Farid Heydari

**Name of the Vulnerable Software and Affected Versions** Junos OS versions 12.3 through 12.3R12-S15 Junos OS versions 12.3X48 through 12.3X48-D85 Junos OS versions 14.1X53 through 14.1X53-D51 Junos OS versions 15.1 through 15.1F6-S13 Junos OS versions 15.1 through 15.1R7-S5 Junos OS versions 15.1X49 through 15.1X49-D180 Junos OS versions 15.1X53 through 15.1X53-D238 Junos OS versions 16.1 through 16.1R4-S13 Junos OS versions 16.1 through 16.1R7-S5 Junos OS versions 16.2 through 16.2R2-S10 Junos OS versions 17.1 through 17.1R3-S1 Junos OS versions 17.2 through 17.2R2-S8 Junos OS versions 17.2 through 17.2R3-S3 Junos OS versions 17.3 through 17.3R3-S5 Junos OS versions 17.4 through 17.4R2-S8 Junos OS versions 17.4 through 17.4R3 Junos OS versions 18.1 through 18.1R3-S8 Junos OS versions 18.2 through 18.2R3 Junos OS versions 18.3 through 18.3R3 Junos OS versions 18.4 through 18.4R2 Junos OS versions 19.1 through 19.1R1-S2 Junos OS versions 19.1 through 19.1R2 **Description** A session fixation issue in J-Web on Junos OS may allow an attacker to use social engineering techniques to fix and hijack a J-Web administrator's web session and potentially gain administrative access to the device. **Recommendations** For Junos OS versions 12.3 through 12.3R12-S15, update to version 12.3R12-S15 or later. For Junos OS versions 12.3X48 through 12.3X48-D85, update to version 12.3X48-D85 or later. For Junos OS versions 14.1X53 through 14.1X53-D51, update to version 14.1X53-D51 or later. For Junos OS versions 15.1 through 15.1F6-S13, update to version 15.1F6-S13 or later. For Junos OS versions 15.1 through 15.1R7-S5, update to version 15.1R7-S5 or later. For Junos OS versions 15.1X49 through 15.1X49-D180, update to version 15.1X49-D180 or later. For Junos OS versions 15.1X53 through 15.1X53-D238, update to version 15.1X53-D238 or later. For Junos OS versions 16.1 through 16.1R4-S13, update to version 16.1R4-S13 or later. For Junos OS versions 16.1 through 16.1R7-S5, update to version 16.1R7-S5 or later. For Junos OS versions 16.2 through 16.2R2-S10, update to version 16.2R2-S10 or later. For Junos OS versions 17.1 through 17.1R3-S1, update to version 17.1R3-S1 or later. For Junos OS versions 17.2 through 17.2R2-S8, update to version 17.2R2-S8 or later. For Junos OS versions 17.2 through 17.2R3-S3, update to version 17.2R3-S3 or later. For Junos OS versions 17.3 through 17.3R3-S5, update to version 17.3R3-S5 or later. For Junos OS versions 17.4 through 17.4R2-S8, update to version 17.4R2-S8 or later. For Junos OS versions 17.4 through 17.4R3, update to version 17.4R3 or later. For Junos OS versions 18.1 through 18.1R3-S8, update to version 18.1R3-S8 or later. For Junos OS versions 18.2 through 18.2R3, update to version 18.2R3 or later. For Junos OS versions 18.3 through 18.3R3, update to version 18.3R3 or later. For Junos OS versions 18.4 through 18.4R2, update to version 18.4R2 or later. For Junos OS versions 19.1 through 19.1R1-S2, update to version 19.1R1-S2 or later. For Junos OS versions 19.1 through 19.1R2, update to version 19.1R2 or later.

**Name of the Vulnerable Software and Affected Versions** Juniper Networks Junos OS versions prior to 12.1X46-D86 Juniper Networks Junos OS 12.3 versions prior to 12.3R12-S13 Juniper Networks Junos OS 12.3X48 versions prior to 12.3X48-D80 Juniper Networks Junos OS 14.1X53 versions prior to 14.1X53-D51 Juniper Networks Junos OS 15.1 versions prior to 15.1F6-S13, 15.1R7-S4 Juniper Networks Junos OS 15.1X49 versions prior to 15.1X49-D171, 15.1X49-D180 Juniper Networks Junos OS 15.1X53 versions prior to 15.1X53-D497, 15.1X53-D69 Juniper Networks Junos OS 16.1 versions prior to 16.1R7-S5 Juniper Networks Junos OS 16.2 versions prior to 16.2R2-S9 Juniper Networks Junos OS 17.1 versions prior to 17.1R3 Juniper Networks Junos OS 17.2 versions prior to 17.2R1-S8, 17.2R2-S7, 17.2R3-S1 Juniper Networks Junos OS 17.3 versions prior to 17.3R3-S6 Juniper Networks Junos OS 17.4 versions prior to 17.4R1-S7, 17.4R2-S4, 17.4R3 Juniper Networks Junos OS 18.1 versions prior to 18.1R3-S5 Juniper Networks Junos OS 18.2 versions prior to 18.2R1-S5, 18.2R2-S3, 18.2R3 Juniper Networks Junos OS 18.3 versions prior to 18.3R1-S3, 18.3R2, 18.3R3 Juniper Networks Junos OS 18.4 versions prior to 18.4R1-S2, 18.4R2 **Description** A persistent Cross-Site Scripting (XSS) vulnerability in the Junos OS J-Web interface may allow remote unauthenticated attackers to perform administrative actions on the Junos device. Successful exploitation requires a Junos administrator to first perform certain diagnostic actions on J-Web. This issue is related to insufficient protection of the web page structure. **Recommendations** For Juniper Networks Junos OS 12.1X46 versions prior to 12.1X46-D86, update to version 12.1X46-D86 or later. For Juniper Networks Junos OS 12.3 versions prior to 12.3R12-S13, update to version 12.3R12-S13 or later. For Juniper Networks Junos OS 12.3X48 versions prior to 12.3X48-D80, update to version 12.3X48-D80 or later. For Juniper Networks Junos OS 14.1X53 versions prior to 14.1X53-D51, update to version 14.1X53-D51 or later. For Juniper Networks Junos OS 15.1 versions prior to 15.1F6-S13, 15.1R7-S4, update to version 15.1F6-S13 or 15.1R7-S4 or later. For Juniper Networks Junos OS 15.1X49 versions prior to 15.1X49-D171, 15.1X49-D180, update to version 15.1X49-D171 or 15.1X49-D180 or later. For Juniper Networks Junos OS 15.1X53 versions prior to 15.1X53-D497, 15.1X53-D69, update to version 15.1X53-D497 or 15.1X53-D69 or later. For Juniper Networks Junos OS 16.1 versions prior to 16.1R7-S5, update to version 16.1R7-S5 or later. For Juniper Networks Junos OS 16.2 versions prior to 16.2R2-S9, update to version 16.2R2-S9 or later. For Juniper Networks Junos OS 17.1 versions prior to 17.1R3, update to version 17.1R3 or later. For Juniper Networks Junos OS 17.2 versions prior to 17.2R1-S8, 17.2R2-S7, 17.2R3-S1, update to version 17.2R1-S8 or 17.2R2-S7 or 17.2R3-S1 or later. For Juniper Networks Junos OS 17.3 versions prior to 17.3R3-S6, update to version 17.3R3-S6 or later. For Juniper Networks Junos OS 17.4 versions prior to 17.4R1-S7, 17.4R2-S4, 17.4R3, update to version 17.4R1-S7 or 17.4R2-S4 or 17.4R3 or later. For Juniper Networks Junos OS 18.1 versions prior to 18.1R3-S5, update to version 18.1R3-S5 or later. For Juniper Networks Junos OS 18.2 versions prior to 18.2R1-S5, 18.2R2-S3, 18.2R3, update to version 18.2R1-S5 or 18.2R2-S3 or 18.2R3 or later. For Juniper Networks Junos OS 18.3 versions prior to 18.3R1-S3, 18.3R2, 18.3R3, update to version 18.3R1-S3 or 18.3R2 or 18.3R3 or later. For Juniper Networks Junos OS 18.4 versions prior to 18.4R1-S2, 18.4R2, update to version 18.4R1-S2 or 18.4R2 or later.

**Name of the Vulnerable Software and Affected Versions** Cisco Adaptive Security Appliance (ASA) Software (affected versions not specified) **Description** A vulnerability in the web-based management interface of Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to insufficient CSRF protections for the web-based management interface on an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious link. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the affected user. If the user has administrative privileges, the attacker could alter the configuration of, extract information from, or reload an affected device. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.