This CPE summary could be partial or incomplete. Please contact us for a detailed listing.

Summary

Detail
Vendor Juniper First view 2014-04-15
Product Junos Space Last view 2019-01-15
Version 15.1 Type Application
Update r3  
Edition *  
Language *  
Sofware Edition *  
Target Software *  
Target Hardware *  
Other *  
 
CPE Product cpe:2.3:a:juniper:junos_space

Activity : Overall

Related : CVE

This CPE have more than 25 Relations. If you want to see a complete summary for this CPE, please contact us.
  Date Alert Description
8.8 2019-01-15 CVE-2019-0017

The Junos Space application, which allows Device Image files to be uploaded, has insufficient validity checking which may allow uploading of malicious images or scripts, or other content types. Affected releases are Juniper Networks Junos Space versions prior to 18.3R1.

6.5 2019-01-15 CVE-2019-0016

A malicious authenticated user may be able to delete a device from the Junos Space database without the necessary privileges through crafted Ajax interactions obtained from another legitimate delete action performed by another administrative user. Affected releases are Juniper Networks Junos Space versions prior to 18.3R1.

7.8 2018-01-10 CVE-2018-0012

Junos Space is affected by a privilege escalation vulnerability that may allow a local authenticated attacker to gain root privileges.

5.4 2018-01-10 CVE-2018-0011

A reflected cross site scripting (XSS) vulnerability in Junos Space may potentially allow a remote authenticated user to inject web script or HTML and steal sensitive data and credentials from a session, and to perform administrative actions on the Junos Space network management device.

7.5 2017-10-13 CVE-2017-10624

Insufficient verification of node certificates in Juniper Networks Junos Space may allow a man-in-the-middle type of attacker to make unauthorized modifications to Space database or add nodes. Affected releases are Juniper Networks Junos Space all versions prior to 17.1R1.

8.1 2017-10-13 CVE-2017-10623

Lack of authentication and authorization of cluster messages in Juniper Networks Junos Space may allow a man-in-the-middle type of attacker to intercept, inject or disrupt Junos Space cluster operations between two nodes. Affected releases are Juniper Networks Junos Space all versions prior to 17.1R1.

8 2017-10-13 CVE-2017-10612

A persistent site scripting vulnerability in Juniper Networks Junos Space allows users who can change certain configuration to implant malicious Javascript or HTML which may be used to steal information or perform actions as other Junos Space users or administrators. Affected releases are Juniper Networks Junos Space all versions prior to 17.1R1.

5.3 2017-05-30 CVE-2017-2311

On Juniper Networks Junos Space versions prior to 16.1R1, an unauthenticated remote attacker with network access to Junos space device can easily create a denial of service condition.

5.3 2017-05-30 CVE-2017-2310

A firewall bypass vulnerability in the host based firewall of Juniper Networks Junos Space versions prior to 16.1R1 may permit certain crafted packets, representing a network integrity risk.

5.9 2017-05-30 CVE-2017-2309

On Juniper Networks Junos Space versions prior to 16.1R1 when certificate based authentication is enabled for the Junos Space cluster, some restricted web services are accessible over the network. This represents an information leak risk.

6.5 2017-05-30 CVE-2017-2308

An XML External Entity Injection vulnerability in Juniper Networks Junos Space versions prior to 16.1R1 may allow an authenticated user to read arbitrary files on the device.

6.1 2017-05-30 CVE-2017-2307

A reflected cross site scripting vulnerability in the administrative interface of Juniper Networks Junos Space versions prior to 16.1R1 may allow remote attackers to steal sensitive information or perform certain administrative actions on Junos Space.

8.8 2017-05-30 CVE-2017-2306

On Juniper Networks Junos Space versions prior to 16.1R1, due to an insufficient authorization check, readonly users on the Junos Space administrative web interface can execute code on the device.

8.8 2017-05-30 CVE-2017-2305

On Juniper Networks Junos Space versions prior to 16.1R1, due to an insufficient authorization check, readonly users on the Junos Space administrative web interface can create privileged users, allowing privilege escalation.

6.5 2017-03-20 CVE-2016-4931

XML entity injection in Junos Space before 15.2R2 allows attackers to cause a denial of service.

6.1 2017-03-20 CVE-2016-4930

Cross-site scripting (XSS) vulnerability in Junos Space before 15.2R2 allows remote attackers to steal sensitive information or perform certain administrative actions.

8.8 2017-03-20 CVE-2016-4929

Command injection vulnerability in Junos Space before 15.2R2 allows attackers to execute arbitrary code as a root user.

8.8 2017-03-20 CVE-2016-4928

Cross site request forgery vulnerability in Junos Space before 15.2R2 allows remote attackers to perform certain administrative actions on Junos Space.

8.1 2017-03-20 CVE-2016-4927

Insufficient validation of SSH keys in Junos Space before 15.2R2 allows man-in-the-middle (MITM) type of attacks while a Space device is communicating with managed devices.

9.8 2017-03-20 CVE-2016-4926

Insufficient authentication vulnerability in Junos Space before 15.2R2 allows remote network based users with access to Junos Space web interface to perform certain administrative tasks without authentication.

4.3 2015-07-16 CVE-2015-2620

Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.23 and earlier allows remote authenticated users to affect confidentiality via unknown vectors related to Server : Security : Privileges.

7.5 2015-06-15 CVE-2015-3209

Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending a packet with TXSTATUS_STARTPACKET set and then a crafted packet with TXSTATUS_DEVICEOWNS set.

5.7 2015-04-16 CVE-2015-0501

Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier, and 5.6.23 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : Compiling.

4.3 2014-10-15 CVE-2014-6559

Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier, and 5.6.20 and earlier, allows remote attackers to affect confidentiality via vectors related to C API SSL CERTIFICATE HANDLING.

7.5 2014-10-15 CVE-2014-6500

Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier, and 5.6.20 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to SERVER:SSL:yaSSL, a different vulnerability than CVE-2014-6491.

CWE : Common Weakness Enumeration

%idName
26% (4) CWE-79 Failure to Preserve Web Page Structure ('Cross-site Scripting')
13% (2) CWE-611 Information Leak Through XML External Entity File Disclosure
13% (2) CWE-287 Improper Authentication
6% (1) CWE-787 Out-of-bounds Write
6% (1) CWE-434 Unrestricted Upload of File with Dangerous Type
6% (1) CWE-352 Cross-Site Request Forgery (CSRF)
6% (1) CWE-345 Insufficient Verification of Data Authenticity
6% (1) CWE-200 Information Exposure
6% (1) CWE-77 Improper Sanitization of Special Elements used in a Command ('Comma...
6% (1) CWE-20 Improper Input Validation

Information Assurance Vulnerability Management (IAVM)

id Description
2015-A-0155 Multiple Vulnerabilities in Oracle MySQL Product Suite
Severity: Category I - VMSKEY: V0061083
2014-A-0056 Multiple Vulnerabilities in Oracle Java SE
Severity: Category I - VMSKEY: V0049583

Snort® IPS/IDS

Date Description
2016-03-14 Oracle Java System.arraycopy race condition attempt
RuleID : 36240 - Type : FILE-JAVA - Revision : 2
2016-03-14 Oracle Java System.arraycopy race condition attempt
RuleID : 36239 - Type : FILE-JAVA - Revision : 2

Nessus® Vulnerability Scanner

This CPE have more than 25 Relations. If you want to see a complete summary for this CPE, please contact us.
id Description
2019-01-10 Name: The remote device is affected by multiple vulnerabilities.
File: juniper_space_jsa10917_183R1.nasl - Type: ACT_GATHER_INFO
2018-03-21 Name: The remote device is affected by multiple vulnerabilities.
File: juniper_space_jsa_10838.nasl - Type: ACT_GATHER_INFO
2017-10-23 Name: The remote device is affected by multiple vulnerabilities.
File: juniper_space_jsa_10826.nasl - Type: ACT_GATHER_INFO
2016-10-12 Name: The remote Gentoo host is missing one or more security-related patches.
File: gentoo_GLSA-201610-06.nasl - Type: ACT_GATHER_INFO
2016-06-23 Name: The remote device is affected by multiple vulnerabilities.
File: juniper_space_jsa10698.nasl - Type: ACT_GATHER_INFO
2016-04-07 Name: The remote Gentoo host is missing one or more security-related patches.
File: gentoo_GLSA-201604-03.nasl - Type: ACT_GATHER_INFO
2016-02-17 Name: The remote device is missing a vendor-supplied security patch.
File: f5_bigip_SOL63519101.nasl - Type: ACT_GATHER_INFO
2015-11-02 Name: The remote Gentoo host is missing one or more security-related patches.
File: gentoo_GLSA-201510-02.nasl - Type: ACT_GATHER_INFO
2015-10-22 Name: The remote SUSE host is missing one or more security updates.
File: suse_SU-2015-1788-1.nasl - Type: ACT_GATHER_INFO
2015-09-30 Name: The remote SUSE host is missing one or more security updates.
File: suse_SU-2015-1643-1.nasl - Type: ACT_GATHER_INFO
2015-09-28 Name: The remote openSUSE host is missing a security update.
File: openSUSE-2015-608.nasl - Type: ACT_GATHER_INFO
2015-09-23 Name: The remote Gentoo host is missing one or more security-related patches.
File: gentoo_GLSA-201507-19.nasl - Type: ACT_GATHER_INFO
2015-09-11 Name: The remote SUSE host is missing one or more security updates.
File: suse_SU-2015-1519-1.nasl - Type: ACT_GATHER_INFO
2015-09-02 Name: The remote Fedora host is missing a security update.
File: fedora_2015-13404.nasl - Type: ACT_GATHER_INFO
2015-08-26 Name: The remote CentOS host is missing one or more security updates.
File: centos_RHSA-2015-1665.nasl - Type: ACT_GATHER_INFO
2015-08-25 Name: The remote Oracle Linux host is missing one or more security updates.
File: oraclelinux_ELSA-2015-1665.nasl - Type: ACT_GATHER_INFO
2015-08-25 Name: The remote Red Hat host is missing one or more security updates.
File: redhat-RHSA-2015-1665.nasl - Type: ACT_GATHER_INFO
2015-08-25 Name: The remote Scientific Linux host is missing one or more security updates.
File: sl_20150824_mariadb_on_SL7_x.nasl - Type: ACT_GATHER_INFO
2015-08-25 Name: The remote SUSE host is missing one or more security updates.
File: suse_SU-2015-1426-1.nasl - Type: ACT_GATHER_INFO
2015-08-24 Name: The remote Fedora host is missing a security update.
File: fedora_2015-13358.nasl - Type: ACT_GATHER_INFO
2015-08-19 Name: The remote host is missing one or more security updates.
File: mysql_5_5_44_rpm.nasl - Type: ACT_GATHER_INFO
2015-08-19 Name: The remote host is missing one or more security updates.
File: mysql_5_6_24_rpm.nasl - Type: ACT_GATHER_INFO
2015-08-18 Name: The remote CentOS host is missing one or more security updates.
File: centos_RHSA-2015-1628.nasl - Type: ACT_GATHER_INFO
2015-08-18 Name: The remote Fedora host is missing a security update.
File: fedora_2015-13402.nasl - Type: ACT_GATHER_INFO
2015-08-18 Name: The remote Oracle Linux host is missing one or more security updates.
File: oraclelinux_ELSA-2015-1628.nasl - Type: ACT_GATHER_INFO