Cross site scripting

Cross-site scripting XSS vulnerability in the help page in Juniper Secure Access SA with IVE OS before 7.1r13, 7.2.x before 7.2r7, and 7.3.x before 7.3r2 allows remote attackers to inject arbitrary web script or HTML via the WWHSearchWordsText parameter...

Pulse Connect Secure Unsupported Version Detection

According to its self-reported version number, the installation of Pulse Connect Secure formerly known as Juniper IVE OS and Junos Pulse Secure IVE OS operating system on the remote host is no longer supported. Lack of support implies that no new security patches for the product will be released ...

Juniper IVE OS Unintentionally Trusted Certificate Authorities

According to its self-reported version, the version of IVE OS running on the remote host has an insecure SSL configuration. Internal and development Certificate Authorities CAs used by Juniper during testing were mistakenly included and explicitly trusted in public releases of IVE OS. A...

CVE-2012-5460

Cross-site scripting XSS vulnerability in the help page in Juniper Secure Access SA with IVE OS before 7.1r13, 7.2.x before 7.2r7, and 7.3.x before 7.3r2 allows remote attackers to inject arbitrary web script or HTML via the WWHSearchWordsText parameter...

CVE-2012-5460

CVE-2012-5460 is a documented XSS in Juniper Secure Access (IVE OS) on the help page, exploitable via the WWHSearchWordsText parameter. Affected versions are IVE OS before 7.1r13, 7.2.x before 7.2r7, and 7.3.x before 7.3r2. The vulnerability can allow an attacker to inject arbitrary web script/HT...

Juniper Secure Access XSS Vulnerability

------------------------------------------------------------------------------- | Juniper Secure Access XSS Vulnerability| -------------------------------------------------------------------------------- Summary =============== Juniper Secure Access software has reflected XSS vulnerability CVE...

Juniper Secure Access crossite scripting

Crossite scripting in SSLVPN...

Juniper JunOS 9.x Cross Site Scripting

Exploit Title: Juniper JUNOS 9.X HTML Injection Vulnerability Google Dork: intext:"2009, Juniper Networks" intext:"Firewall User Web-Authentication" Date: Jul 24th 2013 Exploit Author: Andrea Menin linkedin.com/in/andreamenin Vendor Homepage: http://www.juniper.net Version: JUNOS 9.X Tested on:...

Juniper Junos SSL/TLS Renegotiation DoS (JSA10580)

According to its self-reported version number, the remote Juniper Junos device is affected by a denial of service vulnerability. The SSL/TLS implementation on the remote host allows clients to renegotiate connections. The computational requirements for renegotiating a connection are asymmetrical...

Juniper Junos SRX Series PIM DoS (JSA10573)

According to its self-reported version number, the remote Juniper Junos device is affected by a denial of service vulnerability when Protocol-Independent Multicast PIM is enabled. An attacker, using specially crafted PIM packets subject to NAT, can cause the Flow Daemon flowd to crash. Repeated...

Juniper Junos proxy-arp/arp-resp DoS (JSA10576)

According to its self-reported version number, the remote Junos device has a denial of service vulnerability. Specially crafted ARP requests can result in a crash when a 'family inet' interface is configured as follows : - Uses a VLAN interface with an unnumbered address based on lo0 - lo0 is...

Juniper Junos SRX1400/3400/3600 Etherleak Information Disclosure (JSA10579)

According to its self-reported version number, the remote Junos device has an information disclosure vulnerability. SRX1400, SRX3400, and SRX3600 services gateways pad Ethernet packets with data from previous packets instead of padding them with null bytes. A remote, unauthenticated attacker coul...

Juniper Junos SRX Series UAC Enforcer HTTP Remote Code Execution (JSA10574)

According to its self-reported version number, the remote Junos device has a remote code execution vulnerability. Sending a specially crafted HTTP request to an SRX series device can result in arbitrary code execution. A remote, unauthenticated attacker could exploit this to execute arbitrary cod...

Juniper Junos SRX Series TCP ALG DoS (JSA10577)

According to its self-reported version number, the remote Junos device has a denial of service vulnerability. SRX Series devices with TCP-based Application Layer Gateways ALGs can crash when receiving specially crafted TCP packets. A remote, unauthenticated attacker could exploit this to crash th...

Juniper Junos SRX Series MSRPC DoS (JSA10578)

According to its self-reported version number, the remote Junos device has a denial of service vulnerability. SRX Series devices with a Microsoft Remote Procedure Call MSRPC Application Layer Gateway ALG can crash when processing specially crafted MSRPC packets. A remote, unauthenticated attacker...

Juniper Junos OpenSSL Multiple Vulnerabilities (JSA10575)

According to its self-reported version number, the remote Junos device is using an outdated version of OpenSSL, which has multiple vulnerabilities including but not limited to : - An error exists related to the handling of OCSP response verification that could allow denial of service attacks...

CVE-2013-4688

flowd in Juniper Junos 10.4 before 10.4R11 on SRX devices, when the MSRPC Application Layer Gateway ALG is enabled, allows remote attackers to cause a denial of service daemon crash via crafted MSRPC requests, aka PR 772834...

CVE-2013-4685

Buffer overflow in flowd in Juniper Junos 10.4 before 10.4S14, 11.4 before 11.4R7, 12.1 before 12.1R6, and 12.1X44 before 12.1X44-D15 on SRX devices, when Captive Portal is enabled with the UAC enforcer role, allows remote attackers to execute arbitrary code via crafted HTTP requests, aka PR 8491...

CVE-2013-4687

flowd in Juniper Junos 10.4 before 10.4S14, 11.2 and 11.4 before 11.4R6-S2, and 12.1 before 12.1R6 on SRX devices, when certain Application Layer Gateways ALGs are enabled, allows remote attackers to cause a denial of service daemon crash via crafted TCP packets, aka PRs 727980, 806269, and 83559...

CVE-2013-4690

Juniper Junos 10.4 before 10.4S13, 11.4 before 11.4R7-S1, 12.1 before 12.1R5-S3, 12.1X44 before 12.1X44-D20, and 12.1X45 before 12.1X45-D10 on the SRX1400, SRX3400, and SRX3600 does not properly initialize memory locations used during padding of Ethernet packets, which allows remote attackers to...