Juniper Networks Session Smart Router.

Session Smart Router and Session Smart Conductor: Improper validation of a field causes privilege escalation when updating the YANG configuration

• Juniper Networks Session Smart Router
• Juniper Networks Session Smart Conductor
• Command injection

Session Smart Router: A malicious DHCP server causes information disclosure and a service crash during DHCP option parsing

• Juniper Networks Session Smart Router
• Memory corruption

Session Smart Router: Integer overflow causes denial of service during TLS certificate inspection

• Juniper Networks Session Smart Router
• Memory corruption
• Denial of service

Session Smart Router: An attacker obtains administrative privileges when an unauthenticated internal endpoint is accessed

• Juniper Networks Session Smart Router
• Authentication bypass

Session Smart Router: An attacker-controlled input causes remote code execution when parsing DHCP options

• Juniper Networks Session Smart Router
• Memory corruption

Session Smart Router and Session Smart Conductor: Unsanitized input allows arbitrary file read, overwrite, or deletion via the PKI management

• Juniper Networks Session Smart Router
• Juniper Networks Session Smart Conductor
• Path traversal

Session Smart Router and Session Smart Conductor: Unsanitized input causes HTTP response splitting

• Juniper Networks Session Smart Router
• Juniper Networks Session Smart Conductor
• Other injection

Session Smart Router and Session Smart Conductor: Unvalidated input causes arbitrary file deletion and command execution when deleting audit rules

• Juniper Networks Session Smart Router
• Juniper Networks Session Smart Conductor
• Command injection

Session Smart Router and Session Smart Conductor: Lack of integrity verification in cache files causes arbitrary code execution and privilege escalation

• Juniper Networks Session Smart Router
• Juniper Networks Session Smart Conductor
• CWE-345

Session Smart Router and Session Smart Conductor: An attacker can overwrite arbitrary files as root

• Juniper Networks Session Smart Router
• Juniper Networks Session Smart Conductor
• Path traversal

Session Smart Router and Session Smart Conductor: Crafted directory names cause arbitrary filesystem unmounting during service cleanup

• Juniper Networks Session Smart Router
• Juniper Networks Session Smart Conductor
• Other injection

Session Smart Router: An incomplete operator causes the use of incorrect encryption keys during security policy updates.

• Juniper Networks Session Smart Router
• CWE-665

Session Smart Router: An attacker can cause an out-of-bounds read during VRRP packet processing

• Juniper Networks Session Smart Router
• Memory corruption

Session Smart Router: A SACK option causes out-of-bounds memory access and TCP payload corruption when TCP sequence stitching is enabled

• Juniper Networks Session Smart Router
• Memory corruption

Session Smart Router: An attacker-controlled TCP option causes an out-of-bounds write when using the TCP proxy feature

• Juniper Networks Session Smart Router
• Memory corruption

Session Smart Router and Session Smart Conductor: A malformed HTTP URI causes a service crash during HTTP application identification

• Juniper Networks Session Smart Router
• Juniper Networks Session Smart Conductor
• Memory corruption

Session Smart Router, Session Smart Conductor, WAN Assurance Router: API Authentication Bypass vulnerability

• Juniper Networks Session Smart Router
• Juniper Networks Session Smart Conductor
• Authentication bypass

Session Smart Router(SSR): On redundant router deployments API authentication can be bypassed

• Juniper Networks Session Smart Router
• Juniper Networks Session Smart Conductor
• Authentication bypass