CVSS: 5.4EPSS: 0%CPEs: 27EXPL: 0CVE-2018-0059 – ScreenOS: Stored Cross-Site Scripting (XSS) vulnerability
https://notcve.org/view.php?id=CVE-2018-0059
A persistent cross-site scripting vulnerability in the graphical user interface of ScreenOS may allow a remote authenticated user to inject web script or HTML and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on administrative user to perform administrative actions on the device. Affected releases are Juniper Networks ScreenOS 6.3.0 versions prior to 6.3.0r26. Una vulnerabilidad Cross-Site Scripting (XSS) persistente en la interfaz gráfica de usuario de ScreenOS podría permitir que un usuario autenticado remoto inyecte scripts web o HTML y robe datos sensibles y credenciales de una sesión de administración web, posiblemente engañando a un usuario administrativo Las versiones afectadas son Juniper Networks ScreenOS 6.3.0 en versiones anteriores a la 6.3.0r26. • https://kb.juniper.net/JSA10894 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 25EXPL: 0CVE-2018-0014 – ScreenOS: Etherleak vulnerability found on ScreenOS device
https://notcve.org/view.php?id=CVE-2018-0014
Juniper Networks ScreenOS devices do not pad Ethernet packets with zeros, and thus some packets can contain fragments of system memory or data from previous packets. This issue is often detected as CVE-2003-0001. The issue affects all versions of Juniper Networks ScreenOS prior to 6.3.0r25. Los dispositivos Juniper Networks ScreenOS no rellenan con ceros los paquetes Ethernet, por lo que algunos paquetes podrían contener fragmentos de memoria del sistema o datos de paquetes anteriores. Este problema se suele detectar como CVE-2003-0001. • http://www.securitytracker.com/id/1040185 https://kb.juniper.net/JSA10841 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.6EPSS: 0%CPEs: 24EXPL: 0CVE-2017-2336 – ScreenOS: XSS vulnerability in ScreenOS Firewall
https://notcve.org/view.php?id=CVE-2017-2336
A reflected cross site scripting vulnerability in NetScreen WebUI of Juniper Networks Juniper NetScreen Firewall+VPN running ScreenOS allows a network based attacker to inject HTML/JavaScript content into the management session of other users including the administrator. This enables the attacker to effectively execute commands with the permissions of an administrator. This issue affects Juniper Networks ScreenOS 6.3.0 releases prior to 6.3.0r24 on SSG Series. No other Juniper Networks products or platforms are affected by this issue. Una vulnerabilidad de tipo cross-site-scripting (XSS) reflejado en la WebUI de NetScreen de Juniper Networks Juniper NetScreen Firewall+VPN ejecutándose en ScreenOS, permite a un atacante sobre la red inyectar contenido HTML/JavaScript hacia la sesión de administración de otros usuarios, incluyendo el Administrador. • http://www.securityfocus.com/bid/99590 http://www.securitytracker.com/id/1038881 https://kb.juniper.net/JSA10782 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.4EPSS: 0%CPEs: 24EXPL: 0CVE-2017-2339 – ScreenOS: XSS vulnerability in ScreenOS Firewall
https://notcve.org/view.php?id=CVE-2017-2339
A persistent cross site scripting vulnerability in NetScreen WebUI of Juniper Networks Juniper NetScreen Firewall+VPN running ScreenOS allows a user with the 'security' role to inject HTML/JavaScript content into the management session of other users including the administrator. This enables the lower-privileged user to effectively execute commands with the permissions of an administrator. This issue affects Juniper Networks ScreenOS 6.3.0 releases prior to 6.3.0r24 on SSG Series. No other Juniper Networks products or platforms are affected by this issue. Una vulnerabilidad de tipo cross-site-scripting (XSS) persistente en la WebUI de NetScreen de Juniper Networks Juniper NetScreen Firewall+VPN ejecutándose en ScreenOS, permite a un usuario con el rol “security” inyectar contenido HTML/JavaScript en la sesión de administración de otros usuarios, incluyendo el administrador. • http://www.securityfocus.com/bid/99590 http://www.securitytracker.com/id/1038881 https://kb.juniper.net/JSA10782 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.4EPSS: 0%CPEs: 24EXPL: 0CVE-2017-2335 – ScreenOS: XSS vulnerability in ScreenOS Firewall
https://notcve.org/view.php?id=CVE-2017-2335
A persistent cross site scripting vulnerability in NetScreen WebUI of Juniper Networks Juniper NetScreen Firewall+VPN running ScreenOS allows a user with the 'security' role to inject HTML/JavaScript content into the management session of other users including the administrator. This enables the lower-privileged user to effectively execute commands with the permissions of an administrator. This issue affects Juniper Networks ScreenOS 6.3.0 releases prior to 6.3.0r24 on SSG Series. No other Juniper Networks products or platforms are affected by this issue. Una vulnerabilidad de tipo cross-site-scripting (XSS) persistente en la WebUI de NetScreen de Juniper Networks Juniper NetScreen Firewall+VPN ejecutándose en ScreenOS, permite a un usuario con el rol “security” inyectar contenido HTML/JavaScript hacia la sesión de administración de otros usuarios, incluyendo el administrador. • http://www.securityfocus.com/bid/99590 http://www.securitytracker.com/id/1038881 https://kb.juniper.net/JSA10782 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •