deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-4999
Published: 2018-01-10
Description: vendor/plugins/dataset/lib/dataset/database/mysql.rb in the kajam gem 1.0.3.rc2 for Ruby places the mysql user password on the (1) mysqldump command line in the capture function and (2) mysql command line in the restore function, which allows local users to obtain sensitive information by listing the process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2014/07/07/19; http://www.openwall.com/lists/oss-security/2014/07/17/5; http://www.vapid.dhs.org/advisories/kajam-1.0.3.rc2.html
CVE: CVE-2014-5000
Published: 2018-01-10
Description: The login function in lib/lawn.rb in the lawn-login gem 0.0.7 for Ruby places credentials on the curl command line, which allows local users to obtain sensitive information by listing the process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2014/07/07/20; http://www.openwall.com/lists/oss-security/2014/07/17/5; http://www.vapid.dhs.org/advisories/lawn-login-0.0.7.html
CVE: CVE-2014-5001
Published: 2018-01-10
Description: lib/ksymfony1.rb in the kcapifony gem 2.1.6 for Ruby places database user passwords on the (1) mysqldump, (2) pg_dump, (3) mysql, and (4) psql command lines, which allows local users to obtain sensitive information by listing the processes.
CVSS Score: 7.8 (HIGH)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2014/07/07/21; http://www.openwall.com/lists/oss-security/2014/07/17/5; http://www.vapid.dhs.org/advisories/kcapifony-2.1.6.html
CVE: CVE-2014-5002
Published: 2018-01-10
Description: The lynx gem before 1.0.0 for Ruby places the configured password on command lines, which allows local users to obtain sensitive information by listing processes.
CVSS Score: 7.8 (HIGH)
CWE: CWE-255
References: http://www.openwall.com/lists/oss-security/2014/07/07/23; http://www.openwall.com/lists/oss-security/2014/07/17/5; http://www.vapid.dhs.org/advisories/lynx-0.2.0.html
CVE: CVE-2014-5003
Published: 2018-01-10
Description: chef/travis-cookbooks/ci_environment/perlbrew/recipes/default.rb in the ciborg gem 3.0.0 for Ruby allows local users to write to arbitrary files and gain privileges via a symlink attack on /tmp/perlbrew-installer.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2014/07/07/24; http://www.openwall.com/lists/oss-security/2014/07/17/5; http://www.vapid.dhs.org/advisories/ciborg-3.0.0.html
CVE: CVE-2014-5004
Published: 2018-01-10
Description: lib/brbackup.rb in the brbackup gem 0.1.1 for Ruby places the database password on the mysql command line, which allows local users to obtain sensitive information by listing the process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2014/07/10/6; http://www.openwall.com/lists/oss-security/2014/07/17/5; http://www.securityfocus.com/bid/68506
CVE: CVE-2017-15662
Published: 2018-01-10
Description: In Flexense VX Search Enterprise v10.1.12, the Control Protocol suffers from a denial of service vulnerability. The attack vector is a crafted SERVER_GET_INFO packet sent to control port 9123.
CVSS Score: 7.5 (HIGH)
CWE: CWE-358
References: http://packetstormsecurity.com/files/145764/VX-Search-Enterprise-10.1.12-Denial-Of-Service.html; https://www.exploit-db.com/exploits/43451/; http://packetstormsecurity.com/files/145764/VX-Search-Enterprise-10.1.12-Denial-Of-Service.html
CVE: CVE-2017-15663
Published: 2018-01-10
Description: In Flexense Disk Pulse Enterprise v10.1.18, the Control Protocol suffers from a denial of service vulnerability. The attack vector is a crafted SERVER_GET_INFO packet sent to control port 9120.
CVSS Score: 7.5 (HIGH)
CWE: CWE-358
References: http://packetstormsecurity.com/files/145763/Disk-Pulse-Enterprise-10.1.18-Denial-Of-Service.html; https://www.exploit-db.com/exploits/43452/; https://www.exploit-db.com/exploits/43589/
CVE: CVE-2017-15664
Published: 2018-01-10
Description: In Flexense Sync Breeze Enterprise v10.1.16, the Control Protocol suffers from a denial of service vulnerability. The attack vector is a crafted SERVER_GET_INFO packet sent to control port 9121.
CVSS Score: 7.5 (HIGH)
CWE: CWE-358
References: http://packetstormsecurity.com/files/145760/Sync-Breeze-Enterprise-10.1.16-Denial-Of-Service.html; https://www.exploit-db.com/exploits/43453/; http://packetstormsecurity.com/files/145760/Sync-Breeze-Enterprise-10.1.16-Denial-Of-Service.html
CVE: CVE-2017-15665
Published: 2018-01-10
Description: In Flexense DiskBoss Enterprise 8.5.12, the Control Protocol suffers from a denial of service vulnerability. The attack vector is a crafted SERVER_GET_INFO packet sent to control port 8094.
CVSS Score: 7.5 (HIGH)
CWE: CWE-358
References: http://packetstormsecurity.com/files/145756/DiskBoss-Enterprise-8.5.12-Denial-Of-Service.html; https://www.exploit-db.com/exploits/43454/; http://packetstormsecurity.com/files/145756/DiskBoss-Enterprise-8.5.12-Denial-Of-Service.html
CVE: CVE-2017-15941
Published: 2018-01-10
Description: Cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.7, when the GlobalProtect gateway or portal is configured, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/102446; http://www.securitytracker.com/id/1040147; https://security.paloaltonetworks.com/CVE-2017-15941
CVE: CVE-2017-16878
Published: 2018-01-10
Description: Cross-site scripting (XSS) vulnerability in the Captive Portal function in Palo Alto Networks PAN-OS before 8.0.7 allows remote attackers to inject arbitrary web script or HTML by leveraging an unspecified configuration.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securitytracker.com/id/1040148; https://security.paloaltonetworks.com/CVE-2017-16878; http://www.securitytracker.com/id/1040148
CVE: CVE-2017-17485
Published: 2018-01-10
Description: FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the Spring libraries are available in the classpath.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: http://www.securityfocus.com/archive/1/541652/100/0/threaded; https://access.redhat.com/errata/RHSA-2018:0116; https://access.redhat.com/errata/RHSA-2018:0342
CVE: CVE-2017-17662
Published: 2018-01-10
Description: Directory traversal in the HTTP server on Yawcam 0.2.6 through 0.6.0 devices allows attackers to read arbitrary files through a sequence of the form '.x./' or '....\x/' where x is a pattern composed of one or more (zero or more for the second pattern) of either \ or ..\ -- for example a '.\./', '....\/' or '...\./' sequence. For files with no extension, a single dot needs to be appended to ensure the HTTP server does not alter the request, e.g., a "GET /.\./.\./.\./.\./.\./.\./.\./windows/system32/drivers/etc/hosts." request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.com/files/145770/Yawcam-0.6.0-Directory-Traversal.html; http://www.yawcam.com/news.php; http://packetstormsecurity.com/files/145770/Yawcam-0.6.0-Directory-Traversal.html
CVE: CVE-2017-17841
Published: 2018-01-10
Description: Palo Alto Networks PAN-OS 6.1, 7.1, and 8.0.x before 8.0.7, when an interface implements SSL decryption with RSA enabled or hosts a GlobalProtect portal or gateway, might allow remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, aka a ROBOT attack.
CVSS Score: 5.9 (MEDIUM)
References: http://www.securityfocus.com/bid/102458; http://www.securitytracker.com/id/1040149; https://security.paloaltonetworks.com/CVE-2017-17841
CVE: CVE-2017-18023
Published: 2018-01-10
Description: Office Tracker 11.2.5 has XSS via the logincount parameter to the /otweb/OTPClientLogin URI.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/145775/Office-Tracker-11.2.5-Cross-Site-Scripting.html; http://packetstormsecurity.com/files/145775/Office-Tracker-11.2.5-Cross-Site-Scripting.html
CVE: CVE-2017-18024
Published: 2018-01-10
Description: AvantFAX 3.3.3 has XSS via an arbitrary parameter name to the default URI, as demonstrated by a parameter whose name contains a SCRIPT element and whose value is 1.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/145776/AvantFAX-3.3.3-Cross-Site-Scripting.html; http://packetstormsecurity.com/files/145776/AvantFAX-3.3.3-Cross-Site-Scripting.html
CVE: CVE-2017-3765
Published: 2018-01-10
Description: In Enterprise Networking Operating System (ENOS) in Lenovo and IBM RackSwitch and BladeCenter products, an authentication bypass known as "HP Backdoor" was discovered during a Lenovo security audit in the serial console, Telnet, SSH, and Web interfaces. This bypass mechanism can be accessed when performing local authentication under specific circumstances. If exploited, admin-level access to the switch is granted.
CVSS Score: 7.0 (HIGH)
CWE: CWE-287
References: http://www.securitytracker.com/id/1040296; https://support.lenovo.com/us/en/product_security/LEN-16095; http://www.securitytracker.com/id/1040296
CVE: CVE-2017-11069
Published: 2018-01-10
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, manipulation of SafeSwitch Image data can result in Heap overflow.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/102413; http://www.securitytracker.com/id/1040106; https://source.android.com/security/bulletin/2018-01-01
CVE: CVE-2017-12189
Published: 2018-01-10
Description: It was discovered that the jboss init script as used in Red Hat JBoss Enterprise Application Platform 7.0.7.GA performed unsafe file handling which could result in local privilege escalation. This issue is a result of an incomplete fix for CVE-2016-8656.
CVSS Score: 7.8 (HIGH)
CWE: CWE-282
References: http://www.securityfocus.com/bid/102407; https://access.redhat.com/errata/RHSA-2018:0002; https://access.redhat.com/errata/RHSA-2018:0003
CVE: CVE-2017-15849
Published: 2018-01-10
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a LayerStack can be destroyed in between Validate and Commit by the application resulting in a Use After Free condition.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: http://www.securityfocus.com/bid/102413; http://www.securitytracker.com/id/1040106; https://source.android.com/security/bulletin/2018-01-01
CVE: CVE-2017-17946
Published: 2018-01-10
Description: A buffer overflow in Handy Password 4.9.3 allows remote attackers to execute arbitrary code via a long "Title name" field in "mail box" data that is mishandled in an "Open from mail box" action.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://seclists.org/fulldisclosure/2018/Jan/22; https://sidechannel.tempestsi.com/password-manager-flaw-allows-for-arbitrary-command-execution-b6bb273206b1; http://seclists.org/fulldisclosure/2018/Jan/22
CVE: CVE-2017-11003
Published: 2018-01-10
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while updating a firmware image, data is read from flash into RAM without checking that the data fits into allotted RAM size.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://source.android.com/security/bulletin/pixel/2018-01-01; https://source.android.com/security/bulletin/pixel/2018-01-01
CVE: CVE-2017-11066
Published: 2018-01-10
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while flashing ubi image an uninitialized memory could be accessed.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://source.android.com/security/bulletin/pixel/2018-01-01; https://source.android.com/security/bulletin/pixel/2018-01-01
CVE: CVE-2017-11079
Published: 2018-01-10
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing sparse image, uninitialized heap memory can potentially be flashed due to the lack of validation of sparse image block header size.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200
References: https://source.android.com/security/bulletin/pixel/2018-01-01; https://source.android.com/security/bulletin/pixel/2018-01-01
CVE: CVE-2017-11080
Published: 2018-01-10
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing a user supplied sparse image, a buffer overflow vulnerability could occur if the sparse header block size is equal to[PII_REDACTED].
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://source.android.com/security/bulletin/pixel/2018-01-01; https://source.android.com/security/bulletin/pixel/2018-01-01
CVE: CVE-2017-11081
Published: 2018-01-10
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, there is a potential buffer overflow vulnerability in hdd_parse_setrmcenable_command and hdd_parse_setrmcactionperiod_command APIs as buffers defined in this API can hold maximum 32 bytes but data more than 32 bytes can get copied.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://source.android.com/security/bulletin/pixel/2018-01-01; https://source.android.com/security/bulletin/pixel/2018-01-01
CVE: CVE-2017-14869
Published: 2018-01-10
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while performing update of FOTA partition, uninitialized data can be pushed to storage.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://source.android.com/security/bulletin/pixel/2018-01-01; https://source.android.com/security/bulletin/pixel/2018-01-01
CVE: CVE-2017-14870
Published: 2018-01-10
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while updating the recovery message for eMMC devices, 1088 bytes of stack memory can potentially be leaked.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://source.android.com/security/bulletin/pixel/2018-01-01; https://source.android.com/security/bulletin/pixel/2018-01-01
CVE: CVE-2017-14873
Published: 2018-01-10
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the pp_pgc_get_config() graphics driver function, a kernel memory overwrite can potentially occur.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://source.android.com/security/bulletin/pixel/2018-01-01; https://source.android.com/security/bulletin/pixel/2018-01-01
CVE: CVE-2017-14879
Published: 2018-01-10
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, by calling an IPA ioctl and searching for routing/filer/hdr rule handle from ipa_idr pointer using ipa_idr_find() function, the wrong structure pointer can be returned resulting in a slab out of bound access in the IPA driver.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://source.android.com/security/bulletin/pixel/2018-01-01; https://source.android.com/security/bulletin/pixel/2018-01-01
CVE: CVE-2017-15845
Published: 2018-01-10
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, an invalid input of firmware size (negative value) from user space can potentially lead to the memory leak or buffer overflow during the WLAN cal data store operation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-772
References: https://source.android.com/security/bulletin/pixel/2018-01-01; https://source.android.com/security/bulletin/pixel/2018-01-01
CVE: CVE-2017-15847
Published: 2018-01-10
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the SPCom kernel driver, a race condition exists when creating a channel.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: https://source.android.com/security/bulletin/pixel/2018-01-01; https://source.android.com/security/bulletin/pixel/2018-01-01
CVE: CVE-2017-15848
Published: 2018-01-10
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the fastrpc kernel driver, a buffer overflow vulnerability from userspace may potentially exist.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://source.android.com/security/bulletin/pixel/2018-01-01; https://source.android.com/security/bulletin/pixel/2018-01-01
CVE: CVE-2017-15850
Published: 2018-01-10
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, userspace can read values from audio codec registers.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://source.android.com/security/bulletin/pixel/2018-01-01; https://source.android.com/security/bulletin/pixel/2018-01-01
CVE: CVE-2017-9689
Published: 2018-01-10
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a specially-crafted HDMI CEC message can be used to cause stack memory corruption.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://source.android.com/security/bulletin/pixel/2018-01-01; https://source.android.com/security/bulletin/pixel/2018-01-01
CVE: CVE-2017-9705
Published: 2018-01-10
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, concurrent rx notifications and read() operations in the G-Link PKT driver can result in a double free condition due to missing locking resulting in list_del() and list_add() overlapping and corrupting the next and previous pointers.
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: https://source.android.com/security/bulletin/pixel/2018-01-01; https://source.android.com/security/bulletin/pixel/2018-01-01
CVE: CVE-2017-9712
Published: 2018-01-10
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, if userspace provides a too-large IE length in wlan_hdd_cfg80211_set_ie, a buffer over-read occurs.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://source.android.com/security/bulletin/pixel/2018-01-01; https://source.android.com/security/bulletin/pixel/2018-01-01
CVE: CVE-2018-0001
Published: 2018-01-10
Description: A remote, unauthenticated attacker may be able to execute code by exploiting a use-after-free defect found in older versions of PHP through injection of crafted data via specific PHP URLs within the context of the J-Web process. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D67; 12.3 versions prior to 12.3R12-S5; 12.3X48 versions prior to 12.3X48-D35; 14.1 versions prior to 14.1R8-S5, 14.1R9; 14.1X53 versions prior to 14.1X53-D44, 14.1X53-D50; 14.2 versions prior to 14.2R7-S7, 14.2R8; 15.1 versions prior to 15.1R3; 15.1X49 versions prior to 15.1X49-D30; 15.1X53 versions prior to 15.1X53-D70.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: http://www.securityfocus.com/bid/103092; http://www.securitytracker.com/id/1040180; https://kb.juniper.net/JSA10828
CVE: CVE-2018-0002
Published: 2018-01-10
Description: On SRX Series and MX Series devices with a Service PIC with any ALG enabled, a crafted TCP/IP response packet processed through the device results in memory corruption leading to a flowd daemon crash. Sustained crafted response packets lead to repeated crashes of the flowd daemon which results in an extended Denial of Service condition. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D60 on SRX series; 12.3X48 versions prior to 12.3X48-D35 on SRX series; 14.1 versions prior to 14.1R9 on MX series; 14.2 versions prior to 14.2R8 on MX series; 15.1X49 versions prior to 15.1X49-D60 on SRX series; 15.1 versions prior to 15.1R5-S8, 15.1F6-S9, 15.1R6-S4, 15.1R7 on MX series; 16.1 versions prior to 16.1R6 on MX series; 16.2 versions prior to 16.2R3 on MX series; 17.1 versions prior to 17.1R2-S4, 17.1R3 on MX series. No other Juniper Networks products or platforms are affected by this issue.
CVSS Score: 8.2 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1040178; https://kb.juniper.net/JSA10829; http://www.securitytracker.com/id/1040178
CVE: CVE-2018-0003
Published: 2018-01-10
Description: A specially crafted MPLS packet received or processed by the system, on an interface configured with MPLS, will store information in the system memory. Subsequently, if this stored information is accessed, this may result in a kernel crash leading to a denial of service. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D71; 12.3 versions prior to 12.3R12-S7; 12.3X48 versions prior to 12.3X48-D55; 14.1 versions prior to 14.1R8-S5, 14.1R9; 14.1X53 versions prior to 14.1X53-D45, 14.1X53-D107; 14.2 versions prior to 14.2R7-S7, 14.2R8; 15.1 versions prior to 15.1F5-S8, 15.1F6-S8, 15.1R5-S6, 15.1R6-S3, 15.1R7; 15.1X49 versions prior to 15.1X49-D100; 15.1X53 versions prior to 15.1X53-D65, 15.1X53-D231; 16.1 versions prior to 16.1R3-S6, 16.1R4-S6, 16.1R5; 16.1X65 versions prior to 16.1X65-D45; 16.2 versions prior to 16.2R2-S1, 16.2R3; 17.1 versions prior to 17.1R2-S2, 17.1R3; 17.2 versions prior to 17.2R1-S3, 17.2R2; 17.2X75 versions prior to 17.2X75-D50. No other Juniper Networks products or platforms are affected by this issue.
CVSS Score: 6.5 (MEDIUM)
References: http://www.securityfocus.com/bid/105715; http://www.securitytracker.com/id/1040179; https://kb.juniper.net/JSA10831
CVE: CVE-2018-0004
Published: 2018-01-10
Description: A sustained sequence of different types of normal transit traffic can trigger a high CPU consumption denial of service condition in the Junos OS register and schedule software interrupt handler subsystem when a specific command is issued to the device. This affects one or more threads and conversely one or more running processes running on the system. Once this occurs, the high CPU event(s) affects either or both the forwarding and control plane. As a result of this condition the device can become inaccessible in either or both the control and forwarding plane and stops forwarding traffic until the device is rebooted. The issue will reoccur after reboot upon receiving further transit traffic. Score: 5.7 MEDIUM (CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) For network designs utilizing layer 3 forwarding agents or other ARP through layer 3 technologies, the score is slightly higher. Score: 6.5 MEDIUM (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) If the following entry exists in the RE message logs then this may indicate the issue is present. This entry may or may not appear when this issue occurs. /kernel: Expensive timeout(9) function: Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D50; 12.3X48 versions prior to 12.3X48-D30; 12.3R versions prior to 12.3R12-S7; 14.1 versions prior to 14.1R8-S4, 14.1R9; 14.1X53 versions prior to 14.1X53-D30, 14.1X53-D34; 14.2 versions prior to 14.2R8; 15.1 versions prior to 15.1F6, 15.1R3; 15.1X49 versions prior to 15.1X49-D40; 15.1X53 versions prior to 15.1X53-D31, 15.1X53-D33, 15.1X53-D60. No other Juniper Networks products or platforms are affected by this issue.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: http://www.securitytracker.com/id/1040183; https://kb.juniper.net/JSA10832; http://www.securitytracker.com/id/1040183