Juniper Junos Space

Junos Space: Template Definition page is vulnerable to reflected cross-site script injection

Junos Space: API Access Profiles page is vulnerable to reflected cross-site script injection

Junos Space: Device Discovery page is vulnerable to reflected cross-site script injection

Junos Space: Template Definitions page is vulnerable to reflected cross-site script injection

Junos Space: Quick Template page is vulnerable to reflected cross-site script injection

Junos Space: Template creation through Definition is vulnerable to reflected cross-site script injection

Junos Space: Configuration View page is vulnerable to reflected cross-site script injection

Junos Space: Fields in the CLI Configlets are vulnerable to reflected cross-site script injection

Junos Space: Archive Logs screen is vulnerable to reflected cross-site script injection

Junos Space: Generate Report page is vulnerable to reflected cross-site script injection

Junos Space: Create Quick Template page is vulnerable to reflected cross-site script injection

Junos Space: CLI Configlet page is vulnerable to reflected cross-site script injection

Junos Space: Purging Policy field is vulnerable to reflected cross-site script injection

Junos Space: Secure Console page is vulnerable to reflected cross-site script injection

Junos Space: Device Management pages are vulnerable to reflected cross-site script injection

Junos Space: Template creation pages are vulnerable to reflected cross-site script injection

Junos Space: Generate Report page is vulnerable to reflected cross-site script injection

Junos Space: The arbitrary device search field is vulnerable to reflected cross-site script injection

Junos Space: Input fields in Model Devices are vulnerable to reflected cross-site script injection

Junos Space: Global Search is vulnerable to reflected cross-site script injection

Junos Space: Space Node Setting fields are vulnerable to reflected cross-site script injection

Junos Space: ilpFilter field on nLegacy.jsp is vulnerable to reflected cross-site script injection

On Juniper Networks Junos Space versions prior to 16.1R1 when certificate based authentication is enabled for the Junos Space cluster, some restricted web services are accessible over the network. This represents an information leak risk.

Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality and integrity via vectors related to JNDI.

Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier, and 5.6.23 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : Compiling.

Junos Space: Reflected XSS vulnerability in Junos Space management interface

On Juniper Networks Junos Space versions prior to 16.1R1, an unauthenticated remote attacker with network access to Junos space device can easily create a denial of service condition.

A firewall bypass vulnerability in the host based firewall of Juniper Networks Junos Space versions prior to 16.1R1 may permit certain crafted packets, representing a network integrity risk.

Juniper Junos Space before 12.3P2.8, as used on the JA1500 appliance and in other contexts, includes a cleartext password in a configuration tab, which makes it easier for physically proximate attackers to obtain the password by reading the workstation screen.

Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier, and 5.6.20 and earlier, allows remote attackers to affect availability via vectors related to CLIENT:SSL:yaSSL, a different vulnerability than CVE-2014-6496.

Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.23 and earlier allows remote authenticated users to affect confidentiality via unknown vectors related to Server : Security : Privileges.

Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier, and 5.6.20 and earlier, allows remote attackers to affect confidentiality via vectors related to C API SSL CERTIFICATE HANDLING.

Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier, and 5.6.20 and earlier, allows remote attackers to affect availability via vectors related to CLIENT:SSL:yaSSL, a different vulnerability than CVE-2014-6494.

Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier, and 5.6.19 and earlier, allows remote attackers to affect availability via vectors related to SERVER:SSL:yaSSL.

Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier, and 5.6.19 and earlier, allows remote attackers to affect integrity via vectors related to SERVER:SSL:yaSSL.

Cross-site scripting (XSS) vulnerability in the web-based interface in Juniper Junos Space before 13.1R1.6, as used on the JA1500 appliance and in other contexts, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka PR 884469.

Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Security.

Juniper Junos Space before 13.1R1.6, as used on the JA1500 appliance and in other contexts, does not properly restrict access to the list of user accounts and their MD5 password hashes, which makes it easier for remote authenticated users to obtain sensitive information via a dictionary attack, aka PR 879462.

Juniper Junos Space before 13.1R1.6, as used on the JA1500 appliance and in other contexts, does not properly implement role-based access control, which allows remote authenticated users to modify the configuration by leveraging the read-only privilege, aka PR 863804.