[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fuEae8ILY09eVVBxT-p2HsUip7je7DuqIyXIhFfCIZjg":3,"g5a-family:juniper\u002Fex9250":110,"g5a-ex:juniper\u002Fex9250@*":111},{"success":4,"data":5},true,{"product":6,"versions":15,"topVulnerabilitiesByEpss":16,"kevVulnerabilities":76,"seoMetadata":88,"meta":107},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":14},"juniper","ex9250",0,22,3,"2024-01-25",[],"Ex9250 by Juniper is a technology product and 22 known security vulnerabilities including 3 CISA Known Exploited Vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[],[17,25,29,37,44,51,56,61,67,72],{"cveId":18,"description":19,"publishedDate":20,"cvssScore":21,"cvssVersion":22,"severity":23,"isKev":4,"epssScore":24},"CVE-2023-36844","A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to control certain, important environment variables.\n\nUsing a crafted request an attacker is able to modify \n\ncertain PHP environment variables leading to partial loss of integrity, which may allow chaining to other vulnerabilities.\nThis issue affects Juniper Networks Junos OS on EX Series:\n\n\n\n  *  All versions prior to 20.4R3-S9;\n  *  21.1 versions 21.1R1 and later;\n  *  21.2 versions prior to 21.2R3-S7;\n  *  21.3 versions \n\nprior to \n\n 21.3R3-S5;\n  *  21.4 versions \n\nprior to \n\n21.4R3-S5;\n  *  22.1 versions \n\nprior to \n\n22.1R3-S4;\n  *  22.2 versions \n\nprior to \n\n22.2R3-S2;\n  *  22.3 versions \n\nprior to 22.3R3-S1;\n  *  22.4 versions \n\nprior to \n\n22.4R2-S2, 22.4R3;\n  *  23.2 versions prior to \n\n23.2R1-S1, 23.2R2.","2023-08-17",5.3,"v3.1","Medium",0.89958,{"cveId":26,"description":27,"publishedDate":20,"cvssScore":21,"cvssVersion":22,"severity":23,"isKev":4,"epssScore":28},"CVE-2023-36847","A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity.\n\n\n\n\n\nWith a specific request to installAppPackage.php that doesn't require authentication an attacker is able to upload arbitrary files via J-Web, leading to a loss of \n\nintegrity\n\nfor a certain \n\npart of the file system, which may allow chaining to other vulnerabilities.\n\n\nThis issue affects Juniper Networks Junos OS on EX Series:\n\n\n\n  *  All versions prior to 20.4R3-S8;\n  *  21.1 versions 21.1R1 and later;\n  *  21.2 versions prior to 21.2R3-S6;\n  *  21.3 versions \n\nprior to \n\n 21.3R3-S5;\n  *  21.4 versions \n\nprior to \n\n21.4R3-S4;\n  *  22.1 versions \n\nprior to \n\n22.1R3-S3;\n  *  22.2 versions \n\nprior to \n\n22.2R3-S1;\n  *  22.3 versions \n\nprior to \n\n22.3R2-S2, 22.3R3;\n  *  22.4 versions \n\nprior to \n\n22.4R2-S1, 22.4R3.\n\n\n\n\n",0.83455,{"cveId":30,"description":31,"publishedDate":32,"cvssScore":33,"cvssVersion":34,"severity":23,"isKev":35,"epssScore":36},"CVE-2014-9708","Embedthis Appweb before 4.6.6 and 5.x before 5.2.1 allows remote attackers to cause a denial of service (NULL pointer dereference) via a Range header with an empty value, as demonstrated by \"Range: x=,\".","2015-03-31",5,"v2",false,0.56191,{"cveId":38,"description":39,"publishedDate":40,"cvssScore":41,"cvssVersion":22,"severity":42,"isKev":35,"epssScore":43},"CVE-2018-15504","An issue was discovered in Embedthis GoAhead before 4.0.1 and Appweb before 7.0.2. The server mishandles some HTTP request fields associated with time, which results in a NULL pointer dereference, as demonstrated by If-Modified-Since or If-Unmodified-Since with a month greater than 11.","2018-08-18",7.5,"High",0.02766,{"cveId":45,"description":46,"publishedDate":47,"cvssScore":48,"cvssVersion":22,"severity":49,"isKev":35,"epssScore":50},"CVE-2021-0211","An improper check for unusual or exceptional conditions in Juniper Networks Junos OS and Junos OS Evolved Routing Protocol Daemon (RPD) service allows an attacker to send a valid BGP FlowSpec message thereby causing an unexpected change in the route advertisements within the BGP FlowSpec domain leading to disruptions in network traffic causing a Denial of Service (DoS) condition. Continued receipt of these update messages will cause a sustained Denial of Service condition. This issue affects Juniper Networks: Junos OS: All versions prior to 17.3R3-S10 with the exceptions of 15.1X49-D240 on SRX Series and 15.1R7-S8 on EX Series; 17.3 versions prior to 17.3R3-S10; 17.4 versions prior to 17.4R2-S12, 17.4R3-S4; 18.1 versions prior to 18.1R3-S12; 18.2 versions prior to 18.2R2-S8, 18.2R3-S6; 18.3 versions prior to 18.3R3-S4; 18.4 versions prior to 18.4R1-S8, 18.4R2-S6, 18.4R3-S6; 19.1 versions prior to 19.1R1-S6, 19.1R2-S2, 19.1R3-S3; 19.2 versions prior to 19.2R3-S1; 19.3 versions prior to 19.3R2-S5, 19.3R3-S1; 19.4 versions prior to 19.4R1-S3, 19.4R2-S3, 19.4R3; 20.1 versions prior to 20.1R2; 20.2 versions prior to 20.2R1-S3 20.2R2; 20.3 versions prior to 20.3R1-S1, 20.3R2. Junos OS Evolved: All versions prior to 20.3R1-S1-EVO, 20.3R2-EVO.","2021-01-15",10,"Critical",0.01333,{"cveId":52,"description":53,"publishedDate":54,"cvssScore":41,"cvssVersion":22,"severity":42,"isKev":35,"epssScore":55},"CVE-2019-0043","In MPLS environments, receipt of a specific SNMP packet may cause the routing protocol daemon (RPD) process to crash and restart. By continuously sending a specially crafted SNMP packet, an attacker can repetitively crash the RPD process causing prolonged denial of service. No other Juniper Networks products or platforms are affected by this issue. Affected releases are Juniper Networks Junos OS : 12.1X46 versions prior to 12.1X46-D77 on SRX Series; 12.3 versions prior to 12.3R12-S10; 12.3X48 versions prior to 12.3X48-D75 on SRX Series; 14.1X53 versions prior to 14.1X53-D48 on EX\u002FQFX series; 15.1 versions prior to 15.1R4-S9, 15.1R7-S2; 15.1F6 versions prior to 15.1F6-S11; 15.1X49 versions prior to 15.1X49-D141, 15.1X49-D144, 15.1X49-D150 on SRX Series; 15.1X53 versions prior to 15.1X53-D234 on QFX5200\u002FQFX5110 Series; 15.1X53 versions prior to 15.1X53-D68 on QFX10K Series; 15.1X53 versions prior to 15.1X53-D471, 15.1X53-D490 on NFX Series; 15.1X53 versions prior to 15.1X53-D590 on EX2300\u002FEX3400 Series; 15.1X54 on ACX Series; 16.1 versions prior to 16.1R3-S10, 16.1R4-S11, 16.1R6-S5, 16.1R7; 16.1X65 versions prior to 16.1X65-D48; 16.2 versions prior to 16.2R2-S6; 17.1 versions prior to 17.1R2-S8, 17.1R3; 17.2 versions prior to 17.2R1-S7, 17.2R3; 17.2X75 versions prior to 17.2X75-D92, 17.2X75-D102, 17.2X75-D110; 17.3 versions prior to 17.3R3; 17.4 versions prior to 17.4R1-S4, 17.4R2; 18.1 versions prior to 18.1R1-S1, 18.1R2-S1, 18.1R3; 18.2X75 versions prior to 18.2X75-D10.","2019-04-10",0.01332,{"cveId":57,"description":58,"publishedDate":59,"cvssScore":41,"cvssVersion":22,"severity":42,"isKev":35,"epssScore":60},"CVE-2020-1613","A vulnerability in the BGP FlowSpec implementation may cause a Juniper Networks Junos OS device to terminate an established BGP session upon receiving a specific BGP FlowSpec advertisement. The BGP NOTIFICATION message that terminates an established BGP session is sent toward the peer device that originally sent the specific BGP FlowSpec advertisement. This specific BGP FlowSpec advertisement received from a BGP peer might get propagated from a Junos OS device running the fixed release to another device that is vulnerable causing BGP session termination downstream. This issue affects IPv4 and IPv6 BGP FlowSpec deployment. This issue affects Juniper Networks Junos OS: 12.3; 12.3X48 on SRX Series; 14.1X53 on EX and QFX Series; 15.1 versions prior to 15.1R7-S5; 15.1F versions prior to 15.1F6-S13; 15.1X49 versions prior to 15.1X49-D180 on SRX Series; 15.1X53 versions prior to 15.1X53-D238 on QFX5200\u002FQFX5110; 15.1X53 versions prior to 15.1X53-D497 on NFX Series; 15.1X53 versions prior to 15.1X53-D592 on EX2300\u002FEX3400; 16.1 versions prior to 16.1R7-S7; 17.1 versions prior to 17.1R2-S12, 17.1R3; 17.2 versions prior to 17.2R2-S7, 17.2R3; 17.2X75 versions prior to 17.2X75-D102, 17.2X75-D110, 17.2X75-D44; 17.3 versions prior to 17.3R2-S5, 17.3R3-S5; 17.4 versions prior to 17.4R1-S8, 17.4R2; 18.1 versions prior to 18.1R2-S4, 18.1R3; 18.2X75 versions prior to 18.2X75-D20.","2020-04-08",0.0132,{"cveId":62,"description":63,"publishedDate":64,"cvssScore":65,"cvssVersion":22,"severity":42,"isKev":35,"epssScore":66},"CVE-2021-0275","A Cross-site Scripting (XSS) vulnerability in J-Web on Juniper Networks Junos OS allows an attacker to target another user's session thereby gaining access to the users session. The other user session must be active for the attack to succeed. Once successful, the attacker has the same privileges as the user. If the user has root privileges, the attacker may be able to gain full control of the device. This issue affects: Juniper Networks Junos OS: 12.3 versions prior to 12.3R12-S15 on EX Series; 12.3X48 versions prior to 12.3X48-D95 on SRX Series; 15.1 versions prior to 15.1R7-S6 on EX Series; 15.1X49 versions prior to 15.1X49-D200 on SRX Series; 16.1 versions prior to 16.1R7-S7; 16.2 versions prior to 16.2R2-S11, 16.2R3; 17.1 versions prior to 17.1R2-S11, 17.1R3-S2; 17.2 versions prior to 17.2R3-S3; 17.3 versions prior to 17.3R2-S5, 17.3R3-S7; 17.4 versions prior to 17.4R2-S9, 17.4R3; 18.1 versions prior to 18.1R3-S9; 18.2 versions prior to 18.2R2-S7, 18.2R3-S3; 18.3 versions prior to 18.3R1-S7, 18.3R2-S3, 18.3R3-S1; 18.4 versions prior to 18.4R1-S6, 18.4R2-S4, 18.4R3; 19.1 versions prior to 19.1R2-S1, 19.1R3; 19.2 versions prior to 19.2R1-S3, 19.2R2; 19.3 versions prior to 19.3R2.","2021-04-22",8.8,0.01171,{"cveId":68,"description":69,"publishedDate":70,"cvssScore":21,"cvssVersion":22,"severity":23,"isKev":4,"epssScore":71},"CVE-2023-36851","A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity.\n\n\n\nWith a specific request to \n\nwebauth_operation.php\n\nthat doesn't require authentication, an attacker is able to upload and download arbitrary files via J-Web, leading to a loss of \n\nintegrity or confidentiality, which may allow chaining to other vulnerabilities.\n\n\nThis issue affects Juniper Networks Junos OS on SRX Series:\n\n\n\n  *  \n\n21.2 versions prior to 21.2R3-S8;\n  *  21.4 \n\nversions prior to \n\n21.4R3-S6;\n  *  22.1 \n\nversions prior to \n\n22.1R3-S5;\n  *  22.2 \n\nversions prior to \n\n22.2R3-S3;\n  *  22.3 \n\nversions prior to \n\n22.3R3-S2;\n  *  22.4 versions prior to 22,4R2-S2, 22.4R3;\n  *  23.2 versions prior to \n\n23.2R1-S2, 23.2R2.\n\n\n","2023-09-27",0.01123,{"cveId":73,"description":74,"publishedDate":64,"cvssScore":41,"cvssVersion":22,"severity":42,"isKev":35,"epssScore":75},"CVE-2021-0261","A vulnerability in the HTTP\u002FHTTPS service used by J-Web, Web Authentication, Dynamic-VPN (DVPN), Firewall Authentication Pass-Through with Web-Redirect, and Captive Portal allows an unauthenticated attacker to cause an extended Denial of Service (DoS) for these services by sending a high number of specific requests. This issue affects: Juniper Networks Junos OS 12.3 versions prior to 12.3R12-S17 on EX Series; 12.3X48 versions prior to 12.3X48-D105 on SRX Series; 15.1 versions prior to 15.1R7-S8; 15.1X49 versions prior to 15.1X49-D230 on SRX Series; 16.1 versions prior to 16.1R7-S8; 17.4 versions prior to 17.4R2-S12, 17.4R3-S3; 18.1 versions prior to 18.1R3-S11; 18.2 versions prior to 18.2R3-S6; 18.3 versions prior to 18.3R2-S4, 18.3R3-S3; 18.4 versions prior to 18.4R2-S5, 18.4R3-S4; 19.1 versions prior to 19.1R2-S2, 19.1R3-S2; 19.2 versions prior to 19.2R1-S5, 19.2R3; 19.3 versions prior to 19.3R2-S4, 19.3R3; 19.4 versions prior to 19.4R1-S3, 19.4R2-S2, 19.4R3; 20.1 versions prior to 20.1R1-S3, 20.1R2; 20.2 versions prior to 20.2R1-S1, 20.2R2.",0.01113,[77,82,85],{"cveId":18,"description":19,"publishedDate":20,"cvssScore":21,"severity":23,"isKev":4,"epssScore":24,"cisaVulnName":78,"cisaDateAdded":79,"cisaShortDescription":80,"cisaRequiredAction":81},"Juniper Junos OS EX Series PHP External Variable Modification Vulnerability","2023-11-13","Juniper Junos OS on EX Series contains a PHP external variable modification vulnerability that allows an unauthenticated, network-based attacker to control certain, important environment variables. Using a crafted request an attacker is able to modify certain PHP environment variables, leading to partial loss of integrity, which may allow chaining to other vulnerabilities.","Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",{"cveId":26,"description":27,"publishedDate":20,"cvssScore":21,"severity":23,"isKev":4,"epssScore":28,"cisaVulnName":83,"cisaDateAdded":79,"cisaShortDescription":84,"cisaRequiredAction":81},"Juniper Junos OS EX Series Missing Authentication for Critical Function Vulnerability","Juniper Junos OS on EX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to installAppPackage.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities.",{"cveId":68,"description":69,"publishedDate":70,"cvssScore":21,"severity":23,"isKev":4,"epssScore":71,"cisaVulnName":86,"cisaDateAdded":79,"cisaShortDescription":87,"cisaRequiredAction":81},"Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability","Juniper Junos OS on SRX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to webauth_operation.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities.",{"title":89,"metaDescription":90,"keywords":91,"structuredData":92},"Ex9250 by Juniper - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Ex9250 by Juniper with 22 tracked vulnerabilities and 3 CISA KEV vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Ex9250 vulnerabilities, Ex9250 security, Ex9250 CVE, Juniper Ex9250, Ex9250 threat intelligence, Juniper security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking, Ex9250 KEV, Ex9250 exploited vulnerabilities",{"@context":93,"@type":94,"name":95,"description":90,"url":96,"manufacturer":97,"applicationCategory":101,"softwareVersion":102,"mainEntity":103},"https:\u002F\u002Fschema.org","SoftwareApplication","Ex9250","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Fjuniper\u002Fex9250",{"@type":98,"name":99,"url":100},"Organization","Juniper","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fjuniper","Security Software","Multiple versions",{"@type":104,"name":105,"description":106,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Ex9250 Security Vulnerabilities","Security vulnerabilities affecting Ex9250 by Juniper",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":108,"apiVersion":109},"2026-10-18T16:39:28.157Z","3.0",[],{"rows":112,"total":11,"capped":35,"failed":9},[113,117,121],{"cveId":18,"name":78,"severity":23,"cvss":21,"added":79,"epss":24,"published":114,"ranges":115,"checked":4,"hits":116,"covers":35},"2023-08-17T20:15:10.267",[],[],{"cveId":26,"name":83,"severity":23,"cvss":21,"added":79,"epss":28,"published":118,"ranges":119,"checked":4,"hits":120,"covers":35},"2023-08-17T20:15:10.553",[],[],{"cveId":68,"name":86,"severity":23,"cvss":21,"added":79,"epss":71,"published":122,"ranges":123,"checked":4,"hits":124,"covers":35},"2023-09-27T15:18:54.877",[],[]]