deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-31552
Published: 2021-04-22
Description: An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. It incorrectly executed certain rules related to blocking accounts after account creation. Such rules would allow for user accounts to be created while blocking only the IP address used to create an account (and not the user account itself). Such rules could also be used by a nefarious, unprivileged user to catalog and enumerate any number of IP addresses related to these account creations.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-863
References: https://gerrit.wikimedia.org/r/q/I8bae477ad7e4d[PII_REDACTED]ac2decf28e4313da1; https://phabricator.wikimedia.org/T152394; https://gerrit.wikimedia.org/r/q/I8bae477ad7e4d[PII_REDACTED]ac2decf28e4313da1
CVE: CVE-2021-31553
Published: 2021-04-22
Description: An issue was discovered in the CheckUser extension for MediaWiki through 1.35.2. MediaWiki usernames with trailing whitespace could be stored in the cu_log database table such that denial of service occurred for certain CheckUser extension pages and functionality. For example, the attacker could turn off Special:CheckUserLog and thus interfere with usage tracking.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-428
References: https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CheckUser/+/666963; https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CheckUser/+/666964; https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CheckUser/+/667023
CVE: CVE-2021-31554
Published: 2021-04-22
Description: An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. It improperly handled account blocks for certain automatically created MediaWiki user accounts, thus allowing nefarious users to remain unblocked.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-863
References: https://gerrit.wikimedia.org/r/q/Ie1f4333d5b1c9d17fb2236fe38a31de427a4cc48; https://phabricator.wikimedia.org/T272244; https://gerrit.wikimedia.org/r/q/Ie1f4333d5b1c9d17fb2236fe38a31de427a4cc48
CVE: CVE-2021-31555
Published: 2021-04-22
Description: An issue was discovered in the Oauth extension for MediaWiki through 1.35.2. It did not validate the oarc_version (aka oauth_registered_consumer.oarc_version) parameter's length.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://gerrit.wikimedia.org/r/q/I222c053b4b14ac1ad0f5b3a51565b1b9cd4c139d; https://phabricator.wikimedia.org/T277388; https://gerrit.wikimedia.org/r/q/I222c053b4b14ac1ad0f5b3a51565b1b9cd4c139d
CVE: CVE-2021-3287
Published: 2021-04-22
Description: Zoho ManageEngine OpManager before 12.5.329 allows unauthenticated Remote Code Execution due to a general bypass in the deserialization class.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: http://packetstormsecurity.com/files/164231/ManageEngine-OpManager-SumPDU-Java-Deserialization.html; https://www.manageengine.com/network-monitoring/help/read-me-complete.html#125329; http://packetstormsecurity.com/files/164231/ManageEngine-OpManager-SumPDU-Java-Deserialization.html
CVE: CVE-2021-27736
Published: 2021-04-22
Description: FusionAuth fusionauth-samlv2 before 0.5.4 allows XXE attacks via a forged AuthnRequest or LogoutRequest because parseFromBytes uses javax.xml.parsers.DocumentBuilderFactory unsafely.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-611
References: https://github.com/FusionAuth/fusionauth-samlv2/commit/c66fb689d50010662f705d5b585c6388ce555dbd; https://github.com/FusionAuth/fusionauth-samlv2/compare/0.5.3...0.5.4; https://www.compass-security.com/fileadmin/Research/Advisories/2021-03_CSNC-2021-004_FusionAuth_SAML_Library_XML_External_Entity.txt
CVE: CVE-2021-22540
Published: 2021-04-22
Description: Bad validation logic in the Dart SDK versions prior to 2.12.3 allow an attacker to use an XSS attack via DOM clobbering. The validation logic in dart:html for creating DOM nodes from text did not sanitize properly when it came across template tags.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/dart-lang/sdk/commit/ce5a1c2392debce967415d4c09359ff2555e3588; https://github.com/dart-lang/sdk/security/advisories/GHSA-3rfv-4jvg-9522; https://github.com/dart-lang/sdk/commit/ce5a1c2392debce967415d4c09359ff2555e3588
CVE: CVE-2021-27400
Published: 2021-04-22
Description: HashiCorp Vault and Vault Enterprise Cassandra integrations (storage backend and database secrets engine plugin) did not validate TLS certificates when connecting to Cassandra clusters. Fixed in 1.6.4 and 1.7.1
CVSS Score: 7.5 (HIGH)
CWE: CWE-295
References: https://discuss.hashicorp.com/t/hcsec-2021-10-vault-s-cassandra-integrations-did-not-validate-tls-certificates/23463; https://discuss.hashicorp.com/t/hcsec-2021-10-vault-s-cassandra-integrations-did-not-validate-tls-certificates/23463
CVE: CVE-2021-29653
Published: 2021-04-22
Description: HashiCorp Vault and Vault Enterprise 1.5.1 and newer, under certain circumstances, may exclude revoked but unexpired certificates from the CRL. Fixed in 1.5.8, 1.6.4, and 1.7.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-295
References: https://discuss.hashicorp.com/t/hcsec-2021-09-vault-s-pki-engine-crl-may-exclude-revoked-but-unexpired-certificates-after-tidy/23461/2; https://discuss.hashicorp.com/t/hcsec-2021-09-vault-s-pki-engine-crl-may-exclude-revoked-but-unexpired-certificates-after-tidy/23461/2
CVE: CVE-2021-30476
Published: 2021-04-22
Description: HashiCorp Terraform’s Vault Provider (terraform-provider-vault) did not correctly configure GCE-type bound labels for Vault’s GCP auth method. Fixed in 2.19.1.
CVSS Score: 9.8 (CRITICAL)
References: https://discuss.hashicorp.com/t/hcsec-2021-11-terraform-s-vault-provider-did-not-correctly-configure-bound-labels-for-gcp-auth/23464/2; https://github.com/hashicorp/terraform-provider-vault/issues/996; https://discuss.hashicorp.com/t/hcsec-2021-11-terraform-s-vault-provider-did-not-correctly-configure-bound-labels-for-gcp-auth/23464/2
CVE: CVE-2020-7858
Published: 2021-04-22
Description: There is a directory traversing vulnerability in the download page url of AquaNPlayer 2.0.0.92. The IP of the download page url is localhost and an attacker can traverse directories using "dot dot" sequences(../../) to view host file on the system. This vulnerability can cause information leakage.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-548, CWE-22
References: https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36014; https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36014
CVE: CVE-2020-7861
Published: 2021-04-22
Description: AnySupport (Remote support solution) before 2019.3.21.0 allows directory traversing because of swprintf function to copy file from a management PC to a client PC. This can be lead to arbitrary file execution.
CVSS Score: 8.4 (HIGH)
CWE: CWE-23, CWE-22
References: https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36016; https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36016
CVE: CVE-2021-23133
Published: 2021-04-22
Description: A race condition in Linux kernel SCTP sockets (net/sctp/socket.c) before 5.12-rc8 can lead to kernel privilege escalation from the context of a network service or an unprivileged process. If sctp_destroy_sock is called without sock_net(sk)->sctp.addr_wq_lock then an element is removed from the auto_asconf_splist list without any proper locking. This can be exploited by an attacker with network service privileges to escalate to root or from the context of an unprivileged user directly if a BPF_CGROUP_INET_SOCK_CREATE is attached which denies creation of some SCTP socket.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-362, CWE-362
References: http://www.openwall.com/lists/oss-security/2021/05/10/1; http://www.openwall.com/lists/oss-security/2021/05/10/2; http://www.openwall.com/lists/oss-security/2021/05/10/3
CVE: CVE-2021-27277
Published: 2021-04-22
Description: This vulnerability allows local attackers to escalate privileges on affected installations of SolarWinds Orion Virtual Infrastructure Monitor 2020.2. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the OneTimeJobSchedulerEventsService WCF service. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-11955.
CVSS Score: 7.8 (HIGH)
CWE: CWE-502
References: https://documentation.solarwinds.com/en/Success_Center/SAM/Content/Release_Notes/SAM_2020-2-5_release_notes.htm#Fixed; https://www.zerodayinitiative.com/advisories/ZDI-21-373/; https://documentation.solarwinds.com/en/Success_Center/SAM/Content/Release_Notes/SAM_2020-2-5_release_notes.htm#Fixed
CVE: CVE-2021-27278
Published: 2021-04-22
Description: This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.1-49141. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the Toolgate component. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of the current user on the host system. Was ZDI-CAN-12130.
CVSS Score: 8.2 (HIGH)
CWE: CWE-22
References: https://kb.parallels.com/en/125013; https://www.zerodayinitiative.com/advisories/ZDI-21-412/; https://kb.parallels.com/en/125013
CVE: CVE-2021-28168
Published: 2021-04-22
Description: Eclipse Jersey 2.28 to 2.33 and Eclipse Jersey 3.0.0 to 3.0.1 contains a local information disclosure vulnerability. This is due to the use of the File.createTempFile which creates a file inside of the system temporary directory with the permissions: -rw-r--r--. Thus the contents of this file are viewable by all other users locally on the system. As such, if the contents written is security sensitive, it can be disclosed to other local users.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-378, CWE-379, CWE-668
References: https://github.com/eclipse-ee4j/jersey/pull/4712; https://github.com/eclipse-ee4j/jersey/security/advisories/GHSA-c43q-5hpj-4crv; https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe%40%3Cusers.kafka.apache.org%3E
CVE: CVE-2021-30356
Published: 2021-04-22
Description: A denial of service vulnerability was reported in Check Point Identity Agent before R81.018.0000, which could allow low privileged users to overwrite protected system files.
CVSS Score: 8.1 (HIGH)
CWE: CWE-59
References: https://supportcontent.checkpoint.com/solutions?id=sk134312; https://supportcontent.checkpoint.com/solutions?id=sk134312
CVE: CVE-2021-31571
Published: 2021-04-22
Description: The kernel in Amazon Web Services FreeRTOS before 10.4.3 has an integer overflow in queue.c for queue creation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: https://github.com/FreeRTOS/FreeRTOS-Kernel/commit/47338393f1f79558f[PII_REDACTED]f09f81d7c4837; https://github.com/FreeRTOS/FreeRTOS-Kernel/commit/47338393f1f79558f[PII_REDACTED]f09f81d7c4837
CVE: CVE-2021-31572
Published: 2021-04-22
Description: The kernel in Amazon Web Services FreeRTOS before 10.4.3 has an integer overflow in stream_buffer.c for a stream buffer.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: https://github.com/FreeRTOS/FreeRTOS-Kernel/commit/d05b9c123f2bf9090bce386a244fc934ae44db5b; https://github.com/FreeRTOS/FreeRTOS-Kernel/commit/d05b9c123f2bf9090bce386a244fc934ae44db5b
CVE: CVE-2021-20590
Published: 2021-04-22
Description: Improper authentication vulnerability in GOT2000 series GT27 model VNC server versions 01.39.010 and prior, GOT2000 series GT25 model VNC server versions 01.39.010 and prior, GOT2000 series GT21 model GT2107-WTBD VNC server versions 01.40.000 and prior, GOT2000 series GT21 model GT2107-WTSD VNC server versions 01.40.000 and prior, GOT SIMPLE series GS21 model GS2110-WTBD-N VNC server versions 01.40.000 and prior and GOT SIMPLE series GS21 model GS2107-WTBD-N VNC server versions 01.40.000 and prior allows a remote unauthenticated attacker to gain unauthorized access via specially crafted packets when the "VNC server" function is used.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://jvn.jp/vu/JVNVU97615777/index.html; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-001_en.pdf; https://jvn.jp/vu/JVNVU97615777/index.html
CVE: CVE-2021-3496
Published: 2021-04-22
Description: A heap-based buffer overflow was found in jhead in version 3.06 in Get16u() in exif.c when processing a crafted file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787
References: https://bugzilla.redhat.com/show_bug.cgi?id=1949245; https://github.com/Matthias-Wandel/jhead/issues/33; https://security.gentoo.org/glsa/202210-17
CVE: CVE-2021-0214
Published: 2021-04-22
Description: A vulnerability in the distributed or centralized periodic packet management daemon (PPMD) of Juniper Networks Junos OS may cause receipt of a malformed packet to crash and restart the PPMD process, leading to network destabilization, service interruption, and a Denial of Service (DoS) condition. Continued receipt and processing of these malformed packets will repeatedly crash the PPMD process and sustain the Denial of Service (DoS) condition. Due to the nature of the specifically crafted packet, exploitation of this issue requires direct, adjacent connectivity to the vulnerable component. This issue affects Juniper Networks Junos OS: 17.3 versions prior to 17.3R3-S11; 17.4 versions prior to 17.4R2-S12, 17.4R3-S4; 18.1 versions prior to 18.1R3-S12; 18.2 versions prior to 18.2R2-S8, 18.2R3-S7; 18.3 versions prior to 18.3R3-S4; 18.4 versions prior to 18.4R1-S8, 18.4R2-S7, 18.4R3-S6; 19.1 versions prior to 19.1R1-S6, 19.1R2-S2, 19.1R3-S4; 19.2 versions prior to 19.2R1-S5, 19.2R3-S1; 19.3 versions prior to 19.3R2-S5, 19.3R3-S1; 19.4 versions prior to 19.4R2-S2, 19.4R3; 20.1 versions prior to 20.1R2; 20.2 versions prior to 20.2R1-S2, 20.2R2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://kb.juniper.net/JSA11117; https://kb.juniper.net/JSA11117
CVE: CVE-2021-0216
Published: 2021-04-22
Description: A vulnerability in Juniper Networks Junos OS running on the ACX5448 and ACX710 platforms may cause BFD sessions to flap when a high rate of transit ARP packets are received. This, in turn, may impact routing protocols and network stability, leading to a Denial of Service (DoS) condition. When a high rate of transit ARP packets are exceptioned to the CPU and BFD flaps, the following log messages may be seen: bfdd[15864]: BFDD_STATE_UP_TO_DOWN: BFD Session 192.168.14.3 (IFL 232) state Up -> Down LD/RD(17/19) Up time:11:38:17 Local diag: CtlExpire Remote diag: None Reason: Detect Timer Expiry. bfdd[15864]: BFDD_TRAP_SHOP_STATE_DOWN: local discriminator: 17, new state: down, interface: irb.998, peer addr: 192.168.14.3 rpd[15839]: RPD_ISIS_ADJDOWN: IS-IS lost L2 adjacency to peer on irb.998, reason: BFD Session Down bfdd[15864]: BFDD_TRAP_SHOP_STATE_UP: local discriminator: 17, new state: up, interface: irb.998, peer addr: 192.168.14.3 This issue only affects the ACX5448 Series and ACX710 Series routers. No other products or platforms are affected by this vulnerability. This issue affects Juniper Networks Junos OS: 18.2 versions prior to 18.2R3-S8 on ACX5448; 18.3 versions prior to 18.3R3-S5 on ACX5448; 18.4 versions prior to 18.4R1-S6, 18.4R3-S7 on ACX5448; 19.1 versions prior to 19.1R3-S5 on ACX5448; 19.2 versions prior to 19.2R2, 19.2R3 on ACX5448; 19.3 versions prior to 19.3R3 on ACX5448; 19.4 versions prior to 19.4R3 on ACX5448; 20.1 versions prior to 20.1R2 on ACX5448; 20.2 versions prior to 20.2R2 on ACX5448 and ACX710.
CVSS Score: 6.5 (MEDIUM)
References: https://kb.juniper.net/JSA11118; https://kb.juniper.net/JSA11118
CVE: CVE-2021-0224
Published: 2021-04-22
Description: A vulnerability in the handling of internal resources necessary to bring up a large number of Layer 2 broadband remote access subscriber (BRAS) nodes in Juniper Networks Junos OS can cause the Access Node Control Protocol daemon (ANCPD) to crash and restart, leading to a Denial of Service (DoS) condition. Continued processing of spoofed subscriber nodes will create a sustained Denial of Service (DoS) condition. When the number of subscribers attempting to connect exceeds the configured maximum-discovery-table-entries value, the subscriber fails to map to an internal neighbor entry, causing the ANCPD process to crash. This issue affects Juniper Networks Junos OS: All versions prior to 17.3R3-S12; 17.4 versions prior to 17.4R2-S13; 18.1 versions prior to 18.1R3-S13; 18.2 versions prior to 18.2R3-S8; 18.3 versions prior to 18.3R3-S5; 18.4 versions prior to 18.4R1-S8, 18.4R3-S8; 19.1 versions prior to 19.1R3-S4; 19.2 versions prior to 19.2R3-S2; 19.3 versions prior to 19.3R3-S1; 19.4 versions prior to 19.4R3-S1; 20.1 versions prior to 20.1R2; 20.2 versions prior to 20.2R2; 20.3 versions prior to 20.3R2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770, CWE-770
References: https://kb.juniper.net/JSA11119; https://kb.juniper.net/JSA11119
CVE: CVE-2021-0225
Published: 2021-04-22
Description: An Improper Check for Unusual or Exceptional Conditions in Juniper Networks Junos OS Evolved may cause the stateless firewall filter configuration which uses the action 'policer' in certain combinations with other options to not take effect. An administrator can use the following CLI command to see the failures with filter configuration: user@device> show log kfirewall-agent.log | match ERROR Jul 23 14:16:03 ERROR: filter not supported This issue affects Juniper Networks Junos OS Evolved: Versions 19.1R1-EVO and above prior to 20.3R1-S2-EVO, 20.3R2-EVO. This issue does not affect Juniper Networks Junos OS.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-754, CWE-754
References: https://kb.juniper.net/JSA11120; https://kb.juniper.net/JSA11120
CVE: CVE-2021-0226
Published: 2021-04-22
Description: On Juniper Networks Junos OS Evolved devices, receipt of a specific IPv6 packet may cause an established IPv6 BGP session to terminate, creating a Denial of Service (DoS) condition. Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition. This issue does not affect IPv4 BGP sessions. This issue affects IBGP or EBGP peer sessions with IPv6. This issue affects: Juniper Networks Junos OS Evolved: 19.4 versions prior to 19.4R2-S3-EVO; 20.1 versions prior to 20.1R2-S3-EVO; 20.2 versions prior to 20.2R2-S1-EVO; 20.3 versions prior to 20.3R2-EVO. This issue does not affect Juniper Networks Junos OS releases.
CVSS Score: 7.1 (HIGH)
CWE: CWE-665, CWE-665
References: https://kb.juniper.net/JSA11121; https://kb.juniper.net/JSA11121
CVE: CVE-2021-0227
Published: 2021-04-22
Description: An improper restriction of operations within the bounds of a memory buffer vulnerability in Juniper Networks Junos OS J-Web on SRX Series devices allows an attacker to cause Denial of Service (DoS) by sending certain crafted HTTP packets. Continued receipt and processing of these packets will create a sustained Denial of Service (DoS) condition. When this issue occurs, web-management, NTP daemon (ntpd) and Layer 2 Control Protocol process (L2CPD) daemons might crash. This issue affects Juniper Networks Junos OS on SRX Series: 17.3 versions prior to 17.3R3-S9; 17.4 versions prior to 17.4R2-S11, 17.4R3-S2; 18.2 versions prior to 18.2R3-S5; 18.3 versions prior to 18.3R2-S4, 18.3R3-S3; 18.4 versions prior to 18.4R2-S5, 18.4R3-S4; 19.1 versions prior to 19.1R3-S2; 19.2 versions prior to 19.2R1-S5, 19.2R3; 19.3 versions prior to 19.3R3; 19.4 versions prior to 19.4R2-S1, 19.4R3; 20.1 versions prior to 20.1R1-S2, 20.1R2;
CVSS Score: 7.5 (HIGH)
CWE: CWE-119, CWE-119
References: https://kb.juniper.net/JSA11122; https://kb.juniper.net/JSA11122
CVE: CVE-2021-0228
Published: 2021-04-22
Description: An improper check for unusual or exceptional conditions vulnerability in Juniper Networks MX Series platforms with Trio-based MPC (Modular Port Concentrator) deployed in (Ethernet VPN) EVPN-(Virtual Extensible LAN) VXLAN configuration, may allow an attacker sending specific Layer 2 traffic to cause Distributed Denial of Service (DDoS) protection to trigger unexpectedly, resulting in traffic impact. Continued receipt and processing of this specific Layer 2 frames will sustain the Denial of Service (DoS) condition. An indication of compromise is to check DDOS LACP violations: user@device> show ddos-protection protocols statistics brief | match lacp This issue only affects the MX Series platforms with Trio-based MPC. No other products or platforms are affected. This issue affects: Juniper Networks Junos OS on MX Series: 15.1 versions prior to 15.1R7-S9; 17.3 versions prior to 17.3R3-S11; 17.4 versions prior to 17.4R3-S4; 18.1 versions prior to 18.1R3-S12; 18.2 versions prior to 18.2R2-S8, 18.2R3-S8; 18.3 versions prior to 18.3R3-S4; 18.4 versions prior to 18.4R1-S8, 18.4R2-S7, 18.4R3-S7; 19.1 versions prior to 19.1R3-S4; 19.2 versions prior to 19.2R1-S6; 19.3 versions prior to 19.3R3-S2; 19.4 versions prior to 19.4R2-S4, 19.4R3-S2; 20.1 versions prior to 20.1R2, 20.1R3; 20.2 versions prior to 20.2R2-S1, 20.2R3; 20.3 versions prior to 20.3R1-S1, 20.3R2;
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-754, CWE-754
References: https://kb.juniper.net/JSA11123; https://kb.juniper.net/JSA11123
CVE: CVE-2021-0229
Published: 2021-04-22
Description: An uncontrolled resource consumption vulnerability in Message Queue Telemetry Transport (MQTT) server of Juniper Networks Junos OS allows an attacker to cause MQTT server to crash and restart leading to a Denial of Service (DoS) by sending a stream of specific packets. A Juniper Extension Toolkit (JET) application designed with a listening port uses the Message Queue Telemetry Transport (MQTT) protocol to connect to a mosquitto broker that is running on Junos OS to subscribe for events. Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition. This issue affects Juniper Networks Junos OS: 16.1R1 and later versions prior to 17.3R3-S11; 17.4 versions prior to 17.4R2-S13, 17.4R3-S4; 18.1 versions prior to 18.1R3-S12; 18.2 versions prior to 18.2R2-S8, 18.2R3-S7; 18.3 versions prior to 18.3R3-S4; 18.4 versions prior to 18.4R1-S8, 18.4R2-S7, 18.4R3-S7; 19.1 versions prior to 19.1R3-S5; 19.2 versions prior to 19.2R1-S6, 19.2R3-S2; 19.3 versions prior to 19.3R3-S2; 19.4 versions prior to 19.4R2-S4, 19.4R3-S2; 20.1 versions prior to 20.1R2-S1, 20.1R3; 20.2 versions prior to 20.2R2-S2, 20.2R3; 20.3 versions prior to 20.3R1-S1, 20.3R2. This issue does not affect Juniper Networks Junos OS versions prior to 16.1R1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://kb.juniper.net/JSA11124; https://kb.juniper.net/JSA11124