Design/Logic Flaw

Juniper ATP Series Splunk credentials are logged in a file readable by authenticated local users. Using these credentials an attacker can access the Splunk server. This issue affects Juniper ATP 5.0 versions prior to 5.0.3...

Hardcoded credentials

Juniper ATP uses DES and a hardcoded salt for password hashing, allowing for trivial de-hashing of the password file contents. This issue affects Juniper ATP 5.0 versions prior to 5.0.3...

Cross site scripting

A persistent cross-site scripting XSS vulnerability in the Golden VM menu of Juniper ATP may allow authenticated user to inject arbitrary script and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on administrative user to perform administrative...

Cross site scripting

A persistent cross-site scripting XSS vulnerability in RADIUS configuration menu of Juniper ATP may allow authenticated user to inject arbitrary script and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on administrative user to perform...

Cross site scripting

A persistent cross-site scripting XSS vulnerability in the Zone configuration of Juniper ATP may allow authenticated user to inject arbitrary script and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on administrative user to perform...

Design/Logic Flaw

On Juniper ATP, the API key and the device key are logged in a file readable by authenticated local users. These keys are used for performing critical operations on the WebUI interface. This issue affects Juniper ATP 5.0 versions prior to 5.0.3...

CVE-2019-0004

On Juniper ATP, the API key and the device key are logged in a file readable by authenticated local users. These keys are used for performing critical operations on the WebUI interface. This issue affects Juniper ATP 5.0 versions prior to 5.0.3...

CVE-2019-0004

On Juniper ATP, the API key and the device key are logged in a file readable by authenticated local users. These keys are used for performing critical operations on the WebUI interface. This issue affects Juniper ATP 5.0 versions prior to 5.0.3...

Hardcoded credentials

Juniper ATP ships with hard coded credentials in the Cyphort Core instance which gives an attacker the ability to take full control of any installation of the software. Affected releases are Juniper Networks Juniper ATP: 5.0 versions prior to 5.0.3...

CVE-2019-0021 Juniper ATP: secret CLI inputs are logged to /var/log/syslog in clear text

On Juniper ATP, secret passphrase CLI inputs, such as "set mcm", are logged to /var/log/syslog in clear text, allowing authenticated local user to be able to view these secret information. This issue affects Juniper ATP 5.0 versions prior to 5.0.4...

CVE-2019-0004 Juniper ATP: API and device keys are logged in a world-readable permissions file

On Juniper ATP, the API key and the device key are logged in a file readable by authenticated local users. These keys are used for performing critical operations on the WebUI interface. This issue affects Juniper ATP 5.0 versions prior to 5.0.3...

CVE-2019-0020 Juniper ATP: Hard coded credentials used in Web Collector

Juniper ATP ships with hard coded credentials in the Web Collector instance which gives an attacker the ability to take full control of any installation of the software. Affected releases are Juniper Networks Juniper ATP: 5.0 versions prior to 5.0.3...

CVE-2019-0022 Juniper ATP: Two hard coded credentials sharing the same password give an attacker the ability to take control of any installation of the software.

Juniper ATP ships with hard coded credentials in the Cyphort Core instance which gives an attacker the ability to take full control of any installation of the software. Affected releases are Juniper Networks Juniper ATP: 5.0 versions prior to 5.0.3...

CVE-2019-0023 Juniper ATP: Persistent Cross-Site Scripting vulnerability in the Golden VM menu

A persistent cross-site scripting XSS vulnerability in the Golden VM menu of Juniper ATP may allow authenticated user to inject arbitrary script and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on administrative user to perform administrative...

CVE-2019-0024 Juniper ATP: Persistent Cross-Site Scripting vulnerability in the Email Collectors menu

A persistent cross-site scripting XSS vulnerability in the Email Collectors menu of Juniper ATP may allow authenticated user to inject arbitrary script and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on administrative user to perform...

CVE-2019-0025 Juniper ATP: Persistent Cross-Site Scripting vulnerability in RADIUS configuration menu

A persistent cross-site scripting XSS vulnerability in RADIUS configuration menu of Juniper ATP may allow authenticated user to inject arbitrary script and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on administrative user to perform...

CVE-2019-0026 Juniper ATP: Persistent Cross-Site Scripting vulnerability in Zone configuration

A persistent cross-site scripting XSS vulnerability in the Zone configuration of Juniper ATP may allow authenticated user to inject arbitrary script and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on administrative user to perform...

CVE-2019-0027 Juniper ATP: Persistent Cross-Site Scripting vulnerability in Snort Rules configuration

A persistent cross-site scripting XSS vulnerability in the Snort Rules configuration of Juniper ATP may allow authenticated user to inject arbitrary script and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on administrative user to perform...

CVE-2019-0030 Juniper ATP: Password hashing uses DES and a hardcoded salt

Juniper ATP uses DES and a hardcoded salt for password hashing, allowing for trivial de-hashing of the password file contents. This issue affects Juniper ATP 5.0 versions prior to 5.0.3...

CVE-2019-0018

The CVE-2019-0018 entry documents a persistent cross-site scripting (XSS) vulnerability in the file upload menu of Juniper ATP, affecting Juniper ATP 5.0 versions prior to 5.0.3. The issue allows an authenticated attacker to inject arbitrary scripts and potentially steal sensitive data or credent...