# Juniper Networks Junos OS.

Every CVE that names Juniper Networks Junos OS among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first (an older page)

- [Junos OS: EX4300: PFE Denial of Service (DoS) upon receipt of a flood of specific ARP traffic](https://agentprime.io/advisories/CVE-2022-22191.md)
  `CVE-2022-22191` · CVE record: Juniper Networks Junos OS · CVSS 6.5 Medium · Not analysed yet · Published 14 Apr 2022 · Tags: CWE-410
- [Junos OS: QFX5100/QFX5110/QFX5120/QFX5200/QFX5210/EX4600/EX4650 Series: When storm control profiling is enabled and a device is under an active storm, a Heap-based Buffer Overflow in the PFE will cau…](https://agentprime.io/advisories/CVE-2022-22188.md)
  `CVE-2022-22188` · CVE record: Juniper Networks Junos OS · CVSS 7.5 High · Not analysed yet · Published 14 Apr 2022 · Tags: Memory corruption, Denial of service
- [Junos OS: EX4650 Series: Certain traffic received by the Junos OS device on the management interface may be forwarded to egress interfaces instead of discarded](https://agentprime.io/advisories/CVE-2022-22186.md)
  `CVE-2022-22186` · CVE record: Juniper Networks Junos OS · CVSS 7.2 High · Not analysed yet · Published 14 Apr 2022 · Tags: CWE-665
- [Junos OS: SRX Series: Denial of service vulnerability in flowd daemon upon receipt of a specific fragmented packet](https://agentprime.io/advisories/CVE-2022-22185.md)
  `CVE-2022-22185` · CVE record: Juniper Networks Junos OS · CVSS 7.5 High · Not analysed yet · Published 14 Apr 2022 · Tags: CWE-754
- [Junos OS Evolved: A remote attacker may cause a CPU Denial of Service by sending genuine traffic to a device on a specific IPv4 port.](https://agentprime.io/advisories/CVE-2022-22183.md)
  `CVE-2022-22183` · CVE record: Juniper Networks Junos OS Evolved and 1 more · CVSS 7.5 High · Not analysed yet · Published 14 Apr 2022 · Tags: Information disclosure, Broken access control, CWE-16
- [Junos OS: A XSS vulnerability allows an attacker to execute commands on a target J-Web session](https://agentprime.io/advisories/CVE-2022-22182.md)
  `CVE-2022-22182` · CVE record: Juniper Networks Junos OS · CVSS 8.8 High · Not analysed yet · Published 14 Apr 2022 · Tags: Cross-site scripting (XSS)
- [Junos OS: J-Web can be compromised through reflected XSS attacks](https://agentprime.io/advisories/CVE-2022-22181.md)
  `CVE-2022-22181` · CVE record: Juniper Networks Junos OS · CVSS 8.0 High · Not analysed yet · Published 14 Apr 2022 · Tags: Cross-site scripting (XSS)
- [Junos OS: EX2300 Series, EX2300-MP Series, EX3400 Series: A slow memory leak due to processing of specific IPv6 packets](https://agentprime.io/advisories/CVE-2022-22180.md)
  `CVE-2022-22180` · CVE record: Juniper Networks Junos OS · CVSS 7.5 High · Not analysed yet · Published 19 Jan 2022 · Tags: CWE-754
- [Junos OS: jdhcpd crashes upon receiving a specific DHCP packet](https://agentprime.io/advisories/CVE-2022-22179.md)
  `CVE-2022-22179` · CVE record: Juniper Networks Junos OS · CVSS 6.5 Medium · Not analysed yet · Published 19 Jan 2022
- [Junos OS: MX and SRX series: Flowd core observed if the SIP ALG is enabled and a specific Session Initiation Protocol (SIP) packet is received](https://agentprime.io/advisories/CVE-2022-22178.md)
  `CVE-2022-22178` · CVE record: Juniper Networks Junos OS · CVSS 7.5 High · Not analysed yet · Published 19 Jan 2022 · Tags: Memory corruption
- [Junos OS and Junos OS Evolved: After receiving a specific number of crafted packets snmpd will segmentation fault (SIGSEGV) requiring a manual restart.](https://agentprime.io/advisories/CVE-2022-22177.md)
  `CVE-2022-22177` · CVE record: Juniper Networks Junos OS and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 19 Jan 2022 · Tags: CWE-755
- [Junos OS: In a scenario with dhcp-security and option-82 configured jdhcpd crashes upon receipt of a malformed DHCP packet](https://agentprime.io/advisories/CVE-2022-22176.md)
  `CVE-2022-22176` · CVE record: Juniper Networks Junos OS · CVSS 7.4 High · Not analysed yet · Published 19 Jan 2022 · Tags: CWE-1286
- [Junos OS: MX Series and SRX Series: The flowd daemon will crash if the SIP ALG is enabled and specific SIP messages are processed](https://agentprime.io/advisories/CVE-2022-22175.md)
  `CVE-2022-22175` · CVE record: Juniper Networks Junos OS · CVSS 7.5 High · Not analysed yet · Published 19 Jan 2022 · Tags: CWE-667
- [Junos OS: QFX5000 Series, EX4600: Device may run out of memory, causing traffic loss, upon receipt of specific IPv6 packets](https://agentprime.io/advisories/CVE-2022-22174.md)
  `CVE-2022-22174` · CVE record: Juniper Networks Junos OS · CVSS 7.5 High · Not analysed yet · Published 19 Jan 2022 · Tags: Denial of service, CWE-755
- [Junos OS: CRL failing to download causes a memory leak and ultimately a DoS](https://agentprime.io/advisories/CVE-2022-22173.md)
  `CVE-2022-22173` · CVE record: Juniper Networks Junos OS · CVSS 7.5 High · Not analysed yet · Published 19 Jan 2022 · Tags: Denial of service
- [Junos OS and Junos OS Evolved: An l2cpd memory leak can occur when specific LLDP packets are received leading to a DoS](https://agentprime.io/advisories/CVE-2022-22172.md)
  `CVE-2022-22172` · CVE record: Juniper Networks Junos OS and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 19 Jan 2022 · Tags: Denial of service
- [Junos OS: Specific packets over VXLAN cause FPC reset](https://agentprime.io/advisories/CVE-2022-22171.md)
  `CVE-2022-22171` · CVE record: Juniper Networks Junos OS · CVSS 7.5 High · Not analysed yet · Published 19 Jan 2022 · Tags: CWE-754
- [Junos OS: Specific packets over VXLAN cause FPC memory leak and ultimately reset](https://agentprime.io/advisories/CVE-2022-22170.md)
  `CVE-2022-22170` · CVE record: Juniper Networks Junos OS · CVSS 7.5 High · Not analysed yet · Published 19 Jan 2022 · Tags: Denial of service
- [Junos OS and Junos OS Evolved: OSPFv3 session might go into INIT state upon receipt of multiple crafted packets from a trusted neighbor device.](https://agentprime.io/advisories/CVE-2022-22169.md)
  `CVE-2022-22169` · CVE record: Juniper Networks Junos OS and 1 more · CVSS 5.9 Medium · Not analysed yet · Published 19 Jan 2022 · Tags: CWE-665
- [Junos OS: vMX and MX150: Specific packets might cause a memory leak and eventually an FPC reboot](https://agentprime.io/advisories/CVE-2022-22168.md)
  `CVE-2022-22168` · CVE record: Juniper Networks Junos OS · CVSS 6.5 Medium · Not analysed yet · Published 19 Jan 2022 · Tags: Denial of service, CWE-1287
- [Junos OS: SRX Series: If no-syn-check is enabled, traffic classified as UNKNOWN gets permitted by pre-id-default-policy](https://agentprime.io/advisories/CVE-2022-22167.md)
  `CVE-2022-22167` · CVE record: Juniper Networks Junos OS · CVSS 7.2 High · Not analysed yet · Published 19 Jan 2022 · Tags: Broken access control
- [Junos OS: An rpd core will occur if BGP update tracing is configured and an update containing a malformed BGP SR-TE policy tunnel attribute is received](https://agentprime.io/advisories/CVE-2022-22166.md)
  `CVE-2022-22166` · CVE record: Juniper Networks Junos OS · CVSS 6.5 Medium · Not analysed yet · Published 19 Jan 2022 · Tags: CWE-1284
- [Junos OS: jdhcpd crashes upon receipt of a specific DHCPv6 packet](https://agentprime.io/advisories/CVE-2022-22163.md)
  `CVE-2022-22163` · CVE record: Juniper Networks Junos OS · CVSS 7.4 High · Not analysed yet · Published 19 Jan 2022 · Tags: CWE-20
- [Junos OS: A low privileged user can elevate their privileges to the ones of the highest privileged j-web user logged in](https://agentprime.io/advisories/CVE-2022-22162.md)
  `CVE-2022-22162` · CVE record: Juniper Networks Junos OS · CVSS 7.3 High · Not analysed yet · Published 19 Jan 2022 · Tags: Information disclosure
- [Junos OS: MX104 might become unresponsive if the out-of-band management port receives a flood of traffic](https://agentprime.io/advisories/CVE-2022-22161.md)
  `CVE-2022-22161` · CVE record: Juniper Networks Junos OS · CVSS 7.5 High · Not analysed yet · Published 19 Jan 2022 · Tags: Denial of service
- [Junos OS: MX Series: The bbe-smgd process crashes if an unsupported configuration exists and a PPPoE client sends a specific message](https://agentprime.io/advisories/CVE-2022-22160.md)
  `CVE-2022-22160` · CVE record: Juniper Networks Junos OS · CVSS 6.5 Medium · Not analysed yet · Published 19 Jan 2022 · Tags: CWE-391
- [Junos OS: An attacker sending crafted packets can cause a traffic and CPU Denial of Service (DoS).](https://agentprime.io/advisories/CVE-2022-22159.md)
  `CVE-2022-22159` · CVE record: Juniper Networks Junos OS and 1 more · CVSS 7.5 High · Not analysed yet · Published 19 Jan 2022
- [Junos OS: SRX Series: Traffic classification vulnerability when 'no-syn-check' is enabled](https://agentprime.io/advisories/CVE-2022-22157.md)
  `CVE-2022-22157` · CVE record: Juniper Networks Junos OS · CVSS 7.2 High · Not analysed yet · Published 19 Jan 2022 · Tags: Broken access control
- [Junos OS: Certificate validation is skipped when fetching system scripts from a HTTPS URL](https://agentprime.io/advisories/CVE-2022-22156.md)
  `CVE-2022-22156` · CVE record: Juniper Networks Junos OS · CVSS 6.5 Medium · Not analysed yet · Published 19 Jan 2022 · Tags: Weak cryptography or TLS, CWE-300, CWE-358
- [Junos OS: ACX5448: FPC memory leak due to IPv6 neighbor flaps](https://agentprime.io/advisories/CVE-2022-22155.md)
  `CVE-2022-22155` · CVE record: Juniper Networks Junos OS · CVSS 6.5 Medium · Not analysed yet · Published 19 Jan 2022 · Tags: Denial of service
- [Junos Fusion: A Satellite Device can be controlled by rewiring it to a foreign AD causing a DoS](https://agentprime.io/advisories/CVE-2022-22154.md)
  `CVE-2022-22154` · CVE record: Juniper Networks Junos OS · CVSS 6.8 Medium · Not analysed yet · Published 19 Jan 2022 · Tags: CWE-642
- [SRX Series and MX Series with SPC3: A high percentage of fragments might lead to high latency or packet drops](https://agentprime.io/advisories/CVE-2022-22153.md)
  `CVE-2022-22153` · CVE record: Juniper Networks Junos OS · CVSS 7.5 High · Not analysed yet · Published 19 Jan 2022 · Tags: Denial of service
- [Junos OS: When using J-Web with HTTP an attacker may retrieve encryption keys via Person-in-the-Middle attacks.](https://agentprime.io/advisories/CVE-2021-31386.md)
  `CVE-2021-31386` · CVE record: Juniper Networks Junos OS · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2021 · Tags: Weak cryptography or TLS, CWE-300, CWE-325, CWE-693
- [Junos OS: J-Web: A path traversal vulnerability allows an authenticated attacker to elevate their privileges to root](https://agentprime.io/advisories/CVE-2021-31385.md)
  `CVE-2021-31385` · CVE record: Juniper Networks Junos OS · CVSS 8.8 High · Not analysed yet · Published 19 Oct 2021 · Tags: Path traversal
- [Junos OS: SRX Series: Under a specific device configuration an attacker can access the devices J-Web management services from any interface, regardless of security settings protecting the service](https://agentprime.io/advisories/CVE-2021-31384.md)
  `CVE-2021-31384` · CVE record: Juniper Networks Junos OS · CVSS 7.2 High · Not analysed yet · Published 19 Oct 2021 · Tags: Broken access control, CWE-551, CWE-939, CWE-1220
- [Junos OS and Junos OS Evolved: In Point to MultiPoint (P2MP) scenarios receipt of various crafted packets causes RPD to core.](https://agentprime.io/advisories/CVE-2021-31383.md)
  `CVE-2021-31383` · CVE record: Juniper Networks Junos OS and 1 more · CVSS 7.5 High · Not analysed yet · Published 19 Oct 2021 · Tags: Memory corruption
- [Junos OS: PTX1000 System, PTX10002-60C System: After upgrading, configured firewall filters may be applied on incorrect interfaces](https://agentprime.io/advisories/CVE-2021-31382.md)
  `CVE-2021-31382` · CVE record: Juniper Networks Junos OS · CVSS 6.5 Medium · Not analysed yet · Published 19 Oct 2021 · Tags: Race condition
- [Junos OS: MX Series: MPC 7/8/9/10/11 cards with MAP-E: PFE halts when an attacker sends malformed IPv4 or IPv6 traffic inside the MAP-E tunnel.](https://agentprime.io/advisories/CVE-2021-31379.md)
  `CVE-2021-31379` · CVE record: Juniper Networks Junos OS · CVSS 7.5 High · Not analysed yet · Published 19 Oct 2021 · Tags: CWE-696
- [Junos OS: An attacker sending spoofed RADIUS messages to a Junos OS device configured for broadband services may cause broadband subscribers to remain stuck in a "Terminating" state.](https://agentprime.io/advisories/CVE-2021-31378.md)
  `CVE-2021-31378` · CVE record: Juniper Networks Junos OS · CVSS 6.8 Medium · Not analysed yet · Published 19 Oct 2021 · Tags: Denial of service
- [Junos OS: A local authenticated attacker can cause RPD to core](https://agentprime.io/advisories/CVE-2021-31377.md)
  `CVE-2021-31377` · CVE record: Juniper Networks Junos OS · CVSS 5.5 Medium · Not analysed yet · Published 19 Oct 2021 · Tags: Broken access control
- [Junos OS: ACX Series: Packet Forwarding Engine manager (FXPC) process crashes when processing DHCPv6 packets](https://agentprime.io/advisories/CVE-2021-31376.md)
  `CVE-2021-31376` · CVE record: Juniper Networks Junos OS · CVSS 7.5 High · Not analysed yet · Published 19 Oct 2021 · Tags: CWE-20
- [Junos OS: Receipt of a specific BGP update may cause RPKI policy-checks to be bypassed](https://agentprime.io/advisories/CVE-2021-31375.md)
  `CVE-2021-31375` · CVE record: Juniper Networks Junos OS · CVSS 7.2 High · Not analysed yet · Published 19 Oct 2021 · Tags: CWE-20, CWE-358
- [Junos OS and Junos OS Evolved: RPD crash while processing a specially crafted BGP UPDATE or KEEPALIVE message.](https://agentprime.io/advisories/CVE-2021-31374.md)
  `CVE-2021-31374` · CVE record: Juniper Networks Junos OS and 1 more · CVSS 7.5 High · Not analysed yet · Published 19 Oct 2021 · Tags: Memory corruption
- [Junos OS: SRX Series: Persistent XSS vulnerability in J-Web](https://agentprime.io/advisories/CVE-2021-31373.md)
  `CVE-2021-31373` · CVE record: Juniper Networks Junos OS · CVSS 8.0 High · Not analysed yet · Published 19 Oct 2021 · Tags: Cross-site scripting (XSS), CWE-20
- [Junos OS: J-Web allows a locally authenticated attacker to escalate their privileges to root.](https://agentprime.io/advisories/CVE-2021-31372.md)
  `CVE-2021-31372` · CVE record: Juniper Networks Junos OS · CVSS 8.8 High · Not analysed yet · Published 19 Oct 2021 · Tags: CWE-20
- [Junos OS: QFX5000 Series: Traffic from the network internal to the device (128.0.0.0) may be forwarded to egress interfaces.](https://agentprime.io/advisories/CVE-2021-31371.md)
  `CVE-2021-31371` · CVE record: Juniper Networks Junos OS · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2021 · Tags: Information disclosure
- [Junos OS: QFX5000 Series and EX4600 Series: Control traffic might be dropped if a high rate of specific multicast traffic is received](https://agentprime.io/advisories/CVE-2021-31370.md)
  `CVE-2021-31370` · CVE record: Juniper Networks Junos OS · CVSS 6.5 Medium · Not analysed yet · Published 19 Oct 2021 · Tags: CWE-184
- [Junos OS: MX Series: Traffic drops will be observed if MS-MPC/MS-PIC resources are consumed by certain traffic causing a partial DoS](https://agentprime.io/advisories/CVE-2021-31369.md)
  `CVE-2021-31369` · CVE record: Juniper Networks Junos OS · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2021 · Tags: Denial of service
- [Junos OS: EX2300 Series, EX3400 Series, and ACX710 might become unresponsive if the out-of-band management port receives a flood of traffic](https://agentprime.io/advisories/CVE-2021-31368.md)
  `CVE-2021-31368` · CVE record: Juniper Networks Junos OS · CVSS 7.5 High · Not analysed yet · Published 19 Oct 2021 · Tags: Denial of service
- [Junos OS: PTX Series: An FPC heap memory leak will be triggered by certain Flowspec route operations which can lead to an FPC crash](https://agentprime.io/advisories/CVE-2021-31367.md)
  `CVE-2021-31367` · CVE record: Juniper Networks Junos OS · CVSS 6.5 Medium · Not analysed yet · Published 19 Oct 2021 · Tags: Denial of service
- [Junos OS: MX Series: In subscriber management / BBE configuration authd can crash if a subscriber with a specific username tries to login leading to a DoS](https://agentprime.io/advisories/CVE-2021-31366.md)
  `CVE-2021-31366` · CVE record: Juniper Networks Junos OS · CVSS 6.5 Medium · Not analysed yet · Published 19 Oct 2021 · Tags: CWE-252
- [Junos OS: EX2300, EX3400 and EX4300 Series: An Aggregated Ethernet (AE) interface will go down due to a stream of specific layer 2 frames](https://agentprime.io/advisories/CVE-2021-31365.md)
  `CVE-2021-31365` · CVE record: Juniper Networks Junos OS · CVSS 6.5 Medium · Not analysed yet · Published 19 Oct 2021 · Tags: Denial of service
- [Junos OS: SRX Series: The flowd process will crash if log session-close is configured and specific traffic is received](https://agentprime.io/advisories/CVE-2021-31364.md)
  `CVE-2021-31364` · CVE record: Juniper Networks Junos OS · CVSS 5.9 Medium · Not analysed yet · Published 19 Oct 2021 · Tags: Race condition, CWE-754
- [Junos OS and Junos OS Evolved: Receipt of a specific LDP message will cause a Denial of Service](https://agentprime.io/advisories/CVE-2021-31363.md)
  `CVE-2021-31363` · CVE record: Juniper Networks Junos OS and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 19 Oct 2021 · Tags: Denial of service
- [Junos OS and Junos OS Evolved: An IS-IS adjacency might be taken down if a bad hello PDU is received for an existing adjacency causing a DoS](https://agentprime.io/advisories/CVE-2021-31362.md)
  `CVE-2021-31362` · CVE record: Juniper Networks Junos OS and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 19 Oct 2021 · Tags: CWE-693
- [Junos OS: QFX Series and PTX Series: FPC resource usage increases when certain packets are processed which are being VXLAN encapsulated](https://agentprime.io/advisories/CVE-2021-31361.md)
  `CVE-2021-31361` · CVE record: Juniper Networks Junos OS · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2021 · Tags: CWE-754, CWE-755
- [Junos OS and Junos OS Evolved: Denial of Service vulnerability in local file processing](https://agentprime.io/advisories/CVE-2021-31360.md)
  `CVE-2021-31360` · CVE record: Juniper Networks Junos OS and 1 more · CVSS 7.1 High · Not analysed yet · Published 19 Oct 2021 · Tags: Privilege escalation, CWE-20
- [Junos OS and Junos OS Evolved: Local Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2021-31359.md)
  `CVE-2021-31359` · CVE record: Juniper Networks Junos OS and 1 more · CVSS 7.8 High · Not analysed yet · Published 19 Oct 2021 · Tags: Memory corruption, Privilege escalation
- [Junos OS: Stored Cross-Site Scripting (XSS) vulnerability in captive portal](https://agentprime.io/advisories/CVE-2021-31355.md)
  `CVE-2021-31355` · CVE record: Juniper Networks Junos OS · CVSS 8.0 High · Not analysed yet · Published 19 Oct 2021 · Tags: Cross-site scripting (XSS)
- [Junos OS and Junos OS Evolved: A vulnerability in the Juniper Agile License Client may allow an attacker to perform Remote Code Execution (RCE)](https://agentprime.io/advisories/CVE-2021-31354.md)
  `CVE-2021-31354` · CVE record: Juniper Networks Junos OS and 1 more · CVSS 7.1 High · Not analysed yet · Published 19 Oct 2021 · Tags: Memory corruption

Newest: <https://agentprime.io/advisories/technology/juniper-networks-junos-os.md>
Older: <https://agentprime.io/advisories/technology/juniper-networks-junos-os.md?cursor=WyIyMDIxLTEwLTE5VDE4OjE2OjM2LjUwMjAwMFoiLCJDVkUtMjAyMS0zMTM1NCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=juniper-networks-junos-os&cursor=WyIyMDIyLTA0LTE0VDE1OjUwOjUzLjcyODAwMFoiLCJDVkUtMjAyMi0yMjE5MyJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/juniper-networks-junos-os/?cursor=WyIyMDIyLTA0LTE0VDE1OjUwOjUzLjcyODAwMFoiLCJDVkUtMjAyMi0yMjE5MyJd>. Everything for agents: <https://agentprime.io/llms.txt>.