.168.0.78+49144 TOT:00[PII_REDACTED]7565 MAX:00[PII_REDACTED]0360 RUNS: 233888\
read:RPD Server.0.0.0.0+780.192.168.0.78+49694 TOT:00[PII_REDACTED]0584 MAX:00[PII_REDACTED]0463 RUNS: 233888\
read:RPD Server.0.0.0.0+780.192.168.0.78+50246 TOT:00[PII_REDACTED]6998 MAX:00[PII_REDACTED]0338 RUNS: 233888\



This issue affects:

Junos OS with cRPD: 

  *  All versions before 21.2R3-S8, 
  *  21.4 before 21.4R3-S7, 
  *  22.1 before 22.1R3-S6, 
  *  22.2 before 22.2R3-S4, 
  *  22.3 before 22.3R3-S3, 
  *  22.4 before 22.4R3-S2, 
  *  23.2 before 23.2R2-S2, 
  *  24.2 before 24.2R2; 


Junos OS Evolved with cRPD: 

  *  All versions before 21.4R3-S7-EVO, 
  *  22.2 before 22.2R3-S4-EVO, 
  *  22.3 before 22.3R3-S3-EVO, 
  *  22.4 before 22.4R3-S2-EVO, 
  *  23.2 before 23.2R2-EVO.
CVSS Score: 7.5 (HIGH)
CWE: CWE-755
References: https://supportportal.juniper.net/JSA88108
CVE: CVE-2024-39563
Published: 2024-10-11
Description: A Command Injection vulnerability in Juniper Networks Junos Space allows an unauthenticated, network-based attacker sending a specially crafted request to execute arbitrary shell commands on the Junos Space Appliance, leading to remote command execution by the web application, gaining complete control of the device.

A specific script in the Junos Space web application allows attacker-controlled input from a GET request without sufficient input sanitization. A specially crafted request can exploit this vulnerability to execute arbitrary shell commands on the Junos Space Appliance.

This issue affects Junos Space 24.1R1. Previous versions of Junos Space are unaffected by this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-77
References: https://supportportal.juniper.net/JSA88110
CVE: CVE-2024-42640
Published: 2024-10-11
Description: angular-base64-upload prior to v0.1.21 is vulnerable to unauthenticated remote code execution via demo/server.php. Exploiting this vulnerability allows an attacker to upload arbitrary content to the server, which can subsequently be accessed through demo/uploads. This leads to the execution of previously uploaded content and enables the attacker to achieve code execution on the server. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/adonespitogo/angular-base64-upload; https://www.zyenra.com/blog/unauthenticated-rce-in-angular-base64-upload.html
CVE: CVE-2024-44729
Published: 2024-10-11
Description: Incorrect access control in the component app/src/server.js of Mirotalk before commit 9de226 allows unauthenticated attackers without presenter privileges to arbitrarily eject users from a meeting.
CVSS Score: 7.5 (HIGH)
CWE: CWE-732
References: https://aware7.com/de/blog/schwachstellen-in-videokonferenzsystemen/; https://github.com/miroslavpejic85; https://github.com/miroslavpejic85/mirotalk
CVE: CVE-2024-44730
Published: 2024-10-11
Description: Incorrect access control in the function handleDataChannelChat(dataMessage) of Mirotalk before commit c21d58 allows attackers to forge chat messages using an arbitrary sender name.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-924
References: https://aware7.com/de/blog/schwachstellen-in-videokonferenzsystemen/; https://github.com/miroslavpejic85; https://github.com/miroslavpejic85/mirotalk
CVE: CVE-2024-46088
Published: 2024-10-11
Description: An arbitrary file upload vulnerability in the ProductAction.entphone interface of Zhejiang University Entersoft Customer Resource Management System v2002 to v2024 allows attackers to execute arbitrary code via uploading a crafted file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: http://zhejiang.com; https://periwinkle-brother-031.notion.site/Analysis-of-any-file-upload-vulnerability-of-Zhejiang-University-Entersoft-Customer-Resource-Managem-0f88a0e77d6f4f638bc3c4e508a1e0ed; https://www.entersoft.cn/
CVE: CVE-2024-47489
Published: 2024-10-11
Description: An Improper Handling of Exceptional Conditions vulnerability in the Packet Forwarding Engine (pfe) of the Juniper Networks Junos OS Evolved on ACX Series devices allows an unauthenticated, network based attacker sending specific transit protocol traffic to cause a partial Denial of Service (DoS) to downstream devices.

Receipt of specific transit protocol packets is incorrectly processed by the Routing Engine (RE), filling up the DDoS protection queue which is shared between routing protocols. This influx of transit protocol packets causes DDoS protection violations, resulting in protocol flaps which can affect connectivity to networking devices.

This issue affects both IPv4 and IPv6. This issue does not require any specific routing protocol to be configured or enabled.

The following commands can be used to monitor the DDoS protection queue:

       labuser@re0> show evo-pfemand host pkt-stats

    labuser@re0> show host-path ddos all-policers

This issue affects Junos OS Evolved: 



  *  All versions before 21.4R3-S8-EVO, 
  *  from 22.2 before 22.2R3-S4-EVO, 
  *  from 22.3 before 22.3R3-S4-EVO, 
  *  from 22.4 before 22.4R3-S3-EVO, 
  *  from 23.2 before 23.2R2-EVO, 
  *  from 23.4 before 23.4R1-S1-EVO, 23.4R2-EVO, 
  *  from 24.2 before 24.2R2-EVO.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-755
References: https://supportportal.juniper.net/
CVE: CVE-2024-47490
Published: 2024-10-11
Description: An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS Evolved on ACX 7000 Series allows an unauthenticated, network based attacker to cause increased consumption of resources, ultimately resulting in a Denial of Service (DoS).

When specific transit MPLS packets are received by the PFE, these packets are internally forwarded to the Routing Engine (RE), rather than being handled appropriately. Continuous receipt of these MPLS packets causes resources to be exhausted. MPLS config is not required to be affected by this issue. 


This issue affects Junos OS Evolved ACX 7000 Series: 



  *  All versions before 21.4R3-S9-EVO,
  *  22.2-EVO before 22.2R3-S4-EVO, 
  *  22.3-EVO before 22.3R3-S3-EVO, 
  *  22.4-EVO before 22.4R3-S2-EVO, 
  *  23.2-EVO before 23.2R2-EVO, 
  *  23.4-EVO before 23.4R1-S1-EVO, 23.4R2-EVO.
CVSS Score: 8.2 (HIGH)
CWE: CWE-923
References: https://supportportal.juniper.net/JSA83009
CVE: CVE-2024-47491
Published: 2024-10-11
Description: An Improper Handling of Exceptional Conditions vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-based, unauthenticated attacker to cause Denial of Service (DoS).

When a BGP UPDATE with malformed path attribute is received over an established BGP session, rpd crashes and restarts. 

Continuous receipt of a BGP UPDATE with a specifically malformed path attribute will create a sustained Denial of Service (DoS) condition for impacted devices. While this issue affects systems running 32-bit and 64-bit systems, the probability of impact on 64-bit system is extremely low. 
According to  KB25803  https://supportportal.juniper.net/s/article/Junos-How-to-check-if-Junos-OS-is-64-or-32-bit-on-a-router , customers can confirm 32-bit or 64-bit system via the ' show version detail ' command:



     lab@router> show version detail| match 32
     JUNOS 32-bit kernel Software Suite 

     lab@router> show version detail| match 64
     JUNOS 64-bit kernel Software Suite 


This issue affects:

 Juniper Networks Junos OS: 

  *  All versions before 21.4R3-S8, 
  *  from 22.2 before 22.2R3-S4, 
  *  from 22.4 before 22.4R3-S3, 
  *  from 23.2 before 23.2R2-S1, 
  *  from 23.4 before 23.4R1-S2, 23.4R2.


 Juniper Networks Junos OS Evolved:   *  All versions before 21.4R3-S8-EVO, 
  *  from 22.2 before 22.2R3-S4-EVO, 
  *  from 22.4 before 22.4R3-S3-EVO,
  *  from 23.2 before 23.2R2-S1-EVO, 
  *  from 23.4 before 23.4R1-S2-EVO, 23.4R2-EVO.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-755
References: https://supportportal.juniper.net/
CVE: CVE-2024-47493
Published: 2024-10-11
Description: A Missing Release of Memory after Effective Lifetime vulnerability in the Packet Forwarding Engine (PFE) of the Juniper Networks Junos OS on the MX Series platforms with Trio-based FPCs allows an unauthenticated, adjacent attacker to cause a Denial of Service (DoS).

In case of channelized Modular Interface Cards (MICs), every physical interface flap operation will leak heap memory. Over a period of time, continuous physical interface flap operations causes local FPC  to eventually run out of memory and crash.  

Below CLI command can be used to check the memory usage over a period of time:

  user@host> show chassis fpc























                Temp  CPU Utilization (%)   CPU Utilization (%)  Memory   
Utilization (%)
  Slot State      (C)  Total  Interrupt      1min   5min  
15min DRAM (MB) Heap     Buffer

  0 
Online       43     41         
2                           2048       49         14

  1 
Online       43     41         
2                          
2048       49         14

  2 
Online       43     41         
2                          
2048       49         14









This issue affects Junos OS on MX Series: 




  *  All versions before 21.2R3-S7, 
  *  from 21.4 before 21.4R3-S6, 
  *  from 22.1 before 22.1R3-S5, 
  *  from 22.2 before 22.2R3-S3, 
  *  from 22.3 before 22.3R3-S2, 
  *  from 22.4 before 22.4R3, 
  *  from 23.2 before 23.2R2, 
  *  from 23.4 before 23.4R2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-401
References: https://supportportal.juniper.net/; https://www.juniper.net/documentation/us/en/software/junos/interfaces-link-multilink/topics/topic-map/link-multilink-services-understanding.html#id-multilink-interfaces-on-channelized-mics-overview
CVE: CVE-2024-47494
Published: 2024-10-11
Description: A Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in the AgentD process of Juniper Networks Junos OS allows an attacker who is already causing impact to established sessions which generates counter changes picked up by the AgentD process during telemetry polling, to move the AgentD process into a state where AgentD attempts to reap an already destroyed sensor. This reaping attempt then leads to memory corruption causing the FPC to crash which is a Denial of Service (DoS).





The FPC will recover automatically without user intervention after the crash.
This issue affects Junos OS: 

  *  All versions before 21.4R3-S9
  *  From 22.2 before 22.2R3-S5,
  *  From 22.3 before 22.3R3-S4,
  *  From 22.4 before 22.4R3-S3,
  *  From 23.2 before 23.2R2-S2,
  *  From 23.4 before 23.4R2.


This issue does not affect Junos OS Evolved.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-367
References: https://supportportal.juniper.net/JSA88121
CVE: CVE-2024-47495
Published: 2024-10-11
Description: An Authorization Bypass Through User-Controlled Key vulnerability allows a locally authenticated attacker with shell access to gain full control of the device when Dual Routing Engines (REs) are in use on Juniper Networks Junos OS Evolved devices.

This issue affects:
Juniper Networks Junos OS Evolved with dual-REs:
  *  All versions before 21.2R3-S8-EVO,
  *  from 21.4-EVO before 21.4R3-S8-EVO,
  *  from 22.2-EVO before 22.2R3-S4-EVO,
  *  from 22.3-EVO before 22.3R3-S4-EVO,
  *  from 22.4-EVO before 22.4R3-S3-EVO,
  *  from 23.2-EVO before 23.2R2-S1-EVO,
  *  from 23.4-EVO before 23.4R2-S1-EVO.



This issue does not affect Juniper Networks Junos OS.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-639
References: https://kb.juniper.net/JSA88122
CVE: CVE-2024-47496
Published: 2024-10-11
Description: A NULL Pointer Dereference vulnerability in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS allows a local, low-privileged attacker to cause a Denial-of-Service (DoS).

When a specific command is executed, the pfe crashes. This will cause traffic forwarding to be interrupted until the system self-recovers. Repeated execution will create a sustained DoS condition.

 This issue only affects MX Series devices with Line cards MPC1-MPC9.
This issue affects:
Junos OS on MX Series: 


  *  All versions before 21.4R3-S9, 
  *  from 22.2 before 22.2R3-S5, 
  *  from 22.3 before 22.3R3-S4, 
  *  from 22.4 before 22.4R3-S2, 
  *  from 23.2 before 23.2R2-S1, 
  *  from 23.4 before 23.4R2.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://supportportal.juniper.net/
CVE: CVE-2024-47497
Published: 2024-10-11
Description: An Uncontrolled Resource Consumption vulnerability in the http daemon (httpd) of Juniper Networks Junos OS on SRX Series, QFX Series, MX Series and EX Series allows an unauthenticated, network-based attacker to cause Denial-of-Service (DoS).

An attacker can send specific HTTPS connection requests to the device, triggering the creation of processes that are not properly terminated. Over time, this leads to resource exhaustion, ultimately causing the device to crash and restart.

The following command can be used to monitor the resource usage:
user@host> show system processes extensive | match mgd | count

This issue affects Junos OS on SRX Series and EX Series:
All versions before 21.4R3-S7,
from 22.2 before 22.2R3-S4,
from 22.3 before 22.3R3-S3,
from 22.4 before 22.4R3-S2,
from 23.2 before 23.2R2-S1,
from 23.4 before 23.4R1-S2, 23.4R2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://supportportal.juniper.net/
CVE: CVE-2024-47498
Published: 2024-10-11
Description: An Unimplemented or Unsupported Feature in UI vulnerability in the CLI of Juniper Networks Junos OS Evolved on QFX5000 Series allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS).

Several configuration statements meant to enforce limits on MAC learning and moves can be configured but do not take effect. This can lead to control plane overload situations which will severely impact the ability of the device to processes legitimate traffic.



This issue affects Junos OS Evolved on QFX5000 Series:



  *  All versions before 21.4R3-S8-EVO,
  *  22.2-EVO versions before 22.2R3-S5-EVO,

  *  22.4-EVO versions before 22.4R3-EVO,
  *  23.2-EVO versions before 23.2R2-EVO.
CVSS Score: 6.5 (MEDIUM)
References: https://supportportal.juniper.net/JSA88128
CVE: CVE-2024-47499
Published: 2024-10-11
Description: An Improper Check for Unusual or Exceptional Conditions vulnerability in the routing protocol daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network based attacker to cause a Denial of Service (DoS). 

In a scenario where BGP Monitoring Protocol (BMP) is configured with rib-in pre-policy monitoring, receiving a BGP update with a specifically malformed AS PATH attribute over an established BGP session, can cause an RPD crash and restart.

This issue affects:

Junos OS: 



  *  All versions before 21.2R3-S8,
  *  21.4 versions before 21.4R3-S8,
  *  22.2 versions before 22.2R3-S4,
  *  22.3 versions before 22.3R3-S3,
  *  22.4 versions before 22.4R3-S2,
  *  23.2 versions before 23.2R2-S1,
  *  23.4 versions before 23.4R1-S2, 23.4R2;







Junos OS Evolved:




  *  All versions before 21.2R3-S8-EVO,
  *  21.4 versions before 21.4R3-S8-EVO,
  *  22.2 versions before 22.2R3-S4-EVO,
  *  22.3 versions before 22.3R3-S3-EVO,
  *  22.4 versions before 22.4R3-S2-EVO,
  *  23.2 versions before 23.2R2-S1-EVO,
  *  23.4 versions before 23.4R1-S2-EVO, 23.4R2-EVO.
CVSS Score: 7.5 (HIGH)
CWE: CWE-754
References: https://supportportal.juniper.net/JSA88129
CVE: CVE-2024-47501
Published: 2024-10-11
Description: A NULL Pointer Dereference vulnerability in the 

packet forwarding engine (pfe) of Juniper Networks Junos OS on MX304, MX with MPC10/11/LC9600, and EX9200 with EX9200-15C allows a locally authenticated attacker with low privileges to cause a Denial of Service (DoS).

In a VPLS or Junos Fusion scenario, the execution of specific show commands will cause all FPCs hosting VPLS sessions or connecting to satellites to crash and restart.

This issue affects Junos on MX304, MX with MPC10/11/LC9600 and EX9200 with EX9200-15C: 



  *  All version before 21.2R3-S1,
  *  21.3 versions before 21.3R3, 
  *  21.4 versions before 21.4R2.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://supportportal.juniper.net/JSA88131