CVE-2014-3811

CVE-2014-3811 affects Juniper Installer Service (JIS) Client on Windows (7.x before 7.4R6) and Junos Pulse Client before 4.0R6, enabling local privilege escalation. Root cause is not detailed in the provided sources. Impact is high (local, full confidentiality/integrity/availability). Remediation...

CVE-2014-3820

The CVE-2014-3820 anomaly is a documented XSS in Juniper Pulse Secure/Policy products. Affected are the SSL VPN/UAC web server on Junos Pulse Access Service (IVE OS: 7.1 before 7.1r16, 7.4 before 7.4r3, 8.0 before 8.0r1) and the Pulse Access Control Service (UAC OS: 4.1 before 4.1r8, 4.4 before 4...

CVE-2014-3823

CVE-2014-3823 affects Juniper Junos Pulse Secure Access Service (SSL VPN) IVE OS: 8.0 before 8.0r1, 7.4 before 7.4r5, and 7.1 before 7.1r18. The vulnerability is a clickjacking issue exposed via unspecified vectors, allowing remote attackers to leverage UI framing protections. The issue was addre...

FreeBSD Security Advisory FreeBSD-SA-14:19.tcp

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-14:19.tcp Security Advisory The FreeBSD Project Topic: Denial of Service in TCP packet processing Category: core Module: inet Announced: 2014-09-16 Credits:...

Juniper Junos NTP Server Amplification Remote DoS (JSA10613)

According to its self-reported version number, the remote Juniper Junos device is affected by a vulnerability in the NTP daemon related to the handling of the 'monlist' command. A remote attacker can exploit this by forging a request that results in a distributed denial of service. Note that this...

FreeBSD Patches TCP Processing DoS Vulnerability

FreeBSD has patched a denial-of-service vulnerability that could affect a host of third-party packages built atop the UNIX-like operating system. The vulnerability—found in the way FreeBSD processes TCP packets—was discovered by a member of Juniper Networks’ incident response team. FreeBSD’s...

Juniper Installer Service 7.4 < 7.4r6 Privilege Escalation (JSA10644)

According to its self-reported version, the installation of Juniper Installer Service on the remote Windows host is version 7.4 prior to 7.4r6. It is, therefore, affected by a privilege escalation vulnerability that allows a local user to gain administrative privileges. C Tenable Network Security...

Junos Pulse Secure Access IVE / UAC OS XSS (JSA10645)

According to its self-reported version, the version of IVE / UAC OS running on the remote host is affected by a cross site scripting vulnerability due to incorrect user input validation on the SSL VPN / UAC web server. Note that this issue exists within a web page that is only accessible by an...

Junos Pulse Secure Access IVE OS Clickjacking (JSA10647)

According to its self-reported version, the version of IVE running on the remote host is affected by a clickjacking vulnerability. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid77691; scriptversion"1.5"; scriptsetattributeattribute:"pluginmodificationdate",...

Juniper Installer Service Detection

Binary data juniperjisinstalled.nbin...

Juniper Junos Pulse Client Privilege Escalation (JSA10644)

According to its self-reported version, the installation of Junos Pulse Client on the remote Windows host is version 4.0 prior to 4.0r6 or a version prior to 3.1r8. It is, therefore, affected by a privilege escalation vulnerability that allows a local attacker to gain administrative privileges vi...

Community Health data leak suspected of the use of the Heartbleed vulnerability-a vulnerability warning-the black bar safety net

When the Heartbleed OpenSSL vulnerability in 4 months is discovered, the security community many experts are warning that the vulnerability could be used to expose sensitive data, although at the time also there is no evidence that attackers are actively using Heartbleed vulnerability. And now, a...

Juniper Network and Security Manager XDB Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Juniper Network and Security Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the XDB service. The issue lies in the ability to connect to the...

Juniper NSM < 2012.2R9 Multiple Java and Apache Vulnerabilities (JSA10642)

The remote host has one or more instances of NSM Network and Security Manager Server running, with versions prior to 2012.2R9. It is, therefore, affected by multiple vulnerabilities related to its Java and Apache installations. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

Heartbleed Exploit Linked to Community Health Data Breach

Update: The Heartbleed OpenSSL vulnerability is now the centerpiece of the Community Health Systems data breach. Dave Kennedy, CEO of security consultancy TrustedSec, said yesterday that three sources close to the CHS investigation told him that a Heartbleed exploit was the hackers’ initial way i...

Juniper Junos Multiple OpenSSL Vulnerabilities (JSA10629)

According to its self-reported version number, the remote Juniper Junos device is affected by the following vulnerabilities related to OpenSSL : - An error exists in the ssl3readbytes function that permits data to be injected into other sessions or allows denial of service attacks. Note that this...

Juniper Networks Junos OS NTP Server Amplification Denial of Service Vulnerability

DoS in NTP server SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:juniper:junos"; if description...

Juniper Networks Junos OS RPD Denial of Service Vulnerability

DoS of RPD routing process SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:juniper:junos"; if description...

Juniper Networks Junos OS TCP Packet Processing Denial of Service Vulnerability

DoS in TCP packet processing SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:juniper:junos"; if description...

Juniper Networks Junos OS Web Authentication XSS Vulnerability

XSS vulnerability in webauth SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:juniper:junos"; if description...