ICMPv6 Router Announcement flooding denial of service affecting multiple systems

This security advisory is released because Microsoft doesnt want to fix the issue. Cisco did for its IOS and ASA within 3 months. Title: ICMPv6 Router Announcement flooding denial of service affecting multiple systems Date: 05 April 2011 URL:...

Juniper VPN client rdesktop clickhack

Juniper VPN client rdesktop clickhack ================================ discovered by [email protected] PRODUCT: Juniper VPN client + Windows remote desktop or console access VERSION AFFECTED: Win Vista/7 + Juniper VPN client all versions EXPOSURE: Remote code execution SYSTEM privileges SYNOPSIS...

Juniper VPN client unauthorized access

It's possible to execute Internet Explorer with System rights before authentication via remote session...

Juniper VPN Client rdesktop Click Hack

Juniper VPN client rdesktop clickhack ================================ discovered by [email protected] PRODUCT: Juniper VPN client + Windows remote desktop or console access VERSION AFFECTED: Win Vista/7 + Juniper VPN client all versions EXPOSURE: Remote code execution SYSTEM privileges SYNOPSIS...

Juniper Secure Access crossite scripting

Multiple crossite scripting vulnerabilities...

Juniper SSL VPN Bypass / Cross Site Scripting

This reminded me of a bunch of problems I spotted in Juniper SSL VPN a while ago; they are apparently fixed, but I don't recall seeing any public vendor advisory / credit for reporting them - so here you go, even if just for the record... These were fixed by Juniper in IVE 6.3R1, 6.2R3, 6.1R5,...

some ooold Juniper bugs (was: [Full-disclosure] ZDI-10-231: Juniper Secure Access Series meeting_testjava.cgi XSS Vulnerability)

This reminded me of a bunch of problems I spotted in Juniper SSL VPN a while ago; they are apparently fixed, but I don't recall seeing any public vendor advisory / credit for reporting them - so here you go, even if just for the record... These were fixed by Juniper in IVE 6.3R1, 6.2R3, 6.1R5,...

ZDI-10-231: Juniper Secure Access Series meeting_testjava.cgi XSS Vulnerability

ZDI-10-231: Juniper Secure Access Series meetingtestjava.cgi XSS Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-10-231 November 7, 2010 -- CVSS: 6.4, AV:N/AC:L/Au:N/C:P/I:P/A:N -- Affected Vendors: Juniper -- Affected Products: Juniper Secure Access Series -- TippingPointTM IPS...

Juniper Secure Access Series meeting_testjava.cgi XSS Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Juniper SA Series devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the meetingtestjava.cgi page which is used to test JVM compatibility. When...

NCP Secure Client - Juniper Edition v.9.23.017 DLL Hijacking Exploit

Exploit for windows platform in category local exploits ==================================================================== NCP Secure Client - Juniper Edition v.9.23.017 DLL Hijacking Exploit ==================================================================== / Exploit Title: NCP Secure Client...

PR09-16: Juniper Secure Access series (Juniper IVE) Cross-Site Scripting Vulnerability

PR09-16: Juniper Secure Access series Juniper IVE XSS Vulnerability found: 12th October 2009 Severity: Medium Script injection Description: There is a Cross-site Scripting vulnerability on Juniper, IVE web interface. Procheckup has found by making a malformed request to the IVE Web interface...

Juniper Secure Access crossite scripting

Administration interface crossite scripting...

ProCheckUp Security Advisory 2009.16

PR09-16: Juniper Secure Access series Juniper IVE XSS Vulnerability found: 12th October 2009 Severity: Medium Script injection Description: There is a Cross-site Scripting vulnerability on Juniper, IVE web interface. Procheckup has found by making a malformed request to the IVE Web interface...

CVE-2010-2289

Open redirect vulnerability in dana/home/homepage.cgi in Juniper Networks IVE 6.5R1 Build 14599 and 6.5R2 Build 14951 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the Location parameter...

CVE-2010-2288

Cross-site scripting XSS vulnerability in dana/nc/ncrun.cgi in Juniper Networks IVE 6.5R1 Build 14599 and 6.5R2 Build 14951 allows remote attackers to inject arbitrary web script or HTML via the DSSignInURL cookie...

Open redirect

Open redirect vulnerability in dana/home/homepage.cgi in Juniper Networks IVE 6.5R1 Build 14599 and 6.5R2 Build 14951 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the Location parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in dana/nc/ncrun.cgi in Juniper Networks IVE 6.5R1 Build 14599 and 6.5R2 Build 14951 allows remote attackers to inject arbitrary web script or HTML via the DSSignInURL cookie...

CVE-2010-2288

Cross-site scripting XSS vulnerability in dana/nc/ncrun.cgi in Juniper Networks IVE 6.5R1 Build 14599 and 6.5R2 Build 14951 allows remote attackers to inject arbitrary web script or HTML via the DSSignInURL cookie...

CVE-2010-2289

CVE-2010-2289 describes an open redirect in Juniper Networks IVE. The vulnerability exists in the web-facing CGI path dana/home/homepage.cgi and is exploitable via the Location parameter, allowing remote attackers to redirect users to arbitrary sites and facilitate phishing. Affected products are...

CVE-2010-2289

Open redirect vulnerability in dana/home/homepage.cgi in Juniper Networks IVE 6.5R1 Build 14599 and 6.5R2 Build 14951 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the Location parameter...