Summary
Detail | |||
---|---|---|---|
Vendor | Juniper | First view | 2014-04-15 |
Product | Junos Space | Last view | 2018-04-05 |
Version | 13.3 | Type | Application |
Update | r1.5 | ||
Edition | * | ||
Language | * | ||
Sofware Edition | * | ||
Target Software | * | ||
Target Hardware | * | ||
Other | * | ||
CPE Product | cpe:2.3:a:juniper:junos_space |
Activity : Overall
Related : CVE
Date | Alert | Description | |
---|---|---|---|
9.8 | 2018-04-05 | CVE-2014-3413 | The MySQL server in Juniper Networks Junos Space before 13.3R1.8 has an unspecified account with a hardcoded password, which allows remote attackers to obtain sensitive information and consequently obtain administrative control by leveraging database access. |
7.8 | 2018-01-10 | CVE-2018-0012 | Junos Space is affected by a privilege escalation vulnerability that may allow a local authenticated attacker to gain root privileges. |
7.5 | 2017-10-13 | CVE-2017-10624 | Insufficient verification of node certificates in Juniper Networks Junos Space may allow a man-in-the-middle type of attacker to make unauthorized modifications to Space database or add nodes. Affected releases are Juniper Networks Junos Space all versions prior to 17.1R1. |
8.1 | 2017-10-13 | CVE-2017-10623 | Lack of authentication and authorization of cluster messages in Juniper Networks Junos Space may allow a man-in-the-middle type of attacker to intercept, inject or disrupt Junos Space cluster operations between two nodes. Affected releases are Juniper Networks Junos Space all versions prior to 17.1R1. |
8 | 2017-10-13 | CVE-2017-10612 | A persistent site scripting vulnerability in Juniper Networks Junos Space allows users who can change certain configuration to implant malicious Javascript or HTML which may be used to steal information or perform actions as other Junos Space users or administrators. Affected releases are Juniper Networks Junos Space all versions prior to 17.1R1. |
9.8 | 2017-10-13 | CVE-2016-1265 | A remote unauthenticated network based attacker with access to Junos Space may execute arbitrary code on Junos Space or gain access to devices managed by Junos Space using cross site request forgery (CSRF), default authentication credentials, information leak and command injection attack vectors. All versions of Juniper Networks Junos Space prior to 15.1R3 are affected. |
5.3 | 2017-05-30 | CVE-2017-2311 | On Juniper Networks Junos Space versions prior to 16.1R1, an unauthenticated remote attacker with network access to Junos space device can easily create a denial of service condition. |
5.3 | 2017-05-30 | CVE-2017-2310 | A firewall bypass vulnerability in the host based firewall of Juniper Networks Junos Space versions prior to 16.1R1 may permit certain crafted packets, representing a network integrity risk. |
5.9 | 2017-05-30 | CVE-2017-2309 | On Juniper Networks Junos Space versions prior to 16.1R1 when certificate based authentication is enabled for the Junos Space cluster, some restricted web services are accessible over the network. This represents an information leak risk. |
6.5 | 2017-05-30 | CVE-2017-2308 | An XML External Entity Injection vulnerability in Juniper Networks Junos Space versions prior to 16.1R1 may allow an authenticated user to read arbitrary files on the device. |
6.1 | 2017-05-30 | CVE-2017-2307 | A reflected cross site scripting vulnerability in the administrative interface of Juniper Networks Junos Space versions prior to 16.1R1 may allow remote attackers to steal sensitive information or perform certain administrative actions on Junos Space. |
8.8 | 2017-05-30 | CVE-2017-2306 | On Juniper Networks Junos Space versions prior to 16.1R1, due to an insufficient authorization check, readonly users on the Junos Space administrative web interface can execute code on the device. |
8.8 | 2017-05-30 | CVE-2017-2305 | On Juniper Networks Junos Space versions prior to 16.1R1, due to an insufficient authorization check, readonly users on the Junos Space administrative web interface can create privileged users, allowing privilege escalation. |
6.5 | 2017-03-20 | CVE-2016-4931 | XML entity injection in Junos Space before 15.2R2 allows attackers to cause a denial of service. |
6.1 | 2017-03-20 | CVE-2016-4930 | Cross-site scripting (XSS) vulnerability in Junos Space before 15.2R2 allows remote attackers to steal sensitive information or perform certain administrative actions. |
8.8 | 2017-03-20 | CVE-2016-4929 | Command injection vulnerability in Junos Space before 15.2R2 allows attackers to execute arbitrary code as a root user. |
8.8 | 2017-03-20 | CVE-2016-4928 | Cross site request forgery vulnerability in Junos Space before 15.2R2 allows remote attackers to perform certain administrative actions on Junos Space. |
8.1 | 2017-03-20 | CVE-2016-4927 | Insufficient validation of SSH keys in Junos Space before 15.2R2 allows man-in-the-middle (MITM) type of attacks while a Space device is communicating with managed devices. |
9.8 | 2017-03-20 | CVE-2016-4926 | Insufficient authentication vulnerability in Junos Space before 15.2R2 allows remote network based users with access to Junos Space web interface to perform certain administrative tasks without authentication. |
4.3 | 2015-07-16 | CVE-2015-2620 | Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.23 and earlier allows remote authenticated users to affect confidentiality via unknown vectors related to Server : Security : Privileges. |
7.5 | 2015-06-15 | CVE-2015-3209 | Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending a packet with TXSTATUS_STARTPACKET set and then a crafted packet with TXSTATUS_DEVICEOWNS set. |
5.7 | 2015-04-16 | CVE-2015-0501 | Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier, and 5.6.23 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : Compiling. |
4.3 | 2014-10-15 | CVE-2014-6559 | Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier, and 5.6.20 and earlier, allows remote attackers to affect confidentiality via vectors related to C API SSL CERTIFICATE HANDLING. |
7.5 | 2014-10-15 | CVE-2014-6500 | Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier, and 5.6.20 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to SERVER:SSL:yaSSL, a different vulnerability than CVE-2014-6491. |
4.3 | 2014-10-15 | CVE-2014-6496 | Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier, and 5.6.20 and earlier, allows remote attackers to affect availability via vectors related to CLIENT:SSL:yaSSL, a different vulnerability than CVE-2014-6494. |
CWE : Common Weakness Enumeration
% | id | Name |
---|---|---|
17% (3) | CWE-79 | Failure to Preserve Web Page Structure ('Cross-site Scripting') |
11% (2) | CWE-611 | Information Leak Through XML External Entity File Disclosure |
11% (2) | CWE-352 | Cross-Site Request Forgery (CSRF) |
11% (2) | CWE-287 | Improper Authentication |
11% (2) | CWE-200 | Information Exposure |
5% (1) | CWE-798 | Use of Hard-coded Credentials |
5% (1) | CWE-787 | Out-of-bounds Write |
5% (1) | CWE-345 | Insufficient Verification of Data Authenticity |
5% (1) | CWE-255 | Credentials Management |
5% (1) | CWE-77 | Improper Sanitization of Special Elements used in a Command ('Comma... |
5% (1) | CWE-20 | Improper Input Validation |
Information Assurance Vulnerability Management (IAVM)
id | Description |
---|---|
2015-A-0155 | Multiple Vulnerabilities in Oracle MySQL Product Suite Severity: Category I - VMSKEY: V0061083 |
2014-A-0056 | Multiple Vulnerabilities in Oracle Java SE Severity: Category I - VMSKEY: V0049583 |
Snort® IPS/IDS
Date | Description |
---|---|
2016-03-14 | Oracle Java System.arraycopy race condition attempt RuleID : 36240 - Type : FILE-JAVA - Revision : 2 |
2016-03-14 | Oracle Java System.arraycopy race condition attempt RuleID : 36239 - Type : FILE-JAVA - Revision : 2 |
Nessus® Vulnerability Scanner
id | Description |
---|---|
2018-03-21 | Name: The remote device is affected by multiple vulnerabilities. File: juniper_space_jsa_10838.nasl - Type: ACT_GATHER_INFO |
2017-10-23 | Name: The remote device is affected by multiple vulnerabilities. File: juniper_space_jsa_10826.nasl - Type: ACT_GATHER_INFO |
2016-10-12 | Name: The remote Gentoo host is missing one or more security-related patches. File: gentoo_GLSA-201610-06.nasl - Type: ACT_GATHER_INFO |
2016-06-29 | Name: The remote device is affected by multiple vulnerabilities. File: juniper_space_15_1R3.nasl - Type: ACT_GATHER_INFO |
2016-06-23 | Name: The remote device is affected by multiple vulnerabilities. File: juniper_space_jsa10698.nasl - Type: ACT_GATHER_INFO |
2016-04-07 | Name: The remote Gentoo host is missing one or more security-related patches. File: gentoo_GLSA-201604-03.nasl - Type: ACT_GATHER_INFO |
2016-02-17 | Name: The remote device is missing a vendor-supplied security patch. File: f5_bigip_SOL63519101.nasl - Type: ACT_GATHER_INFO |
2015-11-02 | Name: The remote Gentoo host is missing one or more security-related patches. File: gentoo_GLSA-201510-02.nasl - Type: ACT_GATHER_INFO |
2015-10-22 | Name: The remote SUSE host is missing one or more security updates. File: suse_SU-2015-1788-1.nasl - Type: ACT_GATHER_INFO |
2015-09-30 | Name: The remote SUSE host is missing one or more security updates. File: suse_SU-2015-1643-1.nasl - Type: ACT_GATHER_INFO |
2015-09-28 | Name: The remote openSUSE host is missing a security update. File: openSUSE-2015-608.nasl - Type: ACT_GATHER_INFO |
2015-09-23 | Name: The remote Gentoo host is missing one or more security-related patches. File: gentoo_GLSA-201507-19.nasl - Type: ACT_GATHER_INFO |
2015-09-11 | Name: The remote SUSE host is missing one or more security updates. File: suse_SU-2015-1519-1.nasl - Type: ACT_GATHER_INFO |
2015-09-02 | Name: The remote Fedora host is missing a security update. File: fedora_2015-13404.nasl - Type: ACT_GATHER_INFO |
2015-08-26 | Name: The remote CentOS host is missing one or more security updates. File: centos_RHSA-2015-1665.nasl - Type: ACT_GATHER_INFO |
2015-08-25 | Name: The remote Oracle Linux host is missing one or more security updates. File: oraclelinux_ELSA-2015-1665.nasl - Type: ACT_GATHER_INFO |
2015-08-25 | Name: The remote Red Hat host is missing one or more security updates. File: redhat-RHSA-2015-1665.nasl - Type: ACT_GATHER_INFO |
2015-08-25 | Name: The remote Scientific Linux host is missing one or more security updates. File: sl_20150824_mariadb_on_SL7_x.nasl - Type: ACT_GATHER_INFO |
2015-08-25 | Name: The remote SUSE host is missing one or more security updates. File: suse_SU-2015-1426-1.nasl - Type: ACT_GATHER_INFO |
2015-08-24 | Name: The remote Fedora host is missing a security update. File: fedora_2015-13358.nasl - Type: ACT_GATHER_INFO |
2015-08-19 | Name: The remote host is missing one or more security updates. File: mysql_5_5_44_rpm.nasl - Type: ACT_GATHER_INFO |
2015-08-19 | Name: The remote host is missing one or more security updates. File: mysql_5_6_24_rpm.nasl - Type: ACT_GATHER_INFO |
2015-08-18 | Name: The remote CentOS host is missing one or more security updates. File: centos_RHSA-2015-1628.nasl - Type: ACT_GATHER_INFO |
2015-08-18 | Name: The remote Fedora host is missing a security update. File: fedora_2015-13402.nasl - Type: ACT_GATHER_INFO |
2015-08-18 | Name: The remote Oracle Linux host is missing one or more security updates. File: oraclelinux_ELSA-2015-1628.nasl - Type: ACT_GATHER_INFO |