Overview 78 matches · 1 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
78matches
1in Waratek scope1.3%
0protected0.0%
0exploited0.0%
0CISA KEV0.0%
1public PoC1.3%
0EPSS ≥ 0.50.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
1
1.3%
Outside Waratek scope
77
98.7%
Not applicable
0
0.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
78
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
0
0.0%
Proof of concept only
1
1.3%
Forecast only
0
0.0%
No public exploit
77
98.7%
split by
peak 26 / year
20134
Outside Waratek scope4
Medium4
not blocked4
No public exploit4
201413
No exploit published1
Outside Waratek scope12
High7
Medium6
not blocked13
No public exploit13
20153
Outside Waratek scope3
High1
Medium2
not blocked3
No public exploit3
20160
201718
Outside Waratek scope18
Critical3
High8
Medium7
not blocked18
No public exploit18
20187
Outside Waratek scope7
Critical1
High3
Medium3
not blocked7
No public exploit7
20192
Outside Waratek scope2
High1
Medium1
not blocked2
No public exploit2
20201
Outside Waratek scope1
Medium1
not blocked1
Proof of concept only1
20211
Outside Waratek scope1
Medium1
not blocked1
No public exploit1
20220
20230
20241
Outside Waratek scope1
Medium1
not blocked1
No public exploit1
202526
Outside Waratek scope26
Critical1
High2
Medium23
not blocked26
No public exploit26
20262
Outside Waratek scope2
High1
Medium1
not blocked2
No public exploit2
2014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-21904 | Medium | 2026-04-09 | Outside Waratek scope | No public exploit | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the list filter field that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator. This issue affects all versions of Junos Space before 24.1R5 Patch V3. |
| CVE-2026-21907 | High | 2026-01-15 | Outside Waratek scope | No public exploit | A Use of a Broken or Risky Cryptographic Algorithm vulnerability in the TLS/SSL server of Juniper Networks Junos Space allows the use of static key ciphers (ssl-static-key-ciphers), reducing the confidentiality of on-path traffic communicated across the connection. These ciphers also do not support Perfect Forward Secrecy (PFS), affecting the long-term confidentiality of encrypted communications.This issue affects all versions of Junos Space before 24.1R5. |
| CVE-2025-60009 | Medium | 2025-10-09 | Outside Waratek scope | No public exploit | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the CLI Configlet page that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator. This issue affects all versions of Junos Space before 24.1R4. |
| CVE-2025-60002 | Medium | 2025-10-09 | Outside Waratek scope | No public exploit | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the Template Definitions page that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator. This issue affects all versions of Junos Space before 24.1R4. |
| CVE-2025-60001 | Medium | 2025-10-09 | Outside Waratek scope | No public exploit | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the Generate Report page that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator. This issue affects all versions of Junos Space before 24.1R4. |
| CVE-2025-60000 | Medium | 2025-10-09 | Outside Waratek scope | No public exploit | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the Generate Report page that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator. This issue affects all versions of Junos Space before 24.1R4. |
| CVE-2025-59999 | Medium | 2025-10-09 | Outside Waratek scope | No public exploit | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the API Access Profiles page that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator. This issue affects all versions of Junos Space before 24.1R4. |
| CVE-2025-59998 | Medium | 2025-10-09 | Outside Waratek scope | No public exploit | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the Archive Log screen that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator. This issue affects all versions of Junos Space before 24.1R4. |
| CVE-2025-59997 | Medium | 2025-10-09 | Outside Waratek scope | No public exploit | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the CLI Configlets pages that, when visited by another user, enable the attacker to execute commands with the target's permissions, including an administrator. This issue affects all versions of Junos Space before 24.1R4. |
| CVE-2025-59996 | Medium | 2025-10-09 | Outside Waratek scope | No public exploit | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the Configuration View page that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator. This issue affects all versions of Junos Space before 24.1R4. |
| CVE-2025-59995 | Medium | 2025-10-09 | Outside Waratek scope | No public exploit | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the Quick Template page that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator. This issue affects all versions of Junos Space before 24.1R4. |
| CVE-2025-59994 | Medium | 2025-10-09 | Outside Waratek scope | No public exploit | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the Quick Template page that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator. This issue affects all versions of Junos Space before 24.1R4. |
| CVE-2025-59993 | Medium | 2025-10-09 | Outside Waratek scope | No public exploit | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the Space Node Setting fields that, when visited by another user, enable the attacker to execute commands with the target's permissions, including an administrator. This issue affects all versions of Junos Space before 24.1R4. |
| CVE-2025-59992 | Medium | 2025-10-09 | Outside Waratek scope | No public exploit | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the Secure Console page that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator. This issue affects all versions of Junos Space before 24.1R4. |
| CVE-2025-59991 | Medium | 2025-10-09 | Outside Waratek scope | No public exploit | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the Device Management pages that, when visited by another user, enable the attacker to execute commands with the target's permissions, including an administrator. This issue affects all versions of Junos Space before 24.1R4. |
| CVE-2025-59990 | Medium | 2025-10-09 | Outside Waratek scope | No public exploit | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the template creation pages that, when visited by another user, enable the attacker to execute commands with the target's permissions, including an administrator. This issue affects all versions of Junos Space before 24.1R4. |
| CVE-2025-59989 | Medium | 2025-10-09 | Outside Waratek scope | No public exploit | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the Device Discovery page that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator. This issue affects all versions of Junos Space before 24.1R4. |
| CVE-2025-59988 | Medium | 2025-10-09 | Outside Waratek scope | No public exploit | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the Generate Report page that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator. This issue affects all versions of Junos Space before 24.1R4. |
| CVE-2025-59987 | Medium | 2025-10-09 | Outside Waratek scope | No public exploit | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the arbitrary device search field that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator.This issue affects all versions of Junos Space before 24.1R4. |
| CVE-2025-59986 | Medium | 2025-10-09 | Outside Waratek scope | No public exploit | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the input fields in Model Devices that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator.This issue affects all versions of Junos Space before 24.1R4. |
| CVE-2025-59985 | Medium | 2025-10-09 | Outside Waratek scope | No public exploit | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in a field on the Purging Policy page that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator.This issue affects all versions of Junos Space before 24.1R4. |
| CVE-2025-59984 | Medium | 2025-10-09 | Outside Waratek scope | No public exploit | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in Global Search that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator.This issue affects all versions of Junos Space before 24.1R4. |
| CVE-2025-59983 | Medium | 2025-10-09 | Outside Waratek scope | No public exploit | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the Template Definition page, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator.This issue affects all versions of Junos Space before 24.1R4. |
| CVE-2025-59982 | Medium | 2025-10-09 | Outside Waratek scope | No public exploit | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the dashboard search field that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator.This issue affects all versions of Junos Space before 24.1R4. |
| CVE-2025-59981 | Medium | 2025-10-09 | Outside Waratek scope | No public exploit | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the Device Template Definition page that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator.This issue affects all versions of Junos Space before 24.1R4. |
| CVE-2025-59978 | Critical | 2025-10-09 | Outside Waratek scope | No public exploit | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to store script tags directly in web pages that, when viewed by another user, enable the attacker to execute commands with the target's administrative permissions. This issue affects all versions of Junos Space before 24.1R4. |
| CVE-2025-59976 | High | 2025-10-09 | Outside Waratek scope | No public exploit | An arbitrary file download vulnerability in the web interface of Juniper Networks Junos Space allows a network-based authenticated attacker using a crafted GET method to access any file on the file system. Using specially crafted GET methods, an attacker can gain access to files beyond the file path normally allowed by the JBoss daemon. These files could contain sensitive information restricted from access by low-privileged users.This issue affects all versions of Junos Space before 24.1R3. |
| CVE-2025-59975 | High | 2025-10-09 | Outside Waratek scope | No public exploit | An Uncontrolled Resource Consumption vulnerability in the HTTP daemon (httpd) of Juniper Networks Junos Space allows an unauthenticated network-based attacker flooding the device with inbound API calls to consume all resources on the system, leading to a Denial of Service (DoS). After continuously flooding the system with inbound connection requests, all available file handles become consumed, blocking access to the system via SSH and the web user interface (WebUI), resulting in a management interface DoS. A manual reboot of the system is required to restore functionality. This issue affects Junos Space: * all versions before 22.2R1 Patch V3, * from 23.1 before 23.1R1 Patch V3. |
| CVE-2024-39563 | Medium | 2024-10-11 | Outside Waratek scope | No public exploit | A Command Injection vulnerability in Juniper Networks Junos Space allows an unauthenticated, network-based attacker sending a specially crafted request to execute arbitrary shell commands on the Junos Space Appliance, leading to remote command execution by the web application, gaining complete control of the device. A specific script in the Junos Space web application allows attacker-controlled input from a GET request without sufficient input sanitization. A specially crafted request can exploit this vulnerability to execute arbitrary shell commands on the Junos Space Appliance. This issue affects Junos Space 24.1R1. Previous versions of Junos Space are unaffected by this vulnerability. |
| CVE-2021-0220 | Medium | 2021-01-15 | Outside Waratek scope | No public exploit | The Junos Space Network Management Platform has been found to store shared secrets in a recoverable format that can be exposed through the UI. An attacker who is able to execute arbitrary code in the victim browser (for example via XSS) or access cached contents may be able to obtain a copy of credentials managed by Junos Space. The impact of a successful attack includes, but is not limited to, obtaining access to other servers connected to the Junos Space Management Platform. This issue affects Juniper Networks Junos Space versions prior to 20.3R1. |
| CVE-2020-1611 | Medium | 2020-01-15 | Outside Waratek scope | Proof of concept only | A Local File Inclusion vulnerability in Juniper Networks Junos Space allows an attacker to view all files on the target when the device receives malicious HTTP packets. This issue affects: Juniper Networks Junos Space versions prior to 19.4R1. |
| CVE-2019-0017 | High | 2019-01-15 | Outside Waratek scope | No public exploit | The Junos Space application, which allows Device Image files to be uploaded, has insufficient validity checking which may allow uploading of malicious images or scripts, or other content types. Affected releases are Juniper Networks Junos Space versions prior to 18.3R1. |
| CVE-2019-0016 | Medium | 2019-01-15 | Outside Waratek scope | No public exploit | A malicious authenticated user may be able to delete a device from the Junos Space database without the necessary privileges through crafted Ajax interactions obtained from another legitimate delete action performed by another administrative user. Affected releases are Juniper Networks Junos Space versions prior to 18.3R1. |
| CVE-2018-0047 | High | 2018-10-10 | Outside Waratek scope | No public exploit | A persistent cross-site scripting vulnerability in the UI framework used by Junos Space Security Director may allow authenticated users to inject persistent and malicious scripts. This may allow stealing of information or performing actions as a different user when other users access the Security Director web interface. This issue affects all versions of Juniper Networks Junos Space Security Director prior to 17.2R2. |
| CVE-2018-0046 | High | 2018-10-10 | Outside Waratek scope | No public exploit | A reflected cross-site scripting vulnerability in OpenNMS included with Juniper Networks Junos Space may allow the stealing of sensitive information or session credentials from Junos Space administrators or perform administrative actions. This issue affects Juniper Networks Junos Space versions prior to 18.2R1. |
| CVE-2014-3413 | Critical | 2018-04-05 | Outside Waratek scope | No public exploit | The MySQL server in Juniper Networks Junos Space before 13.3R1.8 has an unspecified account with a hardcoded password, which allows remote attackers to obtain sensitive information and consequently obtain administrative control by leveraging database access. |
| CVE-2018-0013 | Medium | 2018-01-10 | Outside Waratek scope | No public exploit | A local file inclusion vulnerability in Juniper Networks Junos Space Network Management Platform may allow an authenticated user to retrieve files from the system. |
| CVE-2018-0012 | High | 2018-01-10 | Outside Waratek scope | No public exploit | Junos Space is affected by a privilege escalation vulnerability that may allow a local authenticated attacker to gain root privileges. |
| CVE-2018-0011 | Medium | 2018-01-10 | Outside Waratek scope | No public exploit | A reflected cross site scripting (XSS) vulnerability in Junos Space may potentially allow a remote authenticated user to inject web script or HTML and steal sensitive data and credentials from a session, and to perform administrative actions on the Junos Space network management device. |
| CVE-2018-0010 | Medium | 2018-01-10 | Outside Waratek scope | No public exploit | A vulnerability in the Juniper Networks Junos Space Security Director allows a user who does not have SSH access to a device to reuse the URL that was created for another user to perform SSH access. Affected releases are all versions of Junos Space Security Director prior to 17.2R1. |
| CVE-2017-10624 | High | 2017-10-13 | Outside Waratek scope | No public exploit | Insufficient verification of node certificates in Juniper Networks Junos Space may allow a man-in-the-middle type of attacker to make unauthorized modifications to Space database or add nodes. Affected releases are Juniper Networks Junos Space all versions prior to 17.1R1. |
| CVE-2017-10623 | High | 2017-10-13 | Outside Waratek scope | No public exploit | Lack of authentication and authorization of cluster messages in Juniper Networks Junos Space may allow a man-in-the-middle type of attacker to intercept, inject or disrupt Junos Space cluster operations between two nodes. Affected releases are Juniper Networks Junos Space all versions prior to 17.1R1. |
| CVE-2017-10622 | Critical | 2017-10-13 | Outside Waratek scope | No public exploit | An authentication bypass vulnerability in Juniper Networks Junos Space Network Management Platform may allow a remote unauthenticated network based attacker to login as any privileged user. This issue only affects Junos Space Network Management Platform 17.1R1 without Patch v1 and 16.1 releases prior to 16.1R3. This issue was found by an external security researcher. |
| CVE-2017-10612 | High | 2017-10-13 | Outside Waratek scope | No public exploit | A persistent site scripting vulnerability in Juniper Networks Junos Space allows users who can change certain configuration to implant malicious Javascript or HTML which may be used to steal information or perform actions as other Junos Space users or administrators. Affected releases are Juniper Networks Junos Space all versions prior to 17.1R1. |
| CVE-2016-1265 | Critical | 2017-10-13 | Outside Waratek scope | No public exploit | A remote unauthenticated network based attacker with access to Junos Space may execute arbitrary code on Junos Space or gain access to devices managed by Junos Space using cross site request forgery (CSRF), default authentication credentials, information leak and command injection attack vectors. All versions of Juniper Networks Junos Space prior to 15.1R3 are affected. |
| CVE-2017-2311 | Medium | 2017-05-30 | Outside Waratek scope | No public exploit | On Juniper Networks Junos Space versions prior to 16.1R1, an unauthenticated remote attacker with network access to Junos space device can easily create a denial of service condition. |
| CVE-2017-2310 | Medium | 2017-05-30 | Outside Waratek scope | No public exploit | A firewall bypass vulnerability in the host based firewall of Juniper Networks Junos Space versions prior to 16.1R1 may permit certain crafted packets, representing a network integrity risk. |
| CVE-2017-2309 | Medium | 2017-05-30 | Outside Waratek scope | No public exploit | On Juniper Networks Junos Space versions prior to 16.1R1 when certificate based authentication is enabled for the Junos Space cluster, some restricted web services are accessible over the network. This represents an information leak risk. |
| CVE-2017-2308 | Medium | 2017-05-30 | Outside Waratek scope | No public exploit | An XML External Entity Injection vulnerability in Juniper Networks Junos Space versions prior to 16.1R1 may allow an authenticated user to read arbitrary files on the device. |
| CVE-2017-2307 | Medium | 2017-05-30 | Outside Waratek scope | No public exploit | A reflected cross site scripting vulnerability in the administrative interface of Juniper Networks Junos Space versions prior to 16.1R1 may allow remote attackers to steal sensitive information or perform certain administrative actions on Junos Space. |
| CVE-2017-2306 | High | 2017-05-30 | Outside Waratek scope | No public exploit | On Juniper Networks Junos Space versions prior to 16.1R1, due to an insufficient authorization check, readonly users on the Junos Space administrative web interface can execute code on the device. |
| CVE-2017-2305 | High | 2017-05-30 | Outside Waratek scope | No public exploit | On Juniper Networks Junos Space versions prior to 16.1R1, due to an insufficient authorization check, readonly users on the Junos Space administrative web interface can create privileged users, allowing privilege escalation. |
| CVE-2016-4931 | Medium | 2017-03-20 | Outside Waratek scope | No public exploit | XML entity injection in Junos Space before 15.2R2 allows attackers to cause a denial of service. |
| CVE-2016-4930 | Medium | 2017-03-20 | Outside Waratek scope | No public exploit | Cross-site scripting (XSS) vulnerability in Junos Space before 15.2R2 allows remote attackers to steal sensitive information or perform certain administrative actions. |
| CVE-2016-4929 | High | 2017-03-20 | Outside Waratek scope | No public exploit | Command injection vulnerability in Junos Space before 15.2R2 allows attackers to execute arbitrary code as a root user. |
| CVE-2016-4928 | High | 2017-03-20 | Outside Waratek scope | No public exploit | Cross site request forgery vulnerability in Junos Space before 15.2R2 allows remote attackers to perform certain administrative actions on Junos Space. |
| CVE-2016-4927 | High | 2017-03-20 | Outside Waratek scope | No public exploit | Insufficient validation of SSH keys in Junos Space before 15.2R2 allows man-in-the-middle (MITM) type of attacks while a Space device is communicating with managed devices. |
| CVE-2016-4926 | Critical | 2017-03-20 | Outside Waratek scope | No public exploit | Insufficient authentication vulnerability in Junos Space before 15.2R2 allows remote network based users with access to Junos Space web interface to perform certain administrative tasks without authentication. |
| CVE-2015-2620 | Medium | 2015-07-16 | Outside Waratek scope | No public exploit | Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.23 and earlier allows remote authenticated users to affect confidentiality via unknown vectors related to Server : Security : Privileges. |
| CVE-2015-3209 | High | 2015-06-15 | Outside Waratek scope | No public exploit | Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending a packet with TXSTATUS_STARTPACKET set and then a crafted packet with TXSTATUS_DEVICEOWNS set. |
| CVE-2015-0501 | Medium | 2015-04-16 | Outside Waratek scope | No public exploit | Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier, and 5.6.23 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : Compiling. |
| CVE-2014-6559 | Medium | 2014-10-15 | Outside Waratek scope | No public exploit | Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier, and 5.6.20 and earlier, allows remote attackers to affect confidentiality via vectors related to C API SSL CERTIFICATE HANDLING. |
| CVE-2014-6500 | High | 2014-10-15 | Outside Waratek scope | No public exploit | Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier, and 5.6.20 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to SERVER:SSL:yaSSL, a different vulnerability than CVE-2014-6491. |
| CVE-2014-6496 | Medium | 2014-10-15 | Outside Waratek scope | No public exploit | Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier, and 5.6.20 and earlier, allows remote attackers to affect availability via vectors related to CLIENT:SSL:yaSSL, a different vulnerability than CVE-2014-6494. |
| CVE-2014-6495 | Medium | 2014-10-15 | Outside Waratek scope | No public exploit | Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier, and 5.6.19 and earlier, allows remote attackers to affect availability via vectors related to SERVER:SSL:yaSSL. |
| CVE-2014-6494 | Medium | 2014-10-15 | Outside Waratek scope | No public exploit | Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier, and 5.6.20 and earlier, allows remote attackers to affect availability via vectors related to CLIENT:SSL:yaSSL, a different vulnerability than CVE-2014-6496. |
| CVE-2014-6491 | High | 2014-10-15 | Outside Waratek scope | No public exploit | Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier and 5.6.20 and earlier allows remote attackers to affect confidentiality, integrity, and availability via vectors related to SERVER:SSL:yaSSL, a different vulnerability than CVE-2014-6500. |
| CVE-2014-6478 | Medium | 2014-10-15 | Outside Waratek scope | No public exploit | Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier, and 5.6.19 and earlier, allows remote attackers to affect integrity via vectors related to SERVER:SSL:yaSSL. |
| CVE-2014-3412 | High | 2014-05-20 | Outside Waratek scope | No public exploit | Unspecified vulnerability in Juniper Junos Space before 13.3R1.8, when the firewall in disabled, allows remote attackers to execute arbitrary commands via unspecified vectors. |
| CVE-2014-2421 | High | 2014-04-16 | Outside Waratek scope | No public exploit | Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JavaFX 2.2.51; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. |
| CVE-2014-0457 | High | 2014-04-16 | Outside Waratek scope | No public exploit | Unspecified vulnerability in Oracle Java SE 5.0u61, SE 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries. |
| CVE-2014-0456 | High | 2014-04-16 | Outside Waratek scope | No public exploit | Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot. |
| CVE-2014-0453 | Medium | 2014-04-16 | Outside Waratek scope | No public exploit | Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Security. |
| CVE-2014-0429 | High | 2014-04-16 | No exploit published | No public exploit | Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. |
| CVE-2013-5097 | Medium | 2013-08-16 | Outside Waratek scope | No public exploit | Juniper Junos Space before 13.1R1.6, as used on the JA1500 appliance and in other contexts, does not properly restrict access to the list of user accounts and their MD5 password hashes, which makes it easier for remote authenticated users to obtain sensitive information via a dictionary attack, aka PR 879462. |
| CVE-2013-5096 | Medium | 2013-08-16 | Outside Waratek scope | No public exploit | Juniper Junos Space before 13.1R1.6, as used on the JA1500 appliance and in other contexts, does not properly implement role-based access control, which allows remote authenticated users to modify the configuration by leveraging the read-only privilege, aka PR 863804. |
| CVE-2013-5095 | Medium | 2013-08-16 | Outside Waratek scope | No public exploit | Cross-site scripting (XSS) vulnerability in the web-based interface in Juniper Junos Space before 13.1R1.6, as used on the JA1500 appliance and in other contexts, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka PR 884469. |
| CVE-2013-3497 | Medium | 2013-05-08 | Outside Waratek scope | No public exploit | Juniper Junos Space before 12.3P2.8, as used on the JA1500 appliance and in other contexts, includes a cleartext password in a configuration tab, which makes it easier for physically proximate attackers to obtain the password by reading the workstation screen. |