This CPE summary could be partial or incomplete. Please contact us for a detailed listing.

Summary

Detail
Vendor Juniper First view 2013-05-08
Product Junos Space Last view 2021-01-15
Version Type Application
Update  
Edition  
Language  
Sofware Edition  
Target Software  
Target Hardware  
Other  

Activity : Overall

COMMON PLATFORM ENUMERATION: Repartition per Version

CPE Name Affected CVE
cpe:2.3:a:juniper:junos_space:11.4:*:*:*:*:*:*:* 36
cpe:2.3:a:juniper:junos_space:11.3:*:*:*:*:*:*:* 36
cpe:2.3:a:juniper:junos_space:12.2:*:*:*:*:*:*:* 36
cpe:2.3:a:juniper:junos_space:11.1:*:*:*:*:*:*:* 36
cpe:2.3:a:juniper:junos_space:12.3:*:*:*:*:*:*:* 36
cpe:2.3:a:juniper:junos_space:11.2:*:*:*:*:*:*:* 36
cpe:2.3:a:juniper:junos_space:12.1:*:*:*:*:*:*:* 36
cpe:2.3:a:juniper:junos_space:13.3:r4:*:*:*:*:*:* 33
cpe:2.3:a:juniper:junos_space:14.1:-:*:*:*:*:*:* 33
cpe:2.3:a:juniper:junos_space:13.3:r1:*:*:*:*:*:* 33
cpe:2.3:a:juniper:junos_space:15.1:r2:*:*:*:*:*:* 33
cpe:2.3:a:juniper:junos_space:14.1:r3:*:*:*:*:*:* 33
cpe:2.3:a:juniper:junos_space:14.1:r2:*:*:*:*:*:* 33
cpe:2.3:a:juniper:junos_space:1.0:*:*:*:*:*:*:* 33
cpe:2.3:a:juniper:junos_space:13.3:r2:*:*:*:*:*:* 33
cpe:2.3:a:juniper:junos_space:14.1:r1:*:*:*:*:*:* 33
cpe:2.3:a:juniper:junos_space:2.0:*:*:*:*:*:*:* 33
cpe:2.3:a:juniper:junos_space:13.3:r3:*:*:*:*:*:* 33
cpe:2.3:a:juniper:junos_space:1.3:*:*:*:*:*:*:* 33
cpe:2.3:a:juniper:junos_space:1.2:*:*:*:*:*:*:* 33
cpe:2.3:a:juniper:junos_space:1.4:*:*:*:*:*:*:* 33
cpe:2.3:a:juniper:junos_space:1.1:*:*:*:*:*:*:* 33
cpe:2.3:a:juniper:junos_space:15.1:r4:*:*:*:*:*:* 32
cpe:2.3:a:juniper:junos_space:13.1:-:*:*:*:*:*:* 32
cpe:2.3:a:juniper:junos_space:13.1:r1.8:*:*:*:*:*:* 32
cpe:2.3:a:juniper:junos_space:15.1:r1:*:*:*:*:*:* 32
cpe:2.3:a:juniper:junos_space:15.1:r3:*:*:*:*:*:* 32
cpe:2.3:a:juniper:junos_space:13.3:r1.2:*:*:*:*:*:* 31
cpe:2.3:a:juniper:junos_space:13.3:r1.5:*:*:*:*:*:* 31
cpe:2.3:a:juniper:junos_space:13.3:r1.7:*:*:*:*:*:* 31
cpe:2.3:a:juniper:junos_space:13.3:r1.3:*:*:*:*:*:* 31
cpe:2.3:a:juniper:junos_space:13.3:r1.1:*:*:*:*:*:* 31
cpe:2.3:a:juniper:junos_space:13.3:r1.4:*:*:*:*:*:* 31
cpe:2.3:a:juniper:junos_space:13.3:r1.6:*:*:*:*:*:* 31
cpe:2.3:a:juniper:junos_space:15.1:*:*:*:*:*:*:* 30
cpe:2.3:a:juniper:junos_space:15.1:-:*:*:*:*:*:* 30
cpe:2.3:a:juniper:junos_space:15.2:r2:*:*:*:*:*:* 20
cpe:2.3:a:juniper:junos_space:15.2:r1:*:*:*:*:*:* 20
cpe:2.3:a:juniper:junos_space:15.2:-:*:*:*:*:*:* 20
cpe:2.3:a:juniper:junos_space:16.1:r2:*:*:*:*:*:* 11
cpe:2.3:a:juniper:junos_space:16.1:r3:*:*:*:*:*:* 11
cpe:2.3:a:juniper:junos_space:16.1:-:*:*:*:*:*:* 11
cpe:2.3:a:juniper:junos_space:16.1:r1:*:*:*:*:*:* 11
cpe:2.3:a:juniper:junos_space:17.2:r1.4:*:*:*:*:*:* 4
cpe:2.3:a:juniper:junos_space:17.1:r1:*:*:*:*:*:* 4
cpe:2.3:a:juniper:junos_space:18.2:r1:*:*:*:*:*:* 2
cpe:2.3:a:juniper:junos_space:18.1:r1:*:*:*:*:*:* 2
cpe:2.3:a:juniper:junos_space:18.1r1:*:*:*:*:*:*:* 2
cpe:2.3:a:juniper:junos_space:17.1:-:*:*:*:*:*:* 2
cpe:2.3:a:juniper:junos_space:17.2:-:*:*:*:*:*:* 2

Related : CVE

This CPE Product have more than 25 Relations. If you want to see a complete summary for this CPE, please contact us.
  Date Alert Description
6.8 2021-01-15 CVE-2021-0220

The Junos Space Network Management Platform has been found to store shared secrets in a recoverable format that can be exposed through the UI. An attacker who is able to execute arbitrary code in the victim browser (for example via XSS) or access cached contents may be able to obtain a copy of credentials managed by Junos Space. The impact of a successful attack includes, but is not limited to, obtaining access to other servers connected to the Junos Space Management Platform. This issue affects Juniper Networks Junos Space versions prior to 20.3R1.

8.8 2019-01-15 CVE-2019-0017

The Junos Space application, which allows Device Image files to be uploaded, has insufficient validity checking which may allow uploading of malicious images or scripts, or other content types. Affected releases are Juniper Networks Junos Space versions prior to 18.3R1.

6.5 2019-01-15 CVE-2019-0016

A malicious authenticated user may be able to delete a device from the Junos Space database without the necessary privileges through crafted Ajax interactions obtained from another legitimate delete action performed by another administrative user. Affected releases are Juniper Networks Junos Space versions prior to 18.3R1.

6.1 2018-10-10 CVE-2018-0046

A reflected cross-site scripting vulnerability in OpenNMS included with Juniper Networks Junos Space may allow the stealing of sensitive information or session credentials from Junos Space administrators or perform administrative actions. This issue affects Juniper Networks Junos Space versions prior to 18.2R1.

9.8 2018-04-05 CVE-2014-3413

The MySQL server in Juniper Networks Junos Space before 13.3R1.8 has an unspecified account with a hardcoded password, which allows remote attackers to obtain sensitive information and consequently obtain administrative control by leveraging database access.

7.8 2018-01-10 CVE-2018-0012

Junos Space is affected by a privilege escalation vulnerability that may allow a local authenticated attacker to gain root privileges.

5.4 2018-01-10 CVE-2018-0011

A reflected cross site scripting (XSS) vulnerability in Junos Space may potentially allow a remote authenticated user to inject web script or HTML and steal sensitive data and credentials from a session, and to perform administrative actions on the Junos Space network management device.

7.5 2017-10-13 CVE-2017-10624

Insufficient verification of node certificates in Juniper Networks Junos Space may allow a man-in-the-middle type of attacker to make unauthorized modifications to Space database or add nodes. Affected releases are Juniper Networks Junos Space all versions prior to 17.1R1.

8.1 2017-10-13 CVE-2017-10623

Lack of authentication and authorization of cluster messages in Juniper Networks Junos Space may allow a man-in-the-middle type of attacker to intercept, inject or disrupt Junos Space cluster operations between two nodes. Affected releases are Juniper Networks Junos Space all versions prior to 17.1R1.

8 2017-10-13 CVE-2017-10612

A persistent site scripting vulnerability in Juniper Networks Junos Space allows users who can change certain configuration to implant malicious Javascript or HTML which may be used to steal information or perform actions as other Junos Space users or administrators. Affected releases are Juniper Networks Junos Space all versions prior to 17.1R1.

9.8 2017-10-13 CVE-2016-1265

A remote unauthenticated network based attacker with access to Junos Space may execute arbitrary code on Junos Space or gain access to devices managed by Junos Space using cross site request forgery (CSRF), default authentication credentials, information leak and command injection attack vectors. All versions of Juniper Networks Junos Space prior to 15.1R3 are affected.

5.3 2017-05-30 CVE-2017-2311

On Juniper Networks Junos Space versions prior to 16.1R1, an unauthenticated remote attacker with network access to Junos space device can easily create a denial of service condition.

5.3 2017-05-30 CVE-2017-2310

A firewall bypass vulnerability in the host based firewall of Juniper Networks Junos Space versions prior to 16.1R1 may permit certain crafted packets, representing a network integrity risk.

5.9 2017-05-30 CVE-2017-2309

On Juniper Networks Junos Space versions prior to 16.1R1 when certificate based authentication is enabled for the Junos Space cluster, some restricted web services are accessible over the network. This represents an information leak risk.

6.5 2017-05-30 CVE-2017-2308

An XML External Entity Injection vulnerability in Juniper Networks Junos Space versions prior to 16.1R1 may allow an authenticated user to read arbitrary files on the device.

6.1 2017-05-30 CVE-2017-2307

A reflected cross site scripting vulnerability in the administrative interface of Juniper Networks Junos Space versions prior to 16.1R1 may allow remote attackers to steal sensitive information or perform certain administrative actions on Junos Space.

8.8 2017-05-30 CVE-2017-2306

On Juniper Networks Junos Space versions prior to 16.1R1, due to an insufficient authorization check, readonly users on the Junos Space administrative web interface can execute code on the device.

8.8 2017-05-30 CVE-2017-2305

On Juniper Networks Junos Space versions prior to 16.1R1, due to an insufficient authorization check, readonly users on the Junos Space administrative web interface can create privileged users, allowing privilege escalation.

6.5 2017-03-20 CVE-2016-4931

XML entity injection in Junos Space before 15.2R2 allows attackers to cause a denial of service.

6.1 2017-03-20 CVE-2016-4930

Cross-site scripting (XSS) vulnerability in Junos Space before 15.2R2 allows remote attackers to steal sensitive information or perform certain administrative actions.

8.8 2017-03-20 CVE-2016-4929

Command injection vulnerability in Junos Space before 15.2R2 allows attackers to execute arbitrary code as a root user.

8.8 2017-03-20 CVE-2016-4928

Cross site request forgery vulnerability in Junos Space before 15.2R2 allows remote attackers to perform certain administrative actions on Junos Space.

8.1 2017-03-20 CVE-2016-4927

Insufficient validation of SSH keys in Junos Space before 15.2R2 allows man-in-the-middle (MITM) type of attacks while a Space device is communicating with managed devices.

9.8 2017-03-20 CVE-2016-4926

Insufficient authentication vulnerability in Junos Space before 15.2R2 allows remote network based users with access to Junos Space web interface to perform certain administrative tasks without authentication.

4.3 2015-07-16 CVE-2015-2620

Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.23 and earlier allows remote authenticated users to affect confidentiality via unknown vectors related to Server : Security : Privileges.

CWE : Common Weakness Enumeration

%idName
24% (6) CWE-79 Failure to Preserve Web Page Structure ('Cross-site Scripting')
8% (2) CWE-611 Information Leak Through XML External Entity File Disclosure
8% (2) CWE-352 Cross-Site Request Forgery (CSRF)
8% (2) CWE-287 Improper Authentication
8% (2) CWE-264 Permissions, Privileges, and Access Controls
8% (2) CWE-255 Credentials Management
8% (2) CWE-200 Information Exposure
4% (1) CWE-798 Use of Hard-coded Credentials
4% (1) CWE-787 Out-of-bounds Write
4% (1) CWE-522 Insufficiently Protected Credentials
4% (1) CWE-434 Unrestricted Upload of File with Dangerous Type
4% (1) CWE-345 Insufficient Verification of Data Authenticity
4% (1) CWE-77 Improper Sanitization of Special Elements used in a Command ('Comma...
4% (1) CWE-20 Improper Input Validation

Oval Markup Language : Definitions

OvalID Name
oval:org.mitre.oval:def:24672 Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRocki...
oval:org.mitre.oval:def:26653 HP-UX running Java6, Remote Unauthorized Access, Disclosure of Information, a...
oval:org.mitre.oval:def:24535 Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8 allows remote a...
oval:org.mitre.oval:def:26524 HP-UX running Java6, Remote Unauthorized Access, Disclosure of Information, a...
oval:org.mitre.oval:def:24709 Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRocki...
oval:org.mitre.oval:def:26494 HP-UX running Java6, Remote Unauthorized Access, Disclosure of Information, a...
oval:org.mitre.oval:def:26769 USN-2384-1 -- MySQL vulnerabilities
oval:org.mitre.oval:def:27137 DSA-3054-1 mysql-5.5 - security update
oval:org.mitre.oval:def:28389 RHSA-2014:1859 -- mysql55-mysql security update (Important)
oval:org.mitre.oval:def:28369 ELSA-2014-1859 -- mysql55-mysql security update (important)
oval:org.mitre.oval:def:27610 RHSA-2014:1861 -- mariadb security update (Important)
oval:org.mitre.oval:def:27477 ELSA-2014-1861 -- mariadb security update (important)
oval:org.mitre.oval:def:28823 ELSA-2015-1189 -- kvm security update (important)
oval:org.mitre.oval:def:28657 SUSE-SU-2015:1152-1 -- Security update for KVM (important)

Information Assurance Vulnerability Management (IAVM)

id Description
2015-A-0155 Multiple Vulnerabilities in Oracle MySQL Product Suite
Severity: Category I - VMSKEY: V0061083
2014-A-0056 Multiple Vulnerabilities in Oracle Java SE
Severity: Category I - VMSKEY: V0049583

Snort® IPS/IDS

Date Description
2016-03-14 Oracle Java System.arraycopy race condition attempt
RuleID : 36240 - Type : FILE-JAVA - Revision : 2
2016-03-14 Oracle Java System.arraycopy race condition attempt
RuleID : 36239 - Type : FILE-JAVA - Revision : 2

Nessus® Vulnerability Scanner

This CPE Product have more than 25 Relations. If you want to see a complete summary for this CPE, please contact us.
id Description
2019-01-10 Name: The remote device is affected by multiple vulnerabilities.
File: juniper_space_jsa10917_183R1.nasl - Type: ACT_GATHER_INFO
2018-03-21 Name: The remote device is affected by multiple vulnerabilities.
File: juniper_space_jsa_10838.nasl - Type: ACT_GATHER_INFO
2017-10-23 Name: The remote device is affected by multiple vulnerabilities.
File: juniper_space_jsa_10826.nasl - Type: ACT_GATHER_INFO
2016-10-12 Name: The remote Gentoo host is missing one or more security-related patches.
File: gentoo_GLSA-201610-06.nasl - Type: ACT_GATHER_INFO
2016-06-29 Name: The remote device is affected by multiple vulnerabilities.
File: juniper_space_15_1R3.nasl - Type: ACT_GATHER_INFO
2016-06-23 Name: The remote device is affected by multiple vulnerabilities.
File: juniper_space_jsa10698.nasl - Type: ACT_GATHER_INFO
2016-04-07 Name: The remote Gentoo host is missing one or more security-related patches.
File: gentoo_GLSA-201604-03.nasl - Type: ACT_GATHER_INFO
2016-02-17 Name: The remote device is missing a vendor-supplied security patch.
File: f5_bigip_SOL63519101.nasl - Type: ACT_GATHER_INFO
2015-11-02 Name: The remote Gentoo host is missing one or more security-related patches.
File: gentoo_GLSA-201510-02.nasl - Type: ACT_GATHER_INFO
2015-10-22 Name: The remote SUSE host is missing one or more security updates.
File: suse_SU-2015-1788-1.nasl - Type: ACT_GATHER_INFO
2015-09-30 Name: The remote SUSE host is missing one or more security updates.
File: suse_SU-2015-1643-1.nasl - Type: ACT_GATHER_INFO
2015-09-28 Name: The remote openSUSE host is missing a security update.
File: openSUSE-2015-608.nasl - Type: ACT_GATHER_INFO
2015-09-23 Name: The remote Gentoo host is missing one or more security-related patches.
File: gentoo_GLSA-201507-19.nasl - Type: ACT_GATHER_INFO
2015-09-11 Name: The remote SUSE host is missing one or more security updates.
File: suse_SU-2015-1519-1.nasl - Type: ACT_GATHER_INFO
2015-09-02 Name: The remote Fedora host is missing a security update.
File: fedora_2015-13404.nasl - Type: ACT_GATHER_INFO
2015-08-26 Name: The remote CentOS host is missing one or more security updates.
File: centos_RHSA-2015-1665.nasl - Type: ACT_GATHER_INFO
2015-08-25 Name: The remote Oracle Linux host is missing one or more security updates.
File: oraclelinux_ELSA-2015-1665.nasl - Type: ACT_GATHER_INFO
2015-08-25 Name: The remote Red Hat host is missing one or more security updates.
File: redhat-RHSA-2015-1665.nasl - Type: ACT_GATHER_INFO
2015-08-25 Name: The remote Scientific Linux host is missing one or more security updates.
File: sl_20150824_mariadb_on_SL7_x.nasl - Type: ACT_GATHER_INFO
2015-08-25 Name: The remote SUSE host is missing one or more security updates.
File: suse_SU-2015-1426-1.nasl - Type: ACT_GATHER_INFO
2015-08-24 Name: The remote Fedora host is missing a security update.
File: fedora_2015-13358.nasl - Type: ACT_GATHER_INFO
2015-08-19 Name: The remote host is missing one or more security updates.
File: mysql_5_5_44_rpm.nasl - Type: ACT_GATHER_INFO
2015-08-19 Name: The remote host is missing one or more security updates.
File: mysql_5_6_24_rpm.nasl - Type: ACT_GATHER_INFO
2015-08-18 Name: The remote CentOS host is missing one or more security updates.
File: centos_RHSA-2015-1628.nasl - Type: ACT_GATHER_INFO
2015-08-18 Name: The remote Fedora host is missing a security update.
File: fedora_2015-13402.nasl - Type: ACT_GATHER_INFO