Vulnerabilities

A Missing Release of Memory after Effective Lifetime vulnerability in the IKE daemon (iked) of Juniper Networks Junos OS on MX Series with SPC3, and SRX Series allows an administratively adjacent attacker which is able to successfully establish IPsec tunnels to cause a Denial of Service (DoS).<br /> <br /> If specific values for the IPsec parameters local-ip, remote-ip, remote ike-id, and traffic selectors are sent from the peer, a memory leak occurs during every IPsec SA rekey which is carried out with a specific message sequence. This will eventually result in an iked process crash and restart.<br /> <br /> The iked process memory consumption can be checked using the below command:<br />   user@host&gt; show system processes extensive | grep iked<br />           PID USERNAME   PRI NICE   SIZE   RES   STATE   C TIME WCPU COMMAND<br />           56903 root       31   0     4016M 2543M CPU0   0 2:10 10.50% iked<br /> <br /> This issue affects Juniper Networks Junos OS:<br /> * All versions earlier than 20.4R3-S9;<br /> * 21.2 versions earlier than 21.2R3-S7;<br /> * 21.3 versions earlier than 21.3R3-S5;<br /> * 21.4 versions earlier than 21.4R3-S4;<br /> * 22.1 versions earlier than 22.1R3-S3;<br /> * 22.2 versions earlier than 22.2R3-S2;<br /> * 22.3 versions earlier than 22.3R3;<br /> * 22.4 versions earlier than 22.4R3;<br /> * 23.2 versions earlier than 23.2R1-S2, 23.2R2.

An Improper Handling of Exceptional Conditions vulnerability in the Class of Service daemon (cosd) of Juniper Networks Junos OS allows an authenticated, network-based attacker with low privileges to cause a limited Denial of Service (DoS).<br /> <br /> In a scaled CoS scenario with 1000s of interfaces, when specific low privileged commands, received over NETCONF, SSH or telnet, are handled by cosd on behalf of mgd, the respective child management daemon (mgd) processes will get stuck. In case of (Netconf over) SSH this leads to stuck SSH sessions, so that when the connection-limit for SSH is reached, new sessions can&amp;#39;t be established anymore. A similar behavior will be seen for telnet etc.<br /> <br /> Stuck mgd processes can be monitored by executing the following command:<br /> <br />   user@host&gt; show system processes extensive | match mgd | match sbwait<br /> <br /> This issue affects Juniper Networks Junos OS:<br /> * All versions earlier than 20.4R3-S9;<br /> * 21.2 versions earlier than 21.2R3-S7;<br /> * 21.3 versions earlier than 21.3R3-S5;<br /> * 21.4 versions earlier than 21.4R3-S5;<br /> * 22.1 versions earlier than 22.1R3-S4;<br /> * 22.2 versions earlier than 22.2R3-S3;<br /> * 22.3 versions earlier than 22.3R3-S2;<br /> * 22.4 versions earlier than 22.4R3;<br /> * 23.2 versions earlier than 23.2R1-S2, 23.2R2.

An Improper Check or Handling of Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to cause a Denial of Service (DoS).<br /> <br /> If an attacker sends a specific MPLS packet, which upon processing, causes an internal loop, that leads to a PFE crash and restart. Continued receipt of these packets leads to a sustained Denial of Service (DoS) condition.<br /> <br /> Circuit cross-connect (CCC) needs to be configured on the device for it to be affected by this issue.<br /> <br /> This issue only affects MX Series with MPC10, MPC11, LC9600, and MX304.<br /> <br /> This issue affects:<br /> Juniper Networks Junos OS<br /> 21.4 versions from 21.4R3 earlier than 21.4R3-S5;<br /> 22.2 versions from 22.2R2 earlier than 22.2R3-S2;<br /> 22.3 versions from 22.3R1 earlier than 22.3R2-S2;<br /> 22.3 versions from 22.3R3 earlier than 22.3R3-S1<br /> 22.4 versions from 22.4R1 earlier than 22.4R2-S2, 22.4R3;<br /> 23.2 versions earlier than 23.2R1-S1, 23.2R2.

Missing Authorization vulnerability in WooCommerce WooCommerce Shipping Per Product.This issue affects WooCommerce Shipping Per Product: from n/a through 2.5.4.<br /> <br />

Missing Authorization vulnerability in Undsgn Uncode Core allows Privilege Escalation.This issue affects Uncode Core: from n/a through 2.8.8.<br /> <br />

Missing Authorization vulnerability in Automattic WP Job Manager.This issue affects WP Job Manager: from n/a through 2.0.0.<br /> <br />

An Improper Input Validation vulnerability in Juniper Tunnel Driver (jtd) and ICMP module of Juniper Networks Junos OS Evolved allows an unauthenticated attacker within the MPLS administrative domain to send specifically crafted packets to the Routing Engine (RE) to cause a Denial of Service (DoS). <br /> <br /> When specifically crafted transit MPLS IPv4 packets are received by the Packet Forwarding Engine (PFE), these packets are internally forwarded to the RE. Continued receipt of these packets may create a sustained Denial of Service (DoS) condition.<br /> <br /> This issue affects Juniper Networks Junos OS:<br /> <br /> * All versions before 21.2R3-S8-EVO;<br /> * from 21.4-EVO before 21.4R3-S6-EVO;<br /> * from 22.2-EVO before 22.2R3-S4-EVO;<br /> * from 22.3-EVO before 22.3R3-S3-EVO;<br /> * from 22.4-EVO before 22.4R3-EVO;<br /> * from 23.2-EVO before 23.2R2-EVO.<br /> * from 23.4-EVO before 23.4R1-S1-EVO.

Information exposure vulnerability in OpenGnsys affecting version 1.1.1d (Espeto). This vulnerability allows an attacker to enumerate all files in the web tree by accessing a php file.

Information exposure vulnerability in OpenGnsys affecting version 1.1.1d (Espeto). This vulnerability allows an attacker to view a php backup file (controlaccess.php-LAST) where database credentials are stored.

A vulnerability has been found in DedeCMS 5.7.112-UTF8 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file update_guide.php. The manipulation of the argument files leads to path traversal: &amp;#39;../filedir&amp;#39;. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-260473 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in bihell Dice 3.1.0 and classified as problematic. Affected by this issue is some unknown functionality of the component Comment Handler. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-260474 is the identifier assigned to this vulnerability.

A vulnerability was found in Xiamen Four-Faith RMP Router Management Platform 5.2.2. It has been declared as critical. This vulnerability affects unknown code of the file /Device/Device/GetDeviceInfoList?deviceCode=&amp;searchField=&amp;deviceState=. The manipulation of the argument groupId leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-260476. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.