rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-52913 
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP2 (9.8.2.12) could allow an unauthenticated attacker to conduct a path traversal attack due to insufficient input validation. A successful exploit could allow unauthorized access, enabling the attacker to view, corrupt, or delete users' data and system configurations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-08T00:00:00.000Z
CVE-2025-52914 
A vulnerability in the Suite Applications Services component of Mitel MiCollab 10.0 through SP1 FP1 (10.0.1.101) could allow an authenticated attacker to conduct a SQL Injection attack due to insufficient validation of user input. A successful exploit could allow an attacker to execute arbitrary SQL database commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-08T00:00:00.000Z
CVE-2025-52915 
K7RKScan.sys 23.0.0.10, part of the K7 Security Anti-Malware suite, allows an admin-privileged user to send crafted IOCTL requests to terminate processes that are protected through a third-party implementation. This is caused by insufficient caller validation in the driver's IOCTL handler, enabling unauthorized processes to perform those actions in kernel space. Successful exploitation can lead to denial of service by disrupting critical third-party services or applications.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-09-09T00:00:00.000Z
CVE-2025-52916 
Yealink RPS before 2025-06-04 lacks SN verification attempt limits, enabling brute-force enumeration (last five digits).
Problem types: cwe_id: CWE-307
description: CWE-307 Improper Restriction of Excessive Authentication Attempts
Affected products: vendor: Yealink
product: RPS
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 2.2
baseSeverity: LOW
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N
Published: 2025-06-21T00:00:00.000Z
CVE-2025-52917 
The Yealink RPS API before 2025-05-26 lacks rate limiting, potentially enabling information disclosure via excessive requests.
Problem types: cwe_id: CWE-770
description: CWE-770 Allocation of Resources Without Limits or Throttling
Affected products: vendor: Yealink
product: RPS
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 4.3
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Published: 2025-06-21T00:00:00.000Z
CVE-2025-52918 
Yealink RPS before 2025-05-26 does not prevent OpenAPI access by frozen enterprise accounts, allowing unauthorized access to deactivated interfaces.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: Yealink
product: RPS
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 5
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Published: 2025-06-21T00:00:00.000Z
CVE-2025-52919 
In Yealink RPS before 2025-05-26, the certificate upload function does not properly validate certificate content, potentially allowing invalid certificates to be uploaded.
Problem types: cwe_id: CWE-295
description: CWE-295 Improper Certificate Validation
Affected products: vendor: Yealink
product: RPS
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 4.3
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Published: 2025-06-21T00:00:00.000Z
CVE-2025-52920 
Innoshop through 0.4.1 allows Insecure Direct Object Reference (IDOR) at multiple places within the frontend shop. Anyone can create a customer account and easily exploit these. Successful exploitation results in disclosure of the PII of other customers and the deletion of their reviews of products on the website. To be specific, an attacker could view the order details of any order by browsing to /en/account/orders/_ORDER_ID_ or use the address and billing information of other customers by manipulating the shipping_address_id and billing_address_id parameters when making an order (this information is then reflected in the receipt). Additionally, an attacker could delete the reviews of other users by sending a DELETE request to /en/account/reviews/_REVIEW_ID.
Problem types: cwe_id: CWE-425
description: CWE-425 Direct Request ('Forced Browsing')
Affected products: vendor: InnoShop
product: InnoShop
default_status: unknown
CVSS v3.1: version: 3.1
baseScore: 6.4
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Published: 2025-06-23T00:00:00.000Z
CVE-2025-52921 
In Innoshop through 0.4.1, an authenticated attacker could exploit the File Manager functions in the admin panel to achieve code execution on the server, by uploading a crafted file and then renaming it to have a .php extension by using the Rename Function. This bypasses the initial check that uploaded files are image files. The application relies on frontend checks to restrict the administrator from changing the extension of uploaded files to .php. This restriction is easily bypassed with any proxy tool (e.g., BurpSuite). Once the attacker renames the file, and gives it the .php extension, a GET request can be used to trigger the execution of code on the server.
Problem types: cwe_id: CWE-420
description: CWE-420 Unprotected Alternate Channel
Affected products: vendor: InnoShop
product: InnoShop
default_status: unknown
CVSS v3.1: version: 3.1
baseScore: 9.9
baseSeverity: CRITICAL
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
Published: 2025-06-23T00:00:00.000Z
CVE-2025-52922 
Innoshop through 0.4.1 allows directory traversal via FileManager API endpoints. An authenticated attacker with access to the admin panel could abuse this to: (1) fully map the filesystem structure via the /api/file_manager/files?base_folder= endpoint, (2) create arbitrary directories on the server via the /api/file_manager/directories endpoint, (3) read arbitrary files from the server by copying the file to a readable location within the application via the /api/file_manager/copy_files endpoint, {4) delete arbitrary files from the server via a DELETE request to /api/file_manager/files, or (5) create arbitrary files on the server by uploading them and then leveraging the /api/file_manager/move_files endpoint to move them anywhere in the filesystem.
Problem types: cwe_id: CWE-23
description: CWE-23 Relative Path Traversal
Affected products: vendor: InnoShop
product: InnoShop
default_status: unknown
CVSS v3.1: version: 3.1
baseScore: 7.4
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Published: 2025-06-23T00:00:00.000Z
CVE-2025-52923 
Sangfor aTrust through 2.4.10 allows users to modify the ExecStartPre command.
Problem types: cwe_id: CWE-732
description: CWE-732 Incorrect Permission Assignment for Critical Resource
Affected products: vendor: Sangfor
product: aTrust
default_status: unknown
CVSS v3.1: version: 3.1
baseScore: 4.3
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Published: 2025-06-22T00:00:00.000Z
CVE-2025-52924 
In One Identity OneLogin before 2025.2.0, the SQL connection "application name" is set based on the value of an untrusted X-RequestId HTTP request header.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: One Identity
product: OneLogin
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 4
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
Published: 2025-07-19T00:00:00.000Z
CVE-2025-52925 
In One Identity OneLogin Active Directory Connector before 6.1.5, encryption of the DirectoryToken was mishandled, aka ST-812.
Problem types: cwe_id: CWE-402
description: CWE-402 Transmission of Private Resources into a New Sphere ('Resource Leak')
Affected products: vendor: OneLogin
product: Active Directory Connector
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 5
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Published: 2025-07-02T00:00:00.000Z
CVE-2025-52926 
In scan.rs in spytrap-adb before 0.3.5, matches for known stalkerware are not rendered in the interactive user interface.
Problem types: cwe_id: CWE-223
description: CWE-223 Omission of Security-relevant Information
Affected products: vendor: spytrap-org
product: spytrap-adb
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 2.7
baseSeverity: LOW
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N
Published: 2025-06-23T00:00:00.000Z
CVE-2025-52930 
A memory corruption vulnerability exists in the BMPv3 RLE Decoding functionality of the SAIL Image Decoding Library v0.9.8. When decompressing the image data from a specially crafted .bmp file, a heap-based buffer overflow can occur which allows for remote code execution. An attacker will need to convince the library to read a file to trigger this vulnerability.
Problem types: cwe_id: CWE-680
description: CWE-680: Integer Overflow to Buffer Overflow
Affected products: vendor: SAIL Image Decoding Library
product: SAIL Image Decoding Library
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
Credits: lang: en
value: Discovered by a member of Cisco Talos.
Published: 2025-08-25T14:17:36.760Z
CVE-2025-52931 Unexpected input to Update Channel Subscription endpoint causes DoS in Mattermost Confluence Plugin
Mattermost Confluence Plugin version <1.5.0 fails to handle unexpected request body which allows attackers to crash the plugin via constant hit to update channel subscription endpoint with an invalid request body.
Problem types: cwe_id: CWE-754
description: CWE-754: Improper Check for Unusual or Exceptional Conditions
Affected products: vendor: Mattermost
product: Mattermost Confluence Plugin
default_status: unaffected
CVSS v3.1: attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
baseSeverity: HIGH
baseScore: 7.5
Credits: lang: en
value: Lorenzo Gallegos
Published: 2025-08-11T18:57:00.672Z
CVE-2025-52935 Integer Overflow or Wraparound vulnerability in dragonflydb/dragonfly
Integer Overflow or Wraparound vulnerability in dragonflydb dragonfly (src/redis/lua/struct modules). This vulnerability is associated with program files lua_struct.C.

This issue affects dragonfly: 1.30.1, 1.30.0, 1.28.18.
Problem types: cwe_id: CWE-190
description: CWE-190 Integer Overflow or Wraparound
Affected products: vendor: dragonflydb
product: dragonfly
default_status: unaffected
Credits: lang: en
value: TITAN Team (titancaproject@gmail.com)
Published: 2025-06-23T09:27:18.355Z
CVE-2025-52936 Improper Link Resolution Before File Access vulnerability in yrutschle/sslh
Improper Link Resolution Before File Access ('Link Following') vulnerability in yrutschle sslh.This issue affects sslh: before 2.2.2.
Problem types: cwe_id: CWE-59
description: CWE-59 Improper Link Resolution Before File Access ('Link Following')
Affected products: vendor: yrutschle
product: sslh
default_status: unaffected
Credits: lang: en
value: TITAN Team (titancaproject@gmail.com)
Published: 2025-06-23T09:25:41.764Z
CVE-2025-52937 Vulnerability in PointCloudLibrary PCL
Vulnerability in PointCloudLibrary PCL (surface/src/3rdparty/opennurbs modules). This vulnerability is associated with program files crc32.C.

This vulnerability is only relevant if the PCL version is older than 1.14.0 or the user specifically requests to not use the system zlib (WITH_SYSTEM_ZLIB=FALSE).
Affected products: vendor: PointCloudLibrary
product: pcl
default_status: unaffected
Credits: lang: en
value: TITAN Team (titancaproject@gmail.com)
Published: 2025-06-23T09:26:12.727Z
CVE-2025-52938 Potential heap-based buffer over-read vulnerability in NotepadNext
Out-of-bounds Read vulnerability in dail8859 NotepadNext (src/lua/src modules). This vulnerability is associated with program files lparser.C.


This issue affects NotepadNext: through v0.11.

The singlevar() in lparser.c lacks a certain luaK_exp2anyregup call, leading to a heap-based buffer over-read that might affect a system that compiles untrusted Lua code.
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
Affected products: vendor: dail8859
product: NotepadNext
default_status: unaffected
Credits: lang: en
value: TITAN Team (titancaproject@gmail.com)
Published: 2025-06-23T09:26:39.214Z
CVE-2025-52939 Potential heap-buffer overflow vulnerability in NotepadNext
Out-of-bounds Write vulnerability in dail8859 NotepadNext (src/lua/src modules). This vulnerability is associated with program files ldebug.C, lvm.C.

This issue affects NotepadNext: through v0.11.
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
Affected products: vendor: dail8859
product: NotepadNext
default_status: unaffected
Credits: lang: en
value: TITAN Team (titancaproject@gmail.com)
Published: 2025-06-23T09:26:56.917Z
CVE-2025-52946 Junos OS and Junos OS Evolved: With traceoptions enabled, receipt of malformed AS PATH causes RPD crash
A Use After Free vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Juniper Networks Junos OS Evolved allows an attacker sending a BGP update with a specifically malformed AS PATH to cause rpd to crash, resulting in a Denial of Service (DoS). Continuous receipt of the malformed AS PATH attribute will cause a sustained DoS condition.

On all Junos OS and Junos OS Evolved platforms, the rpd process will crash and restart when a specifically malformed AS PATH is received within a BGP update and traceoptions are enabled.

This issue only affects systems with BGP traceoptions enabled and requires a BGP session to be already established.  Systems without BGP traceoptions enabled are not impacted by this issue.



This issue affects:

 Junos OS:



  *  All versions before 21.2R3-S9, 
  *  all versions of 21.4,
  *  from 22.2 before 22.2R3-S6, 
  *  from 22.4 before 22.4R3-S5, 
  *  from 23.2 before 23.2R2-S3, 
  *  from 23.4 before 23.4R2-S4, 
  *  from 24.2 before 24.2R2; 




Junos OS Evolved: 



  *  All versions before 22.4R3-S5-EVO, 
  *  from 23.2-EVO before 23.2R2-S3-EVO, 
  *  from 23.4-EVO before 23.4R2-S4-EVO, 
  *  from 24.2-EVO before 24.2R2-EVO.







This is a more complete fix for previously published CVE-2024-39549 (JSA83011).
Problem types: cwe_id: CWE-416
description: CWE-416 Use After Free
Affected products: vendor: Juniper Networks
product: Junos OS
default_status: unaffected
vendor: Juniper Networks
product: Junos OS Evolved
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2025-07-11T14:39:59.014Z
CVE-2025-52947 Junos OS: ACX Series: When 'hot-standby' mode is configured for an L2 circuit, interface flap causes the FEB to crash
An Improper Handling of Exceptional Conditions vulnerability in route processing of Juniper Networks Junos OS on specific end-of-life (EOL) ACX Series platforms allows an attacker to crash the Forwarding Engine Board (FEB) by flapping an interface, leading to a Denial of Service (DoS).

On ACX1000, ACX1100, ACX2000, ACX2100, ACX2200, ACX4000, ACX5048, and ACX5096 devices, FEB0 will crash when the primary path port of the L2 circuit IGP (Interior Gateway Protocol) on the local device goes down. This issue is seen only when 'hot-standby' mode is configured for the L2 circuit.

This issue affects Junos OS on ACX1000, ACX1100, ACX2000, ACX2100, ACX2200, ACX4000, ACX5048, and ACX5096: 



  *  all versions before 21.2R3-S9.
Problem types: cwe_id: CWE-755
description: CWE-755 Improper Handling of Exceptional Conditions
Affected products: vendor: Juniper Networks
product: Junos OS
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2025-07-11T14:40:14.792Z
CVE-2025-52948 Junos OS: Specific unknown traffic pattern causes FPC and system to crash when packet capturing is enabled
An Improper Handling of Exceptional Conditions vulnerability in Berkeley Packet Filter (BPF) processing of Juniper Networks Junos OS allows an attacker, in rare cases, sending specific, unknown traffic patterns to cause the FPC and system to crash and restart.

BPF provides a raw interface to data link layers in a protocol independent fashion. Internally within the Junos kernel, due to a rare timing issue (race condition), when a BPF instance is cloned, the newly created interface causes an internal structure leakage, leading to a system crash. The precise content and timing of the traffic patterns is indeterminate, but has been seen in a lab environment multiple times.

This issue is more likely to occur when packet capturing is enabled.  See required configuration below.

This issue affects Junos OS: 



  *  all versions before 21.2R3-S9, 
  *  from 21.4 before 21.4R3-S10, 
  *  from 22.2 before 22.2R3-S6, 
  *  from 22.4 before 22.4R3-S7, 
  *  from 23.2 before 23.2R2-S3, 
  *  from 23.4 before 23.4R2-S3, 
  *  from 24.2 before 24.2R1-S1, 24.2R2.
Problem types: cwe_id: CWE-755
description: CWE-755 Improper Handling of Exceptional Conditions
Affected products: vendor: Juniper Networks
product: Junos OS
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2025-07-11T14:40:31.197Z
CVE-2025-52949 Junos OS and Junos OS Evolved: In an EVPN environment, receipt of specifically malformed BGP update causes RPD crash
An Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a logically adjacent BGP peer sending a specifically malformed BGP packet to cause rpd to crash and restart, resulting in a Denial of Service (DoS). Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition.

Only systems configured for Ethernet Virtual Private Networking (EVPN) signaling are vulnerable to this issue. 

This issue affects iBGP and eBGP, and both IPv4 and IPv6 are affected by this vulnerability.This issue affects:

Junos OS: 



  *  all versions before 21.4R3-S11, 
  *  from 22.2 before 22.2R3-S7, 
  *  from 22.4 before 22.4R3-S7, 
  *  from 23.2 before 23.2R2-S4, 
  *  from 23.4 before 23.4R2-S5, 
  *  from 24.2 before 24.2R2-S1, 
  *  from 24.4 before 24.4R1-S3, 24.4R2; 




Junos OS Evolved: 



  *  all versions before 22.2R3-S7-EVO, 
  *  from 22.4-EVO before 22.4R3-S7-EVO, 
  *  from 23.2-EVO before 23.2R2-S4-EVO, 
  *  from 23.4-EVO before 23.4R2-S5-EVO, 
  *  from 24.2-EVO before 24.2R2-S1-EVO, 
  *  from 24.4-EVO before 24.4R1-S3-EVO, 24.4R2-EVO.
Problem types: cwe_id: CWE-130
description: CWE-130 Improper Handling of Length Parameter Inconsistency
Affected products: vendor: Juniper Networks
product: Junos OS
default_status: unaffected
vendor: Juniper Networks
product: Junos OS Evolved
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Juniper SIRT would like to acknowledge and thank Craig Dods from Meta’s Infrastructure Security Engineering team for responsibly reporting this vulnerability.
Published: 2025-07-11T14:40:41.658Z
CVE-2025-52950 Juniper Security Director: Insufficient authorization for multiple endpoints in web interface
A Missing Authorization vulnerability in Juniper Networks Security Director allows an unauthenticated network-based attacker to read or tamper with multiple sensitive resources via the web interface.

Numerous endpoints on the Juniper Security Director appliance do not validate authorization and will deliver information to the caller that is outside their authorization level. An attacker can access data that is outside the user's authorization level. The information obtained can be used to gain access to additional information or perpetrate other attacks, impacting downstream managed devices.



This issue affects Security Director version 24.4.1.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Juniper Networks
product: Juniper Security Director
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.6
baseSeverity: CRITICAL
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H
version: 3.1
Published: 2025-07-11T14:40:49.980Z
CVE-2025-52951 Junos OS: IPv6 firewall filter fails to match payload-protocol
A Protection Mechanism Failure vulnerability in kernel filter processing of Juniper Networks Junos OS allows an attacker sending IPv6 traffic destined to the device to effectively bypass any firewall filtering configured on the interface.

Due to an issue with Junos OS kernel filter processing, the 'payload-protocol' match is not being supported, causing any term containing it to accept all packets without taking any other action. In essence, these firewall filter terms were being processed as an 'accept' for all traffic on the interface destined for the control plane, even when used in combination with other match criteria.

This issue only affects firewall filters protecting the device's control plane. Transit firewall filtering is unaffected by this vulnerability.

This issue affects Junos OS: 



  *  all versions before 21.2R3-S9, 
  *  from 21.4 before 21.4R3-S11, 
  *  from 22.2 before 22.2R3-S7, 
  *  from 22.4 before 22.4R3-S7, 
  *  from 23.2 before 23.2R2-S4, 
  *  from 23.4 before 23.4R2-S5, 
  *  from 24.2 before 24.2R2-S1, 
  *  from 24.4 before 24.4R1-S2, 24.4R2.



This is a more complete fix for previously published CVE-2024-21607 (JSA75748).
Problem types: cwe_id: CWE-693
description: CWE-693: Protection Mechanism Failure
Affected products: vendor: Juniper Networks
product: Junos OS
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.8
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
version: 3.1
Published: 2025-07-11T14:41:03.752Z