https://db.gcve.eu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Wed, 27 May 2026 10:26:03 +0000 https://db.gcve.eu/sighting/d4db3f74-47ae-4e7b-992a-8b20b4b61387/export {"uuid": "d4db3f74-47ae-4e7b-992a-8b20b4b61387", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2023-36830", "type": "seen", "source": "https://t.me/cibsecurity/66142", "content": "\u203c CVE-2023-36830 \u203c\n\nSQLFluff is a SQL linter. Prior to version 2.1.2, in environments where untrusted users have access to the config files, there is a potential security vulnerability where those users could use the `library_path` config value to allow arbitrary python code to be executed via macros. For many users who use SQLFluff in the context of an environment where all users already have fairly escalated privileges, this may not be an issue - however in larger user bases, or where SQLFluff is bundled into another tool where developers still wish to give users access to supply their on rule configuration, this may be an issue.The 2.1.2 release offers the ability for the `library_path` argument to be overwritten on the command line by using the `--library-path` option. This overrides any values provided in the config files and effectively prevents this route of attack for users which have access to the config file, but not to the scripts which call the SQLFluff CLI directly. A similar option is provided for the Python API, where users also have a greater ability to further customise or override configuration as necessary. Unless `library_path` is explicitly required, SQLFluff maintainers recommend using the option `--library-path none` when invoking SQLFluff which will disable the `library-path` option entirely regardless of the options set in the configuration file or via inline config directives. As a workaround, limiting access to - or otherwise validating configuration files before they are ingested by SQLFluff will provides a similar effect and does not require upgrade.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-07-06T20:20:31.000000Z"} {"uuid": "d4db3f74-47ae-4e7b-992a-8b20b4b61387", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2023-36830", "type": "seen", "source": "https://t.me/cibsecurity/66142", "content": "\u203c CVE-2023-36830 \u203c\n\nSQLFluff is a SQL linter. Prior to version 2.1.2, in environments where untrusted users have access to the config files, there is a potential security vulnerability where those users could use the `library_path` config value to allow arbitrary python code to be executed via macros. For many users who use SQLFluff in the context of an environment where all users already have fairly escalated privileges, this may not be an issue - however in larger user bases, or where SQLFluff is bundled into another tool where developers still wish to give users access to supply their on rule configuration, this may be an issue.The 2.1.2 release offers the ability for the `library_path` argument to be overwritten on the command line by using the `--library-path` option. This overrides any values provided in the config files and effectively prevents this route of attack for users which have access to the config file, but not to the scripts which call the SQLFluff CLI directly. A similar option is provided for the Python API, where users also have a greater ability to further customise or override configuration as necessary. Unless `library_path` is explicitly required, SQLFluff maintainers recommend using the option `--library-path none` when invoking SQLFluff which will disable the `library-path` option entirely regardless of the options set in the configuration file or via inline config directives. As a workaround, limiting access to - or otherwise validating configuration files before they are ingested by SQLFluff will provides a similar effect and does not require upgrade.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-07-06T20:20:31.000000Z"} https://db.gcve.eu/sighting/d4db3f74-47ae-4e7b-992a-8b20b4b61387/export Thu, 06 Jul 2023 20:20:31 +0000 https://db.gcve.eu/sighting/970e26a0-85ba-43dc-bb45-987a2c6b44af/export {"uuid": "970e26a0-85ba-43dc-bb45-987a2c6b44af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2023-36831", "type": "seen", "source": "https://t.me/cibsecurity/66732", "content": "\u203c CVE-2023-36831 \u203c\n\nAn Improper Check or Handling of Exceptional Conditions vulnerability in the UTM (Unified Threat Management) Web-Filtering feature of Juniper Networks Junos OS on SRX Series causes a jbuf memory leak to occur when accessing certain websites, eventually leading to a Denial of Service (DoS) condition. Service restoration is only possible by rebooting the system.The jbuf memory leak only occurs in SSL Proxy and UTM Web-Filtering configurations. Other products, platforms, and configurations are not affected by this vulnerability.This issue affects Juniper Networks Junos OS on SRX Series:22.2 versions prior to 22.2R3;22.3 versions prior to 22.3R2-S1, 22.3R3;22.4 versions prior to 22.4R1-S2, 22.4R2.This issue does not affect Juniper Networks Junos OS versions prior to 22.2R2.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-07-14T18:22:21.000000Z"} {"uuid": "970e26a0-85ba-43dc-bb45-987a2c6b44af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2023-36831", "type": "seen", "source": "https://t.me/cibsecurity/66732", "content": "\u203c CVE-2023-36831 \u203c\n\nAn Improper Check or Handling of Exceptional Conditions vulnerability in the UTM (Unified Threat Management) Web-Filtering feature of Juniper Networks Junos OS on SRX Series causes a jbuf memory leak to occur when accessing certain websites, eventually leading to a Denial of Service (DoS) condition. Service restoration is only possible by rebooting the system.The jbuf memory leak only occurs in SSL Proxy and UTM Web-Filtering configurations. Other products, platforms, and configurations are not affected by this vulnerability.This issue affects Juniper Networks Junos OS on SRX Series:22.2 versions prior to 22.2R3;22.3 versions prior to 22.3R2-S1, 22.3R3;22.4 versions prior to 22.4R1-S2, 22.4R2.This issue does not affect Juniper Networks Junos OS versions prior to 22.2R2.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-07-14T18:22:21.000000Z"} https://db.gcve.eu/sighting/970e26a0-85ba-43dc-bb45-987a2c6b44af/export Fri, 14 Jul 2023 18:22:21 +0000 https://db.gcve.eu/sighting/02ac08b7-9379-4408-b4cb-3feca18131c3/export {"uuid": "02ac08b7-9379-4408-b4cb-3feca18131c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2023-36838", "type": "seen", "source": "https://t.me/cibsecurity/66737", "content": "\u203c CVE-2023-36838 \u203c\n\nAn Out-of-bounds Read vulnerability in the flow processing daemon (flowd) of Juniper Networks Junos OS on SRX Series allows a local, authenticated attacker with low privileges, to cause a Denial of Service (DoS).If a low privileged user executes a specific CLI command, flowd which is responsible for traffic forwarding in SRX crashes and generates a core dump. This will cause temporary traffic interruption until the flowd process is restarted automatically. Continued execution of this command will lead to a sustained DoS.This issue affects Juniper Networks Junos OS on SRX Series:All versions prior to 20.2R3-S7;20.3 version 20.3R1 and later versions;20.4 versions prior to 20.4R3-S6;21.1 versions prior to 21.1R3-S5;21.2 versions prior to 21.2R3-S4;21.3 versions prior to 21.3R3-S4;21.4 versions prior to 21.4R3-S3;22.1 versions prior to 22.1R3-S1;22.2 versions prior to 22.2R3;22.3 versions prior to 22.3R2;22.4 versions prior to 22.4R1-S1, 22.4R2.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-07-14T20:22:24.000000Z"} {"uuid": "02ac08b7-9379-4408-b4cb-3feca18131c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2023-36838", "type": "seen", "source": "https://t.me/cibsecurity/66737", "content": "\u203c CVE-2023-36838 \u203c\n\nAn Out-of-bounds Read vulnerability in the flow processing daemon (flowd) of Juniper Networks Junos OS on SRX Series allows a local, authenticated attacker with low privileges, to cause a Denial of Service (DoS).If a low privileged user executes a specific CLI command, flowd which is responsible for traffic forwarding in SRX crashes and generates a core dump. This will cause temporary traffic interruption until the flowd process is restarted automatically. Continued execution of this command will lead to a sustained DoS.This issue affects Juniper Networks Junos OS on SRX Series:All versions prior to 20.2R3-S7;20.3 version 20.3R1 and later versions;20.4 versions prior to 20.4R3-S6;21.1 versions prior to 21.1R3-S5;21.2 versions prior to 21.2R3-S4;21.3 versions prior to 21.3R3-S4;21.4 versions prior to 21.4R3-S3;22.1 versions prior to 22.1R3-S1;22.2 versions prior to 22.2R3;22.3 versions prior to 22.3R2;22.4 versions prior to 22.4R1-S1, 22.4R2.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-07-14T20:22:24.000000Z"} https://db.gcve.eu/sighting/02ac08b7-9379-4408-b4cb-3feca18131c3/export Fri, 14 Jul 2023 20:22:24 +0000 https://db.gcve.eu/sighting/40634480-0952-46c3-9477-514608eb9166/export {"uuid": "40634480-0952-46c3-9477-514608eb9166", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2023-36832", "type": "seen", "source": "https://t.me/cibsecurity/66740", "content": "\u203c CVE-2023-36832 \u203c\n\nAn Improper Handling of Exceptional Conditions vulnerability in packet processing of Juniper Networks Junos OS on MX Series allows an unauthenticated network-based attacker to send specific packets to an Aggregated Multiservices (AMS) interface on the device, causing the packet forwarding engine (PFE) to crash, resulting in a Denial of Service (DoS). Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition.This issue is only triggered by packets destined to a local-interface via a service-interface (AMS). AMS is only supported on the MS-MPC, MS-MIC, and MX-SPC3 cards. This issue is not experienced on other types of interfaces or configurations. Additionally, transit traffic does not trigger this issue.This issue affects Juniper Networks Junos OS on MX Series:All versions prior to 19.1R3-S10;19.2 versions prior to 19.2R3-S7;19.3 versions prior to 19.3R3-S8;19.4 versions prior to 19.4R3-S12;20.2 versions prior to 20.2R3-S8;20.4 versions prior to 20.4R3-S7;21.1 versions prior to 21.1R3-S5;21.2 versions prior to 21.2R3-S5;21.3 versions prior to 21.3R3-S4;21.4 versions prior to 21.4R3-S3;22.1 versions prior to 22.1R3-S2;22.2 versions prior to 22.2R3;22.3 versions prior to 22.3R2-S1, 22.3R3;22.4 versions prior to 22.4R1-S2, 22.4R2.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-07-14T20:28:27.000000Z"} {"uuid": "40634480-0952-46c3-9477-514608eb9166", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2023-36832", "type": "seen", "source": "https://t.me/cibsecurity/66740", "content": "\u203c CVE-2023-36832 \u203c\n\nAn Improper Handling of Exceptional Conditions vulnerability in packet processing of Juniper Networks Junos OS on MX Series allows an unauthenticated network-based attacker to send specific packets to an Aggregated Multiservices (AMS) interface on the device, causing the packet forwarding engine (PFE) to crash, resulting in a Denial of Service (DoS). Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition.This issue is only triggered by packets destined to a local-interface via a service-interface (AMS). AMS is only supported on the MS-MPC, MS-MIC, and MX-SPC3 cards. This issue is not experienced on other types of interfaces or configurations. Additionally, transit traffic does not trigger this issue.This issue affects Juniper Networks Junos OS on MX Series:All versions prior to 19.1R3-S10;19.2 versions prior to 19.2R3-S7;19.3 versions prior to 19.3R3-S8;19.4 versions prior to 19.4R3-S12;20.2 versions prior to 20.2R3-S8;20.4 versions prior to 20.4R3-S7;21.1 versions prior to 21.1R3-S5;21.2 versions prior to 21.2R3-S5;21.3 versions prior to 21.3R3-S4;21.4 versions prior to 21.4R3-S3;22.1 versions prior to 22.1R3-S2;22.2 versions prior to 22.2R3;22.3 versions prior to 22.3R2-S1, 22.3R3;22.4 versions prior to 22.4R1-S2, 22.4R2.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-07-14T20:28:27.000000Z"} https://db.gcve.eu/sighting/40634480-0952-46c3-9477-514608eb9166/export Fri, 14 Jul 2023 20:28:27 +0000 https://db.gcve.eu/sighting/b3f29966-359b-418d-8875-caff3faa90d8/export {"uuid": "b3f29966-359b-418d-8875-caff3faa90d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2023-36833", "type": "seen", "source": "https://t.me/cibsecurity/66741", "content": "\u203c CVE-2023-36833 \u203c\n\nA Use After Free vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS Evolved on PTX10001-36MR, and PTX10004, PTX10008, PTX10016 with LC1201/1202 allows an adjacent, unauthenticated attacker to cause a Denial of Service (DoS).The process 'aftman-bt' will crash after multiple flaps on a multicast-only fast reroute (MoFRR) enabled interface. This will cause the respective FPC to stop forwarding traffic and it needs to be rebooted to restore the service.An indication that the system experienced this issue is the following log message:\u00c2\u00a0 evo-aftmand-bt[]: [Error] jexpr_fdb: sanity check failed, ... , app_name L3 Mcast RoutesThis issue affects Juniper Networks Junos OS Evolved on PTX10001-36MR, PTX10004, PTX10008, PTX10016 with LC1201/1202:21.2 version 21.2R1-EVO and later versions;21.3 version 21.3R1-EVO and later versions;21.4 versions prior to 21.4R3-S3-EVO;22.1 version 22.1R1-EVO and later versions;22.2 versions prior to 22.2R3-S2-EVO;22.3 versions prior to 22.3R3-EVO;22.4 versions prior to 22.4R1-S2-EVO, 22.4R2-EVO.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-07-14T20:28:28.000000Z"} {"uuid": "b3f29966-359b-418d-8875-caff3faa90d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2023-36833", "type": "seen", "source": "https://t.me/cibsecurity/66741", "content": "\u203c CVE-2023-36833 \u203c\n\nA Use After Free vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS Evolved on PTX10001-36MR, and PTX10004, PTX10008, PTX10016 with LC1201/1202 allows an adjacent, unauthenticated attacker to cause a Denial of Service (DoS).The process 'aftman-bt' will crash after multiple flaps on a multicast-only fast reroute (MoFRR) enabled interface. This will cause the respective FPC to stop forwarding traffic and it needs to be rebooted to restore the service.An indication that the system experienced this issue is the following log message:\u00c2\u00a0 evo-aftmand-bt[]: [Error] jexpr_fdb: sanity check failed, ... , app_name L3 Mcast RoutesThis issue affects Juniper Networks Junos OS Evolved on PTX10001-36MR, PTX10004, PTX10008, PTX10016 with LC1201/1202:21.2 version 21.2R1-EVO and later versions;21.3 version 21.3R1-EVO and later versions;21.4 versions prior to 21.4R3-S3-EVO;22.1 version 22.1R1-EVO and later versions;22.2 versions prior to 22.2R3-S2-EVO;22.3 versions prior to 22.3R3-EVO;22.4 versions prior to 22.4R1-S2-EVO, 22.4R2-EVO.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-07-14T20:28:28.000000Z"} https://db.gcve.eu/sighting/b3f29966-359b-418d-8875-caff3faa90d8/export Fri, 14 Jul 2023 20:28:28 +0000 https://db.gcve.eu/sighting/b9847530-502b-4155-a4e6-9324416eef23/export {"uuid": "b9847530-502b-4155-a4e6-9324416eef23", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2023-36834", "type": "seen", "source": "https://t.me/cibsecurity/66753", "content": "\u203c CVE-2023-36834 \u203c\n\nAn Incomplete Internal State Distinction vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS on SRX 4600 and SRX 5000 Series allows an adjacent attacker to cause a Denial of Service (DoS).If an SRX is configured in L2 transparent mode the receipt of a specific genuine packet can cause a single Packet Processing Engines (PPE) component of the PFE to run into a loop, which in turn will render the PPE unavailable. Each packet will cause one PPE to get into a loop, leading to a gradual performance degradation until all PPEs are unavailable and all traffic processing stops. To recover the affected FPC need to be restarted.This issue affects Juniper Networks Junos OS on SRX 4600 and SRX 5000 Series:20.1 version 20.1R1 and later versions;20.2 versions prior to 20.2R3-S7;20.3 version 20.3R1 and later versions;20.4 versions prior to 20.4R3-S7;21.1 versions prior to 21.1R3-S5;21.2 versions prior to 21.2R3-S3;21.3 versions prior to 21.3R3-S3;21.4 versions prior to 21.4R3-S1;22.1 versions prior to 22.1R3;22.2 versions prior to 22.2R2;22.3 versions prior to 22.3R1-S1, 22.3R2.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-07-14T22:22:43.000000Z"} {"uuid": "b9847530-502b-4155-a4e6-9324416eef23", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2023-36834", "type": "seen", "source": "https://t.me/cibsecurity/66753", "content": "\u203c CVE-2023-36834 \u203c\n\nAn Incomplete Internal State Distinction vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS on SRX 4600 and SRX 5000 Series allows an adjacent attacker to cause a Denial of Service (DoS).If an SRX is configured in L2 transparent mode the receipt of a specific genuine packet can cause a single Packet Processing Engines (PPE) component of the PFE to run into a loop, which in turn will render the PPE unavailable. Each packet will cause one PPE to get into a loop, leading to a gradual performance degradation until all PPEs are unavailable and all traffic processing stops. To recover the affected FPC need to be restarted.This issue affects Juniper Networks Junos OS on SRX 4600 and SRX 5000 Series:20.1 version 20.1R1 and later versions;20.2 versions prior to 20.2R3-S7;20.3 version 20.3R1 and later versions;20.4 versions prior to 20.4R3-S7;21.1 versions prior to 21.1R3-S5;21.2 versions prior to 21.2R3-S3;21.3 versions prior to 21.3R3-S3;21.4 versions prior to 21.4R3-S1;22.1 versions prior to 22.1R3;22.2 versions prior to 22.2R2;22.3 versions prior to 22.3R1-S1, 22.3R2.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-07-14T22:22:43.000000Z"} https://db.gcve.eu/sighting/b9847530-502b-4155-a4e6-9324416eef23/export Fri, 14 Jul 2023 22:22:43 +0000 https://db.gcve.eu/sighting/0c766d97-b991-4774-ab0d-b76ee4bd81b5/export {"uuid": "0c766d97-b991-4774-ab0d-b76ee4bd81b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2023-36835", "type": "seen", "source": "https://t.me/cibsecurity/66755", "content": "\u203c CVE-2023-36835 \u203c\n\nAn Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on QFX10000 Series allows a network based attacker to cause a Denial of Service (DoS).If a specific valid IP packet is received and that packet needs to be routed over a VXLAN tunnel, this will result in a PFE wedge condition due to which traffic gets impacted. As this is not a crash and restart scenario, this condition will persist until the system is rebooted to recover.This issue affects Juniper Networks Junos OS on QFX10000:20.3 version 20.3R1 and later versions;20.4 versions prior to 20.4R3-S5;21.1 versions prior to 21.1R3-S5;21.2 versions prior to 21.2R3-S5;21.3 versions prior to 21.3R3-S4;21.4 versions prior to 21.4R3-S1;22.1 versions prior to 22.1R3;22.2 versions prior to 22.2R2;22.3 versions prior to 22.3R1-S2, 22.3R2.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-07-14T22:22:45.000000Z"} {"uuid": "0c766d97-b991-4774-ab0d-b76ee4bd81b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2023-36835", "type": "seen", "source": "https://t.me/cibsecurity/66755", "content": "\u203c CVE-2023-36835 \u203c\n\nAn Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on QFX10000 Series allows a network based attacker to cause a Denial of Service (DoS).If a specific valid IP packet is received and that packet needs to be routed over a VXLAN tunnel, this will result in a PFE wedge condition due to which traffic gets impacted. As this is not a crash and restart scenario, this condition will persist until the system is rebooted to recover.This issue affects Juniper Networks Junos OS on QFX10000:20.3 version 20.3R1 and later versions;20.4 versions prior to 20.4R3-S5;21.1 versions prior to 21.1R3-S5;21.2 versions prior to 21.2R3-S5;21.3 versions prior to 21.3R3-S4;21.4 versions prior to 21.4R3-S1;22.1 versions prior to 22.1R3;22.2 versions prior to 22.2R2;22.3 versions prior to 22.3R1-S2, 22.3R2.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-07-14T22:22:45.000000Z"} https://db.gcve.eu/sighting/0c766d97-b991-4774-ab0d-b76ee4bd81b5/export Fri, 14 Jul 2023 22:22:45 +0000 https://db.gcve.eu/sighting/977b4122-2e8b-4b89-b424-e2f48a7ff369/export {"uuid": "977b4122-2e8b-4b89-b424-e2f48a7ff369", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2023-36836", "type": "seen", "source": "https://t.me/cibsecurity/66756", "content": "\u203c CVE-2023-36836 \u203c\n\nA Use of an Uninitialized Resource vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a local, authenticated attacker with low privileges to cause a Denial of Service (DoS).On all Junos OS and Junos OS Evolved platforms, in a Multicast only Fast Reroute (MoFRR) scenario, the rpd process can crash when a a specific low privileged CLI command is executed. The rpd crash will impact all routing protocols until the process has automatically been restarted. As the operational state which makes this issue exploitable is outside the attackers control, this issue is considered difficult to exploit. Continued execution of this command will lead to a sustained DoS.This issue affects:Juniper Networks Junos OS19.4 version 19.4R3-S5 and later versions prior to 19.4R3-S9;20.1 version 20.1R2 and later versions;20.2 versions prior to 20.2R3-S7;20.3 versions prior to 20.3R3-S5;20.4 versions prior to 20.4R3-S6;21.1 versions prior to 21.1R3-S4;21.2 versions prior to 21.2R3-S2;21.3 versions prior to 21.3R3-S1;21.4 versions prior to 21.4R3;22.1 versions prior to 22.1R1-S2, 22.1R2;22.2 versions prior to 22.2R2.Juniper Networks Junos OS EvolvedAll versions prior to 20.4R3-S6-EVO;21.1-EVO version 21.1R1-EVO and later versions;21.2-EVO version 21.2R1-EVO and later versions;21.3-EVO versions prior to 21.3R3-S1-EVO;21.4-EVO versions prior to 21.4R3-EVO;22.1-EVO versions prior to 22.1R1-S2-EVO, 22.1R2-EVO;22.2-EVO versions prior to 22.2R2-EVO.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-07-14T22:22:46.000000Z"} {"uuid": "977b4122-2e8b-4b89-b424-e2f48a7ff369", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2023-36836", "type": "seen", "source": "https://t.me/cibsecurity/66756", "content": "\u203c CVE-2023-36836 \u203c\n\nA Use of an Uninitialized Resource vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a local, authenticated attacker with low privileges to cause a Denial of Service (DoS).On all Junos OS and Junos OS Evolved platforms, in a Multicast only Fast Reroute (MoFRR) scenario, the rpd process can crash when a a specific low privileged CLI command is executed. The rpd crash will impact all routing protocols until the process has automatically been restarted. As the operational state which makes this issue exploitable is outside the attackers control, this issue is considered difficult to exploit. Continued execution of this command will lead to a sustained DoS.This issue affects:Juniper Networks Junos OS19.4 version 19.4R3-S5 and later versions prior to 19.4R3-S9;20.1 version 20.1R2 and later versions;20.2 versions prior to 20.2R3-S7;20.3 versions prior to 20.3R3-S5;20.4 versions prior to 20.4R3-S6;21.1 versions prior to 21.1R3-S4;21.2 versions prior to 21.2R3-S2;21.3 versions prior to 21.3R3-S1;21.4 versions prior to 21.4R3;22.1 versions prior to 22.1R1-S2, 22.1R2;22.2 versions prior to 22.2R2.Juniper Networks Junos OS EvolvedAll versions prior to 20.4R3-S6-EVO;21.1-EVO version 21.1R1-EVO and later versions;21.2-EVO version 21.2R1-EVO and later versions;21.3-EVO versions prior to 21.3R3-S1-EVO;21.4-EVO versions prior to 21.4R3-EVO;22.1-EVO versions prior to 22.1R1-S2-EVO, 22.1R2-EVO;22.2-EVO versions prior to 22.2R2-EVO.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-07-14T22:22:46.000000Z"} https://db.gcve.eu/sighting/977b4122-2e8b-4b89-b424-e2f48a7ff369/export Fri, 14 Jul 2023 22:22:46 +0000 https://db.gcve.eu/sighting/06cdc762-f1b2-4a59-b48a-94cc24283b7c/export {"uuid": "06cdc762-f1b2-4a59-b48a-94cc24283b7c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2023-36839", "type": "seen", "source": "https://t.me/cibsecurity/72206", "content": "\u203c CVE-2023-36839 \u203c\n\nAn Improper Validation of Specified Quantity in Input vulnerability in the Layer-2 control protocols daemon (l2cpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker who sends specific LLDP packets to cause a Denial of Service(DoS).This issue occurs when specific LLDP packets are received and telemetry polling is being done on the device. The impact of the l2cpd crash is reinitialization of STP protocols (RSTP, MSTP or VSTP), and MVRP and ERP. Also, if any services depend on LLDP state (like PoE or VoIP device recognition), then these will also be affected.This issue affects:Juniper Networks Junos OS * All versions prior to 20.4R3-S8; * 21.1 version 21.1R1 and later versions; * 21.2 versions prior to 21.2R3-S5; * 21.3 versions prior to 21.3R3-S4; * 21.4 versions prior to 21.4R3-S3; * 22.1 versions prior to 22.1R3-S2; * 22.2 versions prior to 22.2R3; * 22.3 versions prior to 22.3R2-S2; * 22.4 versions prior to 22.4R2;Juniper Networks Junos OS Evolved * All versions prior to 20.4R3-S8-EVO; * 21.1 version 21.1R1-EVO and later versions; * 21.2 versions prior to 21.2R3-S5-EVO; * 21.3 versions prior to 21.3R3-S4-EVO; * 21.4 versions prior to 21.4R3-S3-EVO; * 22.1 versions prior to 22.1R3-S2-EVO; * 22.2 versions prior to 22.2R3-EVO; * 22.3 versions prior to 22.3R2-S2-EVO; * 22.4 versions prior to 22.4R1-S1-EVO;\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-10-13T02:33:42.000000Z"} {"uuid": "06cdc762-f1b2-4a59-b48a-94cc24283b7c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2023-36839", "type": "seen", "source": "https://t.me/cibsecurity/72206", "content": "\u203c CVE-2023-36839 \u203c\n\nAn Improper Validation of Specified Quantity in Input vulnerability in the Layer-2 control protocols daemon (l2cpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker who sends specific LLDP packets to cause a Denial of Service(DoS).This issue occurs when specific LLDP packets are received and telemetry polling is being done on the device. The impact of the l2cpd crash is reinitialization of STP protocols (RSTP, MSTP or VSTP), and MVRP and ERP. Also, if any services depend on LLDP state (like PoE or VoIP device recognition), then these will also be affected.This issue affects:Juniper Networks Junos OS * All versions prior to 20.4R3-S8; * 21.1 version 21.1R1 and later versions; * 21.2 versions prior to 21.2R3-S5; * 21.3 versions prior to 21.3R3-S4; * 21.4 versions prior to 21.4R3-S3; * 22.1 versions prior to 22.1R3-S2; * 22.2 versions prior to 22.2R3; * 22.3 versions prior to 22.3R2-S2; * 22.4 versions prior to 22.4R2;Juniper Networks Junos OS Evolved * All versions prior to 20.4R3-S8-EVO; * 21.1 version 21.1R1-EVO and later versions; * 21.2 versions prior to 21.2R3-S5-EVO; * 21.3 versions prior to 21.3R3-S4-EVO; * 21.4 versions prior to 21.4R3-S3-EVO; * 22.1 versions prior to 22.1R3-S2-EVO; * 22.2 versions prior to 22.2R3-EVO; * 22.3 versions prior to 22.3R2-S2-EVO; * 22.4 versions prior to 22.4R1-S1-EVO;\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-10-13T02:33:42.000000Z"} https://db.gcve.eu/sighting/06cdc762-f1b2-4a59-b48a-94cc24283b7c/export Fri, 13 Oct 2023 02:33:42 +0000