The version of Junos OS installed on the remote host is prior to 16.1R7-S3, 16.2R2-S9, 17.1R3, 17.2R3, 17.2X75-D105, 17.3R3-S2, 17.4R1-S7, 18.1R3-S2, 18.2R2, 18.2X75-D12, or 18.3R1-S4. It is, therefore, affected by a denial of service (DoS) vulnerability which exists in Junos devices with the BGP graceful restart helper mode enabled or the BGP graceful restart mechanism enabled due to a certain sequence of BGP session restart on a remote peer that has the graceful restart mechanism enabled which may cause the local routing protocol daemon (RPD) process to crash and restart. An unauthenticated, local attacker can exploit this issue, via a certain sequence of BGP session restart, to cause a repeated crashes of the RPD process which can cause prolonged Denial of Service (DoS) as referenced in the JSA10943 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Junos OS installed on the remote host is prior to 17.1R3, 17.2R3, 17.3R3-S2, 17.4R2, 18.1R3, or 18.2R2.
It is, therefore, affected by a vulnerability as referenced in the JSA10938 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of the tested product installed on the remote host is prior to the fixed version in the advisory. It is, therefore, affected by a denial of service vulnerability that exists in RPD daemon. An unauthenticated, remote attacker can exploit this issue, by continuously sending a specific Draft-Rosen MVPN control packet, to repeatedly crash the RPD process causing a prolonged denial of service as referenced in the JSA10879 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the version of Junos Space running on the remote device is < 17.2R2, and is therefore affected by a persistent cross-site scripting vulnerability in the UI framework used by Junos Space Security Director. A remote authenticated attacker can exploit that to inject persistent and malicious scripts, steal information or perform actions.

The version of Junos OS installed on the remote host is prior to 12.3X48-D85, 15.1X49-D181, 17.4R1-S8, 18.1R3-S6, 18.2R2-S1, 18.3R1-S2, or 18.4R1-S1. It is, therefore, affected by a vulnerability as referenced in the JSA10946 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the version of Junos Space running on the remote device is < 18.2R1, and is therefore affected by multiple vulnerabilities:

  - Due to untrusted search path vulnerability in ssh-agent.c in ssh-agent     in OpenSSH before 7.4, unauthenticated, remote attacker can execute execute     arbitrary local PKCS#11 modules by leveraging control over a forwarded     agent-socket. (CVE-2016-10009)    
  - In OpenSSH before 7.4, an authenticated local attacker can escalate     privileges via unspecified vectors, related to serverloop.c.     (CVE-2016-10010)     
  - authfile.c in sshd in OpenSSH before 7.4 does not properly consider the     effects of realloc on buffer contents. an authenticated local attacker     can obtain sensitive private-key information by leveraging access to a     privilege-separated child process. (CVE-2016-10011)     
  - In sshd in OpenSSH before 7.4, a local attacker can gain privileges by     leveraging access to a sandboxed privilege-separation process due to a     bounds check that's enforced by all by the shared memory manager.     (CVE-2016-10012)     
  - The process_open function in sftp-server.c in OpenSSH before 7.6 does not     properly prevent write operations in readonly mode, which allows local     attackers to create zero-length files. (CVE-2017-15906)     
  - A reflected cross-site scripting vulnerability in OpenNMS included     with Juniper Networks Junos Space may allow the stealing of sensitive     information or session credentials from Junos Space administrators or     perform administrative actions.  (CVE-2018-0046)

According to its self-reported version number, the remote Juniper Junos device is affected by a vulnerability. With an insecure SSHD configuration in Juniper Device Manager, a remote, unauthenticated attacker can gain access if any of the passwords on the system are empty. The affected SSHD configuration has the PermitEmptyPasswords option set to 'yes'.

The version of tested product installed on the remote host is 18.2 prior to 18.2R1-S2, 18.2R2 on an EX4300-MP Series device with any lo0 filters applied. It is, therefore, affected by a vulnerability. The transit network traffic may reach the control plane via loopback interface (lo0). The device may fail to forward such traffic as referenced in the JSA10933 advisory.
Note that Nessus has not tested for this issue but has instead relied only  on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by a denial of service vulnerability in the Junos OS device configured as a DHCP server in a Broadband Edge (BBE) environment. A remote attacker can exploit it via sending a continuous, specially crafted DHCPv6 message which can result in a repeatedly jdhcpd daemon crash which lead to a denial of service condition as referenced in the JSA10889 advisory.
Note that Nessus has not tested for this issue but has instead relied only  on the application's self-reported version number.

The version of tested product installed on the remote host is 12.3 prior to 12.3R12-S12, 12.3X48 prior to 12.3X48-D76, 14.1X53 prior to 14.1X53-D48, 15.1 prior to 15.1R5, 15.1X49 prior to 15.1X49-D151, 15.1 prior to 15.1F6-S12 or 16.1 prior to 16.1R2. It is, therefore, affected by a denial of service (DoS) vulnerability. An unauthenticated, remote attacker can exploit this issue, via a crafted XML data input, to cause the system to stop responding and potentially with other possible unspecified impacts as referenced in the JSA10904 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the JSA10928 advisory. 

If REST API is enabled, the Junos OS login credentials are vulnerable to brute force attacks. The high default connection limit of the REST API may allow an attacker to brute-force passwords using advanced scripting techniques.
Additionally, administrators who do not enforce a strong password policy can increase the likelihood of success from brute force attacks.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the JSA10929 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self- reported version number.

The version of tested product installed on the remote host is 12.1X46 prior to 12.1X46-D82, 12.3X48 prior to 12.3X48-D80 or 15.1X49 prior to 15.1X49-D160. It is, therefore, affected by a vulnerability as referenced in the JSA10936 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by a stack based overflow vulnerability in the Junos OS Packet Forwarding Engine manager (FXPC) process on QFX5000 series. A remote attacker can exploit it which can lead to a remote code execution  as referenced in the JSA10930 advisory.
Note that Nessus has not tested for this issue but has instead relied only  on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability On Junos devices with the BGP graceful restart helper mode enabled or the BGP graceful restart mechanism enabled. A remote attacker can exploit this by simulating a specific BGP session restart to cause a denial of service as referenced in the JSA10932 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the remote Juniper Junos device is affected by a denial of service vulnerability in the jdhcpd daemon due to failure to handle exceptional conditions. An unauthenticated, remote attacker can exploit this, via sending specific IPv6 DHCP packets to the jdhcpd daemon to cause a denial of service condition to clients requesting and not receiving IP addresses.

According to its self-reported version number, the remote Juniper Junos device is affected by a denial of service vulnerability in the management interface due to buffer space exhaustion. An unauthenticated, adjacent attacker can exploit this issue, via crafted packets destined to the management interface (fxp0) to cause the service to stop responding.

According to its self-reported version number, the remote Juniper Junos device is affected by a denial of service vulnerability in the jdhcpd daemon due to failure to handle exceptional conditions. An unauthenticated, remote attacker can exploit this, via continuously sending a certain DHCPv6 solicit message to the jdhcpd daemon to cause the jdhcpd process to stop responding.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the JSA10931 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self- reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the JSA10922 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self- reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the JSA10925 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self- reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the JSA10935 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self- reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the JSA10924 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self- reported version number.

According to its self-reported version number, the remote Juniper Junos device is affected by a vulnerability. When a specific BGP flowspec configuration is enabled and upon receipt of a specific matching BGP packet meeting a specific term in the flowspec configuration, a reachable assertion failure occurs, causing the routing protocol daemon (rpd) process to crash with a core file being generated.

According to its self-reported version number, the remote Juniper Junos device is affected by a vulnerability which may allow IPv6 packets that should have been blocked to be forwarded.

According to its self-reported version number, the remote Juniper Junos device is affected by a denial of service vulnerability. An SRX Series Service Gateway configured for Unified Threat Management (UTM) may experience a denial of service due to the receipt of crafted HTTP traffic.

According to its self-reported version number, the remote Juniper Junos device is affected by a vulnerability that allows deleted dynamic VPN users to establish dynamic VPN connections until the device is rebooted.

Receipt of a malformed packet on MX Series devices with dynamic   vlan configuration can trigger an uncontrolled recursion loop in   the Broadband Edge subscriber management daemon (bbe-smgd),   and lead to high CPU usage and a crash of the bbe-smgd service.   Repeated receipt of the same packet can result in an extended denial of service condition for the device.

According to its self-reported version number, the remote Juniper Junos device is affected by a vulnerability in which high disk I/O operations may disrupt the communication between the routing engine (RE) and the packet forwarding engine (PFE).

According to its self-reported version number, the remote Juniper Junos device is affected by a vulnerability in which stateless firewall filter configuration that uses the action 'policer' in combination with other actions might not take effect.

According to its self-reported version number, the remote Juniper Junos device is affected by a denial of service vulnerability. The routing protocol daemon (RPD) process will crash and restart when a specific invalid IPv4 PIM Join packet is received. While RPD restarts after a crash, repeated crashes can result in an extended denial of service (DoS) condition.

According to its self-reported version number, the remote Juniper Junos device is affected by a denial of service vulnerability. The Junos OS kernel crashes after processing a specific incoming packet to the out of band management interface (such as fxp0, me0, em0, vme0) destined for another address.

By continuously sending this type of packet, an attacker can repeatedly crash the kernel causing a sustained Denial of Service.

According to its self-reported version number, the remote Junos device uses a predictable IP ID sequence number. It is, therefore, vulnerable to a family of attacks that rely on this property, including a susceptibility to being used as a 'zombie' host in an 'idle scan' blind port scan of another remote host.

According to its self-reported version number, the remote Juniper Junos device is affected by a denial of service vulnerability. By continuously sending the offending packet, an attacker can repeatedly crash the FPC process causing a sustained Denial of Service (DoS).
This issue affects both IPv4 and IPv6 packet processing.

According to its self-reported version number, the remote Juniper Junos device is affected by a denial of service vulnerability which allows an attacker to craft a specific BGP message to cause the routing protocol daemon (rpd) process to crash and restart. While rpd restarts after a crash, repeated crashes can result in an extended DoS condition.

According to its self-reported version number, the remote Juniper Junos device is affected by a Multiple vulnerabilities in libxml2:

- Format string vulnerability in libxml2 before 2.9.4 allows   attackers to have unspecified impact via format string   specifiers in unknown vectors.(CVE-2016-4448)   
- The xmlStringGetNodeList function in tree.c in libxml2 2.9.3 and   earlier, when used in recovery mode, allows context-dependent   attackers to cause a denial of service (infinite recursion, stack   consumption, and application crash) via a crafted XML document.   (CVE-2016-3627)

According to its self-reported version number, the remote Juniper Junos device is affected by a multiple vulnerabilities:

- During key agreement in a TLS handshake using a DH(E) based   ciphersuite a malicious server can send a very large prime value to   the client. This will cause the client to spend an unreasonably   long period of time generating a key for this prime resulting in a   hang until the client has finished. This could be exploited in a   Denial Of Service attack. Fixed in OpenSSL 1.1.0i-dev (Affected   1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2-1.0.2o).
  (CVE-2018-0732)   
- The OpenSSL RSA Key generation algorithm has been shown to be   vulnerable to a cache timing side channel attack. An attacker with   sufficient access to mount cache timing attacks during the RSA key   generation process could recover the private key. Fixed in OpenSSL   1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev   (Affected 1.0.2b-1.0.2o). (CVE-2018-0737)

According to its self-reported version number, the remote Junos Space version is 18.4.x prior to 18.4R1. It is, therefore, affected by multiple vulnerabilities : 

  - An integer overflow issue exists in procps-ng. This is     related to CVE-2018-1124. (CVE-2018-1126)

  - A directory traversal issue exits in reposync, a part     of yum-utils.tory configuration files. If an attacker     controls a repository, they may be able to copy files     outside of the destination directory on the targeted     system via path traversal. (CVE-2018-10897)

  - An integer overflow flaw was found in the Linux     kernel's create_elf_tables() function. An unprivileged     local user with access to SUID binary could use this     flaw to escalate their privileges on the system.
    (CVE-2018-14634)

Additionally, Junos Space is affected by several other vulnerabilities exist as noted in the vendor advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the remote Junos Space version is prior to 18.3R1. It is, therefore, affected by multiple vulnerabilities:

  - A use after free vulnerability exists in the    do_get_mempolicy function. An local attacker can exploit    this to cause a denial of service condition.
   (CVE-2018-10675)

  - A malicious authenticated user may be able to delete a     device from the Junos Space database without the     privileges through crafted Ajax interactions from     another legitimate delete action performed by an     administrative user. (CVE-2019-0016)

  - A flaw in validity checking of image files uploaded     to Junos Space could allow an attacker to upload     malicious scripts or images. (CVE-2019-0017)

Additionally, Junos Space is affected by several other vulnerabilities exist as noted in the vendor advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the remote Junos device is affected by a potential remote code execution vulnerability due to how the Packet Forwarding Engine manager (FXPC) handles HTTP packets.
An attacker could potentially crash the fxpc daemon or execute code.

According to its self-reported version number, the remote Junos device is affected by a denial of service vulnerability due to a flaw with the Routing Protocols Daemon with Juniper Extension Toolkit support. A remote attacker could exhaust memory resources potentially causing the device to become unavailable.

According to its self-reported version number, the remote Junos device is affected by a potential remote code execution vulnerability due to how the routing protocol daemon handles MPLS packets. An attacker could potentially crash the RDP service or execute code.

According to its self-reported version number, the remote Junos device is affected by a denial of service vulnerability.

According to its self-reported version number, the remote Junos device is affected by a firewall deactivation on reboot vulnerability.

According to its self-reported version number, the remote Junos device is affected by a remote information disclosure vulnerability.

According to its self-reported version number, the remote Junos device is affected by a privilege escalation vulnerability.

According to its self-reported version number, the remote Junos device is affected by man-in-the-middle spoofing vulnerability.

According to its self-reported version number, the remote Junos device is affected by a remote denial of service vulnerability.

According to its self-reported version number and configuration, the remote Juniper Junos device is affected by an unspecified flaw in the SNMP MIB-II subagent daemon, mib2d, that allows a remote attacker to cause the daemon to crash, resulting in a denial of service for the SNMP subsystem. No further details have been provided.

Note: This issue only affects systems with SNMP mib2d enabled.
SNMP is disabled by default on devices running Junos OS.

ID	Name	Severity
127122	Juniper JSA10943	Medium
127056	Juniper JSA10938	Medium
126925	Juniper JSA10879	Medium
126917	Juniper Junos Space < 17.2R2 Persistent XSS Vulnerability (JSA10881)	Low
126785	Juniper JSA10946	High
126510	Juniper Junos Space < 18.2R1 Multiple Vulnerabilities (JSA10880)	High
126508	NFX Series: Insecure sshd configuration in Juniper Device Manager (JDM) and host OS (JSA10878)	Medium
125774	Juniper JSA10933	Medium
125773	Juniper JSA10889	Low
125546	Juniper JSA10904	Medium
125309	Juniper JSA10928	Medium
124765	Juniper JSA10929	Medium
124760	Juniper JSA10936	Medium
124327	Juniper JSA10930	High
124238	Juniper JSA10932	Medium
124236	Juniper Junos memory consumption denial of service (JSA10920)	Medium
124195	Juniper Junos SRX crafted packets destined to fxp0 denial of service (JSA10927)	Medium
124193	Juniper Junos jdhcpd crash denial of service (JSA10926)	Medium
124092	Juniper JSA10931 BGP Tracing DoS	Medium
124091	Juniper JSA10922	Medium
124031	Juniper JSA10925	High
124030	Juniper JSA10935	Medium
124003	Juniper JSA10924	Medium
122242	Junos OS: Multiple vulnerabilities in libxml2 (JSA10902)	High
122241	Junos OS: Stateless firewall filter ignores IPv6 extension headers (JSA10905)	Medium
121644	Junos OS: Crafted HTTP traffic may cause UTM to consume all mbufs, leading to Denial of Service (JSA10910)	Medium
121643	Junos OS: Deleted dynamic VPN users are allowed to establish VPN connections until reboot (JSA10915)	Medium
121642	Juniper Junos MX Malformed Packet - DOS (JSA10900)	High
121390	Junos OS: EX2300 and EX3400 series: High disk I/O operations may disrupt the communication between RE and PFE (JSA10909)	Medium
121389	Junos OS: EX2300 and EX3400 series: Certain stateless firewall filter rules might not take effect (JSA10901)	High
121354	Junos OS: RPD crash upon receipt of malformed PIM packet (JSA10913)	Medium
121215	Junos OS: Kernel crash after processing specific incoming packet to the out of band management interface (JSA10911)	Low
121129	Juniper Junos vMX Predictable IP ID Sequence Numbers (JSA10903)	High
121126	Junos OS: FPC process crashes after J-Flow processes a malformed packet (JSA10914)	Medium
121111	Junos OS: pd crash on VPLS PE upon receipt of specific BGP message (JSA10912)	Medium
121070	Junos OS: Multiple vulnerabilities in libxml2 (JSA10916)	Critical
121069	Junos OS: OpenSSL Security Advisories [16 Apr 2018] and [12 June 2018] (JSA10919)	Medium
121068	Juniper Junos Space 18.4.x < 18.4R1 Multiple Vulnerabilities (JSA10917)	High
121067	Juniper Junos Space < 18.3R1 Multiple Vulnerabilities (JSA10917)	High
121066	Juniper Junos Packet Forwarding Engine Potential RCE (JSA10906)	Critical
118232	Juniper Junos Memory Exhaustion RDP DOS with JET support (JSA10882)	High
118231	Juniper Junos RPD MPLS RCE (JSA10877)	High
111207	Juniper Junos Malformed RSVP RPD DoS (JSA10861)	High
111206	Juniper Junos Security Bypass Stateless Firewall Deactivation (JSA10859)	Medium
111205	Juniper Junos HTTP/HTTPS Firewall User Authentication Remote Information Disclosure (JSA10858)	Medium
111204	Juniper Junos Privilege Escalation (JSA10857)	High
109216	Juniper Junos VPLS Routing MPLS Packet Handling mbuf Exhaustion Remote DoS (JSA10855)	High
109215	Juniper Junos Short MacSec Keys Configuration CKN / CAK Key Extension Brute-force Mitm Spoofing (JSA10854)	Medium
109214	Juniper Junos Routing Process Daemon (RPD) BGP UPDATE Packet Handling Unspecified Remote DoS (JSA10848)	Medium
109213	Juniper Junos SNMP MIB-II Subagent Daemon (mib2d) Unspecified Remote DoS (JSA10847)	Medium

Junos Local Security Checks Family for Nessus