[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fWz_zBSjbRjnczA-O6AOslXxrSFPLbMV2wz3hmMMQIOM":3,"g5a-family:juniper\u002Fex4600-vc":112,"g5a-ex:juniper\u002Fex4600-vc@*":113},{"success":4,"data":5},true,{"product":6,"versions":15,"topVulnerabilitiesByEpss":16,"kevVulnerabilities":78,"seoMetadata":90,"meta":109},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":14},"juniper","ex4600-vc",0,16,3,"2024-01-25",[],"Ex4600-vc by Juniper is a technology product and 16 known security vulnerabilities including 3 CISA Known Exploited Vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[],[17,25,29,37,44,52,58,63,68,73],{"cveId":18,"description":19,"publishedDate":20,"cvssScore":21,"cvssVersion":22,"severity":23,"isKev":4,"epssScore":24},"CVE-2023-36844","A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to control certain, important environment variables.\n\nUsing a crafted request an attacker is able to modify \n\ncertain PHP environment variables leading to partial loss of integrity, which may allow chaining to other vulnerabilities.\nThis issue affects Juniper Networks Junos OS on EX Series:\n\n\n\n  *  All versions prior to 20.4R3-S9;\n  *  21.1 versions 21.1R1 and later;\n  *  21.2 versions prior to 21.2R3-S7;\n  *  21.3 versions \n\nprior to \n\n 21.3R3-S5;\n  *  21.4 versions \n\nprior to \n\n21.4R3-S5;\n  *  22.1 versions \n\nprior to \n\n22.1R3-S4;\n  *  22.2 versions \n\nprior to \n\n22.2R3-S2;\n  *  22.3 versions \n\nprior to 22.3R3-S1;\n  *  22.4 versions \n\nprior to \n\n22.4R2-S2, 22.4R3;\n  *  23.2 versions prior to \n\n23.2R1-S1, 23.2R2.","2023-08-17",5.3,"v3.1","Medium",0.89958,{"cveId":26,"description":27,"publishedDate":20,"cvssScore":21,"cvssVersion":22,"severity":23,"isKev":4,"epssScore":28},"CVE-2023-36847","A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity.\n\n\n\n\n\nWith a specific request to installAppPackage.php that doesn't require authentication an attacker is able to upload arbitrary files via J-Web, leading to a loss of \n\nintegrity\n\nfor a certain \n\npart of the file system, which may allow chaining to other vulnerabilities.\n\n\nThis issue affects Juniper Networks Junos OS on EX Series:\n\n\n\n  *  All versions prior to 20.4R3-S8;\n  *  21.1 versions 21.1R1 and later;\n  *  21.2 versions prior to 21.2R3-S6;\n  *  21.3 versions \n\nprior to \n\n 21.3R3-S5;\n  *  21.4 versions \n\nprior to \n\n21.4R3-S4;\n  *  22.1 versions \n\nprior to \n\n22.1R3-S3;\n  *  22.2 versions \n\nprior to \n\n22.2R3-S1;\n  *  22.3 versions \n\nprior to \n\n22.3R2-S2, 22.3R3;\n  *  22.4 versions \n\nprior to \n\n22.4R2-S1, 22.4R3.\n\n\n\n\n",0.83455,{"cveId":30,"description":31,"publishedDate":32,"cvssScore":33,"cvssVersion":34,"severity":23,"isKev":35,"epssScore":36},"CVE-2014-9708","Embedthis Appweb before 4.6.6 and 5.x before 5.2.1 allows remote attackers to cause a denial of service (NULL pointer dereference) via a Range header with an empty value, as demonstrated by \"Range: x=,\".","2015-03-31",5,"v2",false,0.56191,{"cveId":38,"description":39,"publishedDate":40,"cvssScore":41,"cvssVersion":22,"severity":42,"isKev":35,"epssScore":43},"CVE-2018-15504","An issue was discovered in Embedthis GoAhead before 4.0.1 and Appweb before 7.0.2. The server mishandles some HTTP request fields associated with time, which results in a NULL pointer dereference, as demonstrated by If-Modified-Since or If-Unmodified-Since with a month greater than 11.","2018-08-18",7.5,"High",0.02766,{"cveId":45,"description":46,"publishedDate":47,"cvssScore":48,"cvssVersion":49,"severity":50,"isKev":35,"epssScore":51},"CVE-2017-10615","A vulnerability in the pluggable authentication module (PAM) of Juniper Networks Junos OS may allow an unauthenticated network based attacker to potentially execute arbitrary code or crash daemons such as telnetd or sshd that make use of PAM. Affected Juniper Networks Junos OS releases are: 14.1 from 14.1R5 prior to 14.1R8-S4, 14.1R9; 14.1X53 prior to 14.1X53-D50 on EX and QFX series; 14.2 from 14.2R3 prior to 14.2R7-S8, 14.2R8; No other Junos OS releases are affected by this issue. No other Juniper Networks products are affected by this issue.","2017-10-13",9.8,"v3.0","Critical",0.02455,{"cveId":53,"description":54,"publishedDate":55,"cvssScore":56,"cvssVersion":22,"severity":50,"isKev":35,"epssScore":57},"CVE-2021-0211","An improper check for unusual or exceptional conditions in Juniper Networks Junos OS and Junos OS Evolved Routing Protocol Daemon (RPD) service allows an attacker to send a valid BGP FlowSpec message thereby causing an unexpected change in the route advertisements within the BGP FlowSpec domain leading to disruptions in network traffic causing a Denial of Service (DoS) condition. Continued receipt of these update messages will cause a sustained Denial of Service condition. This issue affects Juniper Networks: Junos OS: All versions prior to 17.3R3-S10 with the exceptions of 15.1X49-D240 on SRX Series and 15.1R7-S8 on EX Series; 17.3 versions prior to 17.3R3-S10; 17.4 versions prior to 17.4R2-S12, 17.4R3-S4; 18.1 versions prior to 18.1R3-S12; 18.2 versions prior to 18.2R2-S8, 18.2R3-S6; 18.3 versions prior to 18.3R3-S4; 18.4 versions prior to 18.4R1-S8, 18.4R2-S6, 18.4R3-S6; 19.1 versions prior to 19.1R1-S6, 19.1R2-S2, 19.1R3-S3; 19.2 versions prior to 19.2R3-S1; 19.3 versions prior to 19.3R2-S5, 19.3R3-S1; 19.4 versions prior to 19.4R1-S3, 19.4R2-S3, 19.4R3; 20.1 versions prior to 20.1R2; 20.2 versions prior to 20.2R1-S3 20.2R2; 20.3 versions prior to 20.3R1-S1, 20.3R2. Junos OS Evolved: All versions prior to 20.3R1-S1-EVO, 20.3R2-EVO.","2021-01-15",10,0.01333,{"cveId":59,"description":60,"publishedDate":61,"cvssScore":21,"cvssVersion":22,"severity":23,"isKev":4,"epssScore":62},"CVE-2023-36851","A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity.\n\n\n\nWith a specific request to \n\nwebauth_operation.php\n\nthat doesn't require authentication, an attacker is able to upload and download arbitrary files via J-Web, leading to a loss of \n\nintegrity or confidentiality, which may allow chaining to other vulnerabilities.\n\n\nThis issue affects Juniper Networks Junos OS on SRX Series:\n\n\n\n  *  \n\n21.2 versions prior to 21.2R3-S8;\n  *  21.4 \n\nversions prior to \n\n21.4R3-S6;\n  *  22.1 \n\nversions prior to \n\n22.1R3-S5;\n  *  22.2 \n\nversions prior to \n\n22.2R3-S3;\n  *  22.3 \n\nversions prior to \n\n22.3R3-S2;\n  *  22.4 versions prior to 22,4R2-S2, 22.4R3;\n  *  23.2 versions prior to \n\n23.2R1-S2, 23.2R2.\n\n\n","2023-09-27",0.01123,{"cveId":64,"description":65,"publishedDate":66,"cvssScore":41,"cvssVersion":22,"severity":42,"isKev":35,"epssScore":67},"CVE-2021-0285","An uncontrolled resource consumption vulnerability in Juniper Networks Junos OS on QFX5000 Series and EX4600 Series switches allows an attacker sending large amounts of legitimate traffic destined to the device to cause Interchassis Control Protocol (ICCP) interruptions, leading to an unstable control connection between the Multi-Chassis Link Aggregation Group (MC-LAG) nodes which can in turn lead to traffic loss. Continued receipt of this amount of traffic will create a sustained Denial of Service (DoS) condition. An indication that the system could be impacted by this issue is the following log message: \"DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol\u002Fexception LOCALNH:aggregate exceeded its allowed bandwidth at fpc \u003Cfpc number> for \u003Cn> times, started at \u003Ctimestamp>\" This issue affects Juniper Networks Junos OS on QFX5000 Series and EX4600 Series: 15.1 versions prior to 15.1R7-S9; 17.3 versions prior to 17.3R3-S11; 17.4 versions prior to 17.4R2-S13, 17.4R3-S5; 18.3 versions prior to 18.3R3-S5; 18.4 versions prior to 18.4R2-S8, 18.4R3-S7; 19.1 versions prior to 19.1R3-S5; 19.2 versions prior to 19.2R1-S6, 19.2R3-S2; 19.3 versions prior to 19.3R2-S6, 19.3R3-S2; 19.4 versions prior to 19.4R1-S4, 19.4R2-S4, 19.4R3-S2; 20.1 versions prior to 20.1R2-S2, 20.1R3; 20.2 versions prior to 20.2R2-S3, 20.2R3; 20.3 versions prior to 20.3R2; 20.4 versions prior to 20.4R1-S1, 20.4R2.","2021-07-15",0.00961,{"cveId":69,"description":70,"publishedDate":71,"cvssScore":41,"cvssVersion":22,"severity":42,"isKev":35,"epssScore":72},"CVE-2022-22174","A vulnerability in the processing of inbound IPv6 packets in Juniper Networks Junos OS on QFX5000 Series and EX4600 switches may cause the memory to not be freed, leading to a packet DMA memory leak, and eventual Denial of Service (DoS) condition. Once the condition occurs, further packet processing will be impacted, creating a sustained Denial of Service (DoS) condition. The following error logs may be observed using the \"show heap\" command and the device may eventually run out of memory if such packets are received continuously. Jan 12 12:00:00 device-name fpc0 (buf alloc) failed allocating packet buffer Jan 12 12:00:01 device-name fpc0 (buf alloc) failed allocating packet buffer user@device-name> request pfe execute target fpc0 timeout 30 command \"show heap\" ID Base Total(b) Free(b) Used(b) % Name -- ---------- ----------- ----------- ----------- --- ----------- 0 246fc1a8 536870488 353653752 183216736 34 Kernel 1 91800000 16777216 12069680 4707536 28 DMA 2 92800000 75497472 69997640 5499832 7 PKT DMA DESC 3 106fc000 335544320 221425960 114118360 34 Bcm_sdk 4 97000000 176160768 200 176160568 99 Packet DMA \u003C\u003C\u003C\u003C\u003C\u003C\u003C\u003C\u003C\u003C\u003C\u003C\u003C\u003C 5 903fffe0 20971504 20971504 0 0 Blob This issue affects Juniper Networks Junos OS on QFX5000 Series, EX4600: 18.3R3 versions prior to 18.3R3-S6; 18.4 versions prior to 18.4R2-S9, 18.4R3-S9; 19.1 versions prior to 19.1R2-S3, 19.1R3-S7; 19.2 versions prior to 19.2R1-S8, 19.2R3-S3; 19.3 versions prior to 19.3R2-S7, 19.3R3-S4; 19.4 versions prior to 19.4R2-S5, 19.4R3-S6; 20.1 versions prior to 20.1R3-S1; 20.2 versions prior to 20.2R3-S2; 20.3 versions prior to 20.3R3-S1; 20.4 versions prior to 20.4R3; 21.1 versions prior to 21.1R2-S1, 21.1R3; 21.2 versions prior to 21.2R1-S1, 21.2R2. This issue does not affect Juniper Networks Junos OS: Any versions prior to 17.4R3; 18.1 versions prior to 18.1R3-S6; 18.2 versions prior to 18.2R3; 18.3 versions prior to 18.3R3; 18.4 versions prior to 18.4R2; 19.1 versions prior to 19.1R2.","2022-01-19",0.0093,{"cveId":74,"description":75,"publishedDate":12,"cvssScore":76,"cvssVersion":22,"severity":42,"isKev":35,"epssScore":77},"CVE-2024-21620","An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in J-Web of Juniper Networks Junos OS on SRX Series and EX Series allows an attacker to construct a URL that when visited by another user enables the attacker to execute commands with the target's permissions, including an administrator.\n\nA specific invocation of the emit_debug_note method in webauth_operation.php will echo back the data it receives.\n\nThis issue affects Juniper Networks Junos OS on SRX Series and EX Series:\n  *  All versions earlier than 20.4R3-S10;\n  *  21.2 versions earlier than 21.2R3-S8;\n  *  21.4 versions earlier than 21.4R3-S6;\n  *  22.1 versions earlier than 22.1R3-S5;\n  *  22.2 versions earlier than 22.2R3-S3;\n  *  22.3 versions earlier than 22.3R3-S2;\n  *  22.4 versions earlier than 22.4R3-S1;\n  *  23.2 versions earlier than 23.2R2;\n  *  23.4 versions earlier than 23.4R2.\n\n\n",8.8,0.00908,[79,84,87],{"cveId":18,"description":19,"publishedDate":20,"cvssScore":21,"severity":23,"isKev":4,"epssScore":24,"cisaVulnName":80,"cisaDateAdded":81,"cisaShortDescription":82,"cisaRequiredAction":83},"Juniper Junos OS EX Series PHP External Variable Modification Vulnerability","2023-11-13","Juniper Junos OS on EX Series contains a PHP external variable modification vulnerability that allows an unauthenticated, network-based attacker to control certain, important environment variables. Using a crafted request an attacker is able to modify certain PHP environment variables, leading to partial loss of integrity, which may allow chaining to other vulnerabilities.","Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",{"cveId":26,"description":27,"publishedDate":20,"cvssScore":21,"severity":23,"isKev":4,"epssScore":28,"cisaVulnName":85,"cisaDateAdded":81,"cisaShortDescription":86,"cisaRequiredAction":83},"Juniper Junos OS EX Series Missing Authentication for Critical Function Vulnerability","Juniper Junos OS on EX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to installAppPackage.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities.",{"cveId":59,"description":60,"publishedDate":61,"cvssScore":21,"severity":23,"isKev":4,"epssScore":62,"cisaVulnName":88,"cisaDateAdded":81,"cisaShortDescription":89,"cisaRequiredAction":83},"Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability","Juniper Junos OS on SRX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to webauth_operation.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities.",{"title":91,"metaDescription":92,"keywords":93,"structuredData":94},"Ex4600-vc by Juniper - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Ex4600-vc by Juniper with 16 tracked vulnerabilities and 3 CISA KEV vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Ex4600-vc vulnerabilities, Ex4600-vc security, Ex4600-vc CVE, Juniper Ex4600-vc, Ex4600-vc threat intelligence, Juniper security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking, Ex4600-vc KEV, Ex4600-vc exploited vulnerabilities",{"@context":95,"@type":96,"name":97,"description":92,"url":98,"manufacturer":99,"applicationCategory":103,"softwareVersion":104,"mainEntity":105},"https:\u002F\u002Fschema.org","SoftwareApplication","Ex4600-vc","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Fjuniper\u002Fex4600-vc",{"@type":100,"name":101,"url":102},"Organization","Juniper","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fjuniper","Security Software","Multiple versions",{"@type":106,"name":107,"description":108,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Ex4600-vc Security Vulnerabilities","Security vulnerabilities affecting Ex4600-vc by Juniper",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":110,"apiVersion":111},"2026-10-17T19:08:50.928Z","3.0",[],{"rows":114,"total":11,"capped":35,"failed":9},[115,119,123],{"cveId":18,"name":80,"severity":23,"cvss":21,"added":81,"epss":24,"published":116,"ranges":117,"checked":4,"hits":118,"covers":35},"2023-08-17T20:15:10.267",[],[],{"cveId":26,"name":85,"severity":23,"cvss":21,"added":81,"epss":28,"published":120,"ranges":121,"checked":4,"hits":122,"covers":35},"2023-08-17T20:15:10.553",[],[],{"cveId":59,"name":88,"severity":23,"cvss":21,"added":81,"epss":62,"published":124,"ranges":125,"checked":4,"hits":126,"covers":35},"2023-09-27T15:18:54.877",[],[]]