CVE-2018-0039

CVE-2018-0039 affects Juniper Networks Contrail Service Orchestration releases prior to 4.0.0, where Grafana is enabled by default with hard-coded credentials. This enables network-based attackers to access information stored in Grafana or potentially exploit weaknesses in Grafana. The connection...

CVE-2018-0038

CVE-2018-0038 affects Juniper Networks Contrail Service Orchestration (CSO) prior to version 3.3.0, where the Cassandra service is enabled by default with hard-coded credentials. This allows network-based attackers to gain unauthorized access to information stored in Cassandra. The connected docu...

CVE-2018-0039 Contrail Service Orchestration: Hardcoded credentials for Grafana service

Juniper Networks Contrail Service Orchestration releases prior to 4.0.0 have Grafana service enabled by default with hardcoded credentials. These credentials allow network based attackers unauthorized access to information stored in Grafana or exploit other weaknesses or vulnerabilities in Grafan...

CVE-2018-0040

CVE-2018-0040 affects Juniper Networks Contrail Service Orchestrator prior to 4.0.0, where hard-coded cryptographic certificates and keys are used. Root cause: the presence of hard-coded credentials may allow an attacker to gain unauthorized access to services over the network. Consequences: unau...

CVE-2018-0038

Juniper Networks Contrail Service Orchestration releases prior to 3.3.0 have Cassandra service enabled by default with hardcoded credentials. These credentials allow network based attackers unauthorized access to information stored in Cassandra...

CVE-2018-0041

The CVE-2018-0041 entry concerns Juniper Networks Contrail Service Orchestration (CSO) prior to version 3.3.0, where hard-coded credentials grant network-based attackers unauthorized access to Keystone service data. Root cause: hard-coded credentials in CSO access to Keystone. Affected product: C...

CVE-2018-0038: Use of Hard-coded Credentials

Juniper Networks Contrail Service Orchestration releases prior to 3.3.0 have Cassandra service enabled by default with hardcoded credentials. These credentials allow network based attackers unauthorized access to information stored in Cassandra...

CVE-2018-0041: Use of Hard-coded Credentials

Juniper Networks Contrail Service Orchestration releases prior to 3.3.0 use hardcoded credentials to access Keystone service. These credentials allow network based attackers unauthorized access to information stored in keystone...

PT-2018-8583

Name of the Vulnerable Software and Affected Versions: Juniper Networks Contrail Service Orchestration versions prior to 4.0.0 Description: The issue concerns hardcoded credentials in the Grafana service, which is enabled by default. These credentials can be exploited by network-based attackers t...

CVE-2018-0039: Use of Hard-coded Credentials

Juniper Networks Contrail Service Orchestration releases prior to 4.0.0 have Grafana service enabled by default with hardcoded credentials. These credentials allow network based attackers unauthorized access to information stored in Grafana or exploit other weaknesses or vulnerabilities in Grafan...

PT-2018-8585

Name of the Vulnerable Software and Affected Versions: Juniper Networks Contrail Service Orchestration versions prior to 3.3.0 Description: The issue concerns the use of hardcoded credentials to access the Keystone service, allowing network-based attackers to gain unauthorized access to informati...

PT-2018-8584

Name of the Vulnerable Software and Affected Versions: Juniper Networks Contrail Service Orchestrator versions prior to 4.0.0 Description: The issue concerns the use of hardcoded cryptographic certificates and keys, which may allow network-based attackers to gain unauthorized access to services...

CVE-2018-0040: Use of Hard-coded Cryptographic Key

Juniper Networks Contrail Service Orchestrator versions prior to 4.0.0 use hardcoded cryptographic certificates and keys in some cases, which may allow network based attackers to gain unauthorized access to services...

PT-2018-8582

Name of the Vulnerable Software and Affected Versions: Juniper Networks Contrail Service Orchestration versions prior to 3.3.0 Description: The issue allows network-based attackers unauthorized access to information stored in Cassandra due to hardcoded credentials. The Cassandra service is enable...

Randy Bias joins Wallarm board of advisers

Menlo Park, California — December 5, 2017 — Wallarm today announced that Randy Bias, Vice President of Technology and Strategy, Cloud Software at Juniper and founder of Cloudscaling acquired by EMC, has joined Wallarm’s board of advisers. “Randy is an agile cloud pioneer and a thought leader in...

Juniper Contrail XML External Entity Injection Vulnerability

Juniper Contrail is a suite of cloud-based security solutions from Juniper Networks, Inc. The solution provides intelligent automation, application security and reliability for cloud and NFV. An XML external entity injection vulnerability exists in the ifmap service in Juniper Contrail. A remote...

Juniper Contrail Information Disclosure Vulnerability

Juniper Contrail is a suite of cloud-based security solutions from Juniper Networks, Inc. The solution provides intelligent automation, application security and reliability for cloud and NFV. A security vulnerability exists in the ifmap service in Juniper Contrail that stems from the program's us...

CVE-2017-10616

The ifmap service that comes bundled with Juniper Networks Contrail releases uses hard coded credentials. Affected releases are Contrail releases 2.2 prior to 2.21.4; 3.0 prior to 3.0.3.4; 3.1 prior to 3.1.4.0; 3.2 prior to 3.2.5.0. CVE-2017-10616 and CVE-2017-10617 can be chained together and ha...

CVE-2017-10617

The ifmap service that comes bundled with Contrail has an XML External Entity XXE vulnerability that may allow an attacker to retrieve sensitive system files. Affected releases are Juniper Networks Contrail 2.2 prior to 2.21.4; 3.0 prior to 3.0.3.4; 3.1 prior to 3.1.4.0; 3.2 prior to 3.2.5.0...

CVE-2017-10616

The ifmap service that comes bundled with Juniper Networks Contrail releases uses hard coded credentials. Affected releases are Contrail releases 2.2 prior to 2.21.4; 3.0 prior to 3.0.3.4; 3.1 prior to 3.1.4.0; 3.2 prior to 3.2.5.0. CVE-2017-10616 and CVE-2017-10617 can be chained together and ha...