CVE-2019-0022 Juniper ATP: Two hard coded credentials sharing the same password give an attacker the ability to take control of any installation of the software.

Juniper ATP ships with hard coded credentials in the Cyphort Core instance which gives an attacker the ability to take full control of any installation of the software. Affected releases are Juniper Networks Juniper ATP: 5.0 versions prior to 5.0.3...

CVE-2019-0030

Juniper Advanced Threat Prevention (ATP) variant 5.0 before 5.0.3 uses DES with a hardcoded salt for password hashing, enabling trivial recovery of hashed password contents. Affects Juniper ATP 5.0.x releases prior to 5.0.3. The CVE entry is corroborated by multiple sources (NVD/CNVD/CVELIST). Re...

CVE-2019-0026 Juniper ATP: Persistent Cross-Site Scripting vulnerability in Zone configuration

A persistent cross-site scripting XSS vulnerability in the Zone configuration of Juniper ATP may allow authenticated user to inject arbitrary script and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on administrative user to perform...

CVE-2019-0022

CVE-2019-0022 describes a vulnerability in Juniper ATP where the Cyphort Core instance ships with hard-coded credentials , enabling an attacker to gain full control of an affected installation. The impact affects Juniper ATP 5.0 releases prior to 5.0.3, with a network-accessible vector and high s...

CVE-2019-0020

The CVE-2019-0020 entry concerns Juniper ATP: hard-coded credentials in the Web Collector component, enabling an attacker to gain full control of affected installations. Affected releases are Juniper ATP 5.0 versions prior to 5.0.3. The root cause is the presence of hard-coded credentials in the ...

CVE-2019-0021 Juniper ATP: secret CLI inputs are logged to /var/log/syslog in clear text

On Juniper ATP, secret passphrase CLI inputs, such as "set mcm", are logged to /var/log/syslog in clear text, allowing authenticated local user to be able to view these secret information. This issue affects Juniper ATP 5.0 versions prior to 5.0.4...

CVE-2019-0027

CVE-2019-0027 affects Juniper ATP 5.0 (before 5.0.3). The issue is a persistent XSS in the Snort Rules configuration that allows an authenticated user to inject arbitrary scripts, potentially stealing data/credentials from a web admin session and tricking a follow-on admin into performing actions...

CVE-2019-0004 Juniper ATP: API and device keys are logged in a world-readable permissions file

On Juniper ATP, the API key and the device key are logged in a file readable by authenticated local users. These keys are used for performing critical operations on the WebUI interface. This issue affects Juniper ATP 5.0 versions prior to 5.0.3...

CVE-2019-0025 Juniper ATP: Persistent Cross-Site Scripting vulnerability in RADIUS configuration menu

A persistent cross-site scripting XSS vulnerability in RADIUS configuration menu of Juniper ATP may allow authenticated user to inject arbitrary script and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on administrative user to perform...

CVE-2019-0018 Juniper ATP: Persistent Cross-Site Scripting (XSS) vulnerability in file upload menu

A persistent cross-site scripting XSS vulnerability in the file upload menu of Juniper ATP may allow an authenticated user to inject arbitrary scripts and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on administrative user to perform...

CVE-2019-0018

The CVE-2019-0018 entry documents a persistent cross-site scripting (XSS) vulnerability in the file upload menu of Juniper ATP, affecting Juniper ATP 5.0 versions prior to 5.0.3. The issue allows an authenticated attacker to inject arbitrary scripts and potentially steal sensitive data or credent...

CVE-2019-0023

The CVE concerns a persistent Cross-Site Scripting (XSS) vulnerability in the Golden VM menu of Juniper ATP. Affected product: Juniper ATP 5.0 series prior to 5.0.3. Root cause: XSS in the Golden VM menu that could allow an authenticated user to inject arbitrary scripts and potentially steal data...

CVE-2019-0029 Juniper ATP: Splunk credentials are in logged in clear text

Juniper ATP Series Splunk credentials are logged in a file readable by authenticated local users. Using these credentials an attacker can access the Splunk server. This issue affects Juniper ATP 5.0 versions prior to 5.0.3...

CVE-2019-0004

CVE-2019-0004 affects Juniper ATP 5.0 prior to 5.0.3. The issue is that API keys and device keys are logged to a file readable by local authenticated users, enabling potential abuse of WebUI operations. Affected component: Juniper ATP 5.0.x; root cause: keys logged to a world-readable/local file....

CVE-2019-0025: Improper Neutralization of Input During Web Page Generation

A persistent cross-site scripting XSS vulnerability in RADIUS configuration menu of Juniper ATP may allow authenticated user to inject arbitrary script and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on administrative user to perform...

CVE-2019-0023: Improper Neutralization of Input During Web Page Generation

A persistent cross-site scripting XSS vulnerability in the Golden VM menu of Juniper ATP may allow authenticated user to inject arbitrary script and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on administrative user to perform administrative...

CVE-2019-0024: Improper Neutralization of Input During Web Page Generation

A persistent cross-site scripting XSS vulnerability in the Email Collectors menu of Juniper ATP may allow authenticated user to inject arbitrary script and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on administrative user to perform...

CVE-2019-0021: Insertion of Sensitive Information into Log File

On Juniper ATP, secret passphrase CLI inputs, such as "set mcm", are logged to /var/log/syslog in clear text, allowing authenticated local user to be able to view these secret information. This issue affects Juniper ATP 5.0 versions prior to 5.0.4...

CVE-2019-0022: Use of Hard-coded Credentials

Juniper ATP ships with hard coded credentials in the Cyphort Core instance which gives an attacker the ability to take full control of any installation of the software. Affected releases are Juniper Networks Juniper ATP: 5.0 versions prior to 5.0.3...

CVE-2019-0004: Insertion of Sensitive Information into Log File

On Juniper ATP, the API key and the device key are logged in a file readable by authenticated local users. These keys are used for performing critical operations on the WebUI interface. This issue affects Juniper ATP 5.0 versions prior to 5.0.3...