CVE Vulnerability Catalog

A Cross-site Scripting (XSS) vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the Quick Template page. When visited by another user, including an administrator, the attacker can execute commands with the target's permissions. This issue affects all versions of Junos Space before 24.1R4.

A Cross-site Scripting (XSS) vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the Space Node Setting fields. When visited by another user, including an administrator, the attacker can execute commands with the target's permissions. This issue affects all versions of Junos Space before 24.1R4.

A Cross-site Scripting (XSS) vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the Secure Console page. When visited by another user, including an administrator, the attacker can execute commands with the target's permissions. This issue affects all versions of Junos Space before 24.1R4.

A Cross-site Scripting (XSS) vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the Device Management pages. When visited by another user, including an administrator, the attacker can execute commands with the target's permissions. This issue affects all versions of Junos Space before 24.1R4.

Junos Space before version 24.1R4 contains an XSS vulnerability that allows an attacker to inject script tags on template creation pages. When another user visits these pages, the attacker can execute commands with the target's permissions, including administrator.

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the Device Discovery page that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator. This issue affects all versions of Junos Space before 24.1R4.

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the Generate Report page that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator. This issue affects all versions of Junos Space before 24.1R4.

A Cross-site Scripting (XSS) vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the arbitrary device search field. When visited by another user, including an administrator, the attacker can execute commands with the target's permissions. This issue affects all versions of Junos Space before 24.1R4.

A Cross-site Scripting (XSS) vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the input fields in Model Devices. When visited by another user, including an administrator, the attacker can execute commands with the target's permissions. This issue affects all versions of Junos Space before 24.1R4.

A Cross-site Scripting (XSS) vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in a field on the Purging Policy page. When visited by another user, including an administrator, the attacker can execute commands with the target's permissions. This issue affects all versions of Junos Space before 24.1R4.

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in Global Search that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator. This issue affects all versions of Junos Space before 24.1R4.

A Cross-site Scripting vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the Template Definition page. When visited by another user, the attacker can execute commands with the target's permissions, including administrator. This issue affects all versions of Junos Space before 24.1R4.

A Cross-site Scripting vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the dashboard search field. When visited by another user, the attacker can execute commands with the target's permissions, including administrator. This issue affects all versions of Junos Space before 24.1R4.

A Cross-site Scripting vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the Device Template Definition page. When visited by another user, the attacker can execute commands with the target's permissions, including administrator. This issue affects all versions of Junos Space before 24.1R4.

An Authentication Bypass by Primary Weakness in the FTP server of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to get limited read-write access to files on the device. When the FTP server is enabled and a user named "ftp" or "anonymous" is configured, that user can login without providing the configured password and then has read-write access to their home directory.

A Cross-Site Scripting (XSS) vulnerability has been found in code-projects Client Details System 1.0. Malicious JavaScript code can be injected into the username field when adding customer information.

An arbitrary file download vulnerability in the web interface of Juniper Networks Junos Space allows a network-based authenticated attacker using a crafted GET method to access any file on the file system. Using specially crafted GET methods, an attacker can gain access to files beyond the file path normally allowed by the JBoss daemon. These files could contain sensitive information restricted from access by low-privileged users.

A NULL Pointer Dereference vulnerability in the PFE management daemon (evo-pfemand) of Juniper Networks Junos OS Evolved on ACX7024, ACX7024X, ACX7100-32C, ACX7100-48L, ACX7348, ACX7509 devices allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS). Whenever specific valid multicast traffic is received on any layer 3 interface, the evo-pfemand process crashes and restarts. Continued receipt of specific valid multicast traffic results in a sustained Denial-of-Service (DoS) attack. This issue affects Junos OS Evolved on ACX7024, ACX7024X, ACX7100-32C, ACX7100-48L, ACX7348, ACX7509: from 23.2R2-EVO before 23.2R2-S4-EVO, from 23.4R1-EVO before 23.4R2-EVO.

An access of uninitialized pointer vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved with BGP sharding configured allows an attacker triggering indirect next-hop updates to cause rpd to crash and restart, leading to a Denial of Service (DoS).

A vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS Evolved on PTX Series allows an unauthenticated, network-based attacker to cause impact to confidentiality and availability. When an output firewall filter is configured with terms where the action is 'reject', matching packets are erroneously sent to the Routing Engine (RE) and processed there, consuming RE resources. Responses from the RE may reveal confidential information about the device. This issue only applies to firewall filters on WAN or revenue interfaces, not mgmt or lo0.