Overview 51 matches · 1 in Waratek scope · 1 protected · 0 exploited · 0 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
51matches
1in Waratek scope2.0%
1protected2.0%
0exploited0.0%
0CISA KEV0.0%
1public PoC2.0%
0EPSS ≥ 0.50.0%
Protected by Waratek
1
2.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
50
98.0%
Not applicable
0
0.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
1
2.0%
partly blocked
0
0.0%
not blocked
50
98.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
0
0.0%
Proof of concept only
1
2.0%
Forecast only
0
0.0%
No public exploit
50
98.0%
split by
peak 23 / year
20134
Outside Waratek scope4
Medium4
not blocked4
No public exploit4
20147
Protected by Waratek1
Outside Waratek scope6
Medium7
blocked by ARMR today1
not blocked6
No public exploit7
20152
Outside Waratek scope2
Medium2
not blocked2
No public exploit2
20160
20177
Outside Waratek scope7
Medium7
not blocked7
No public exploit7
20183
Outside Waratek scope3
Medium3
not blocked3
No public exploit3
20191
Outside Waratek scope1
Medium1
not blocked1
No public exploit1
20201
Outside Waratek scope1
Medium1
not blocked1
Proof of concept only1
20211
Outside Waratek scope1
Medium1
not blocked1
No public exploit1
20220
20230
20241
Outside Waratek scope1
Medium1
not blocked1
No public exploit1
202523
Outside Waratek scope23
Medium23
not blocked23
No public exploit23
20261
Outside Waratek scope1
Medium1
not blocked1
No public exploit1
2014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-21904 | Medium | 2026-04-09 | Outside Waratek scope | No public exploit | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the list filter field that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator. This issue affects all versions of Junos Space before 24.1R5 Patch V3. |
| CVE-2025-60009 | Medium | 2025-10-09 | Outside Waratek scope | No public exploit | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the CLI Configlet page that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator. This issue affects all versions of Junos Space before 24.1R4. |
| CVE-2025-60002 | Medium | 2025-10-09 | Outside Waratek scope | No public exploit | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the Template Definitions page that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator. This issue affects all versions of Junos Space before 24.1R4. |
| CVE-2025-60001 | Medium | 2025-10-09 | Outside Waratek scope | No public exploit | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the Generate Report page that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator. This issue affects all versions of Junos Space before 24.1R4. |
| CVE-2025-60000 | Medium | 2025-10-09 | Outside Waratek scope | No public exploit | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the Generate Report page that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator. This issue affects all versions of Junos Space before 24.1R4. |
| CVE-2025-59999 | Medium | 2025-10-09 | Outside Waratek scope | No public exploit | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the API Access Profiles page that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator. This issue affects all versions of Junos Space before 24.1R4. |
| CVE-2025-59998 | Medium | 2025-10-09 | Outside Waratek scope | No public exploit | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the Archive Log screen that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator. This issue affects all versions of Junos Space before 24.1R4. |
| CVE-2025-59997 | Medium | 2025-10-09 | Outside Waratek scope | No public exploit | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the CLI Configlets pages that, when visited by another user, enable the attacker to execute commands with the target's permissions, including an administrator. This issue affects all versions of Junos Space before 24.1R4. |
| CVE-2025-59996 | Medium | 2025-10-09 | Outside Waratek scope | No public exploit | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the Configuration View page that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator. This issue affects all versions of Junos Space before 24.1R4. |
| CVE-2025-59995 | Medium | 2025-10-09 | Outside Waratek scope | No public exploit | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the Quick Template page that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator. This issue affects all versions of Junos Space before 24.1R4. |
| CVE-2025-59994 | Medium | 2025-10-09 | Outside Waratek scope | No public exploit | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the Quick Template page that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator. This issue affects all versions of Junos Space before 24.1R4. |
| CVE-2025-59993 | Medium | 2025-10-09 | Outside Waratek scope | No public exploit | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the Space Node Setting fields that, when visited by another user, enable the attacker to execute commands with the target's permissions, including an administrator. This issue affects all versions of Junos Space before 24.1R4. |
| CVE-2025-59992 | Medium | 2025-10-09 | Outside Waratek scope | No public exploit | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the Secure Console page that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator. This issue affects all versions of Junos Space before 24.1R4. |
| CVE-2025-59991 | Medium | 2025-10-09 | Outside Waratek scope | No public exploit | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the Device Management pages that, when visited by another user, enable the attacker to execute commands with the target's permissions, including an administrator. This issue affects all versions of Junos Space before 24.1R4. |
| CVE-2025-59990 | Medium | 2025-10-09 | Outside Waratek scope | No public exploit | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the template creation pages that, when visited by another user, enable the attacker to execute commands with the target's permissions, including an administrator. This issue affects all versions of Junos Space before 24.1R4. |
| CVE-2025-59989 | Medium | 2025-10-09 | Outside Waratek scope | No public exploit | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the Device Discovery page that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator. This issue affects all versions of Junos Space before 24.1R4. |
| CVE-2025-59988 | Medium | 2025-10-09 | Outside Waratek scope | No public exploit | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the Generate Report page that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator. This issue affects all versions of Junos Space before 24.1R4. |
| CVE-2025-59987 | Medium | 2025-10-09 | Outside Waratek scope | No public exploit | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the arbitrary device search field that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator.This issue affects all versions of Junos Space before 24.1R4. |
| CVE-2025-59986 | Medium | 2025-10-09 | Outside Waratek scope | No public exploit | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the input fields in Model Devices that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator.This issue affects all versions of Junos Space before 24.1R4. |
| CVE-2025-59985 | Medium | 2025-10-09 | Outside Waratek scope | No public exploit | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in a field on the Purging Policy page that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator.This issue affects all versions of Junos Space before 24.1R4. |
| CVE-2025-59984 | Medium | 2025-10-09 | Outside Waratek scope | No public exploit | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in Global Search that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator.This issue affects all versions of Junos Space before 24.1R4. |
| CVE-2025-59983 | Medium | 2025-10-09 | Outside Waratek scope | No public exploit | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the Template Definition page, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator.This issue affects all versions of Junos Space before 24.1R4. |
| CVE-2025-59982 | Medium | 2025-10-09 | Outside Waratek scope | No public exploit | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the dashboard search field that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator.This issue affects all versions of Junos Space before 24.1R4. |
| CVE-2025-59981 | Medium | 2025-10-09 | Outside Waratek scope | No public exploit | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the Device Template Definition page that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator.This issue affects all versions of Junos Space before 24.1R4. |
| CVE-2024-39563 | Medium | 2024-10-11 | Outside Waratek scope | No public exploit | A Command Injection vulnerability in Juniper Networks Junos Space allows an unauthenticated, network-based attacker sending a specially crafted request to execute arbitrary shell commands on the Junos Space Appliance, leading to remote command execution by the web application, gaining complete control of the device. A specific script in the Junos Space web application allows attacker-controlled input from a GET request without sufficient input sanitization. A specially crafted request can exploit this vulnerability to execute arbitrary shell commands on the Junos Space Appliance. This issue affects Junos Space 24.1R1. Previous versions of Junos Space are unaffected by this vulnerability. |
| CVE-2021-0220 | Medium | 2021-01-15 | Outside Waratek scope | No public exploit | The Junos Space Network Management Platform has been found to store shared secrets in a recoverable format that can be exposed through the UI. An attacker who is able to execute arbitrary code in the victim browser (for example via XSS) or access cached contents may be able to obtain a copy of credentials managed by Junos Space. The impact of a successful attack includes, but is not limited to, obtaining access to other servers connected to the Junos Space Management Platform. This issue affects Juniper Networks Junos Space versions prior to 20.3R1. |
| CVE-2020-1611 | Medium | 2020-01-15 | Outside Waratek scope | Proof of concept only | A Local File Inclusion vulnerability in Juniper Networks Junos Space allows an attacker to view all files on the target when the device receives malicious HTTP packets. This issue affects: Juniper Networks Junos Space versions prior to 19.4R1. |
| CVE-2019-0016 | Medium | 2019-01-15 | Outside Waratek scope | No public exploit | A malicious authenticated user may be able to delete a device from the Junos Space database without the necessary privileges through crafted Ajax interactions obtained from another legitimate delete action performed by another administrative user. Affected releases are Juniper Networks Junos Space versions prior to 18.3R1. |
| CVE-2018-0013 | Medium | 2018-01-10 | Outside Waratek scope | No public exploit | A local file inclusion vulnerability in Juniper Networks Junos Space Network Management Platform may allow an authenticated user to retrieve files from the system. |
| CVE-2018-0011 | Medium | 2018-01-10 | Outside Waratek scope | No public exploit | A reflected cross site scripting (XSS) vulnerability in Junos Space may potentially allow a remote authenticated user to inject web script or HTML and steal sensitive data and credentials from a session, and to perform administrative actions on the Junos Space network management device. |
| CVE-2018-0010 | Medium | 2018-01-10 | Outside Waratek scope | No public exploit | A vulnerability in the Juniper Networks Junos Space Security Director allows a user who does not have SSH access to a device to reuse the URL that was created for another user to perform SSH access. Affected releases are all versions of Junos Space Security Director prior to 17.2R1. |
| CVE-2017-2311 | Medium | 2017-05-30 | Outside Waratek scope | No public exploit | On Juniper Networks Junos Space versions prior to 16.1R1, an unauthenticated remote attacker with network access to Junos space device can easily create a denial of service condition. |
| CVE-2017-2310 | Medium | 2017-05-30 | Outside Waratek scope | No public exploit | A firewall bypass vulnerability in the host based firewall of Juniper Networks Junos Space versions prior to 16.1R1 may permit certain crafted packets, representing a network integrity risk. |
| CVE-2017-2309 | Medium | 2017-05-30 | Outside Waratek scope | No public exploit | On Juniper Networks Junos Space versions prior to 16.1R1 when certificate based authentication is enabled for the Junos Space cluster, some restricted web services are accessible over the network. This represents an information leak risk. |
| CVE-2017-2308 | Medium | 2017-05-30 | Outside Waratek scope | No public exploit | An XML External Entity Injection vulnerability in Juniper Networks Junos Space versions prior to 16.1R1 may allow an authenticated user to read arbitrary files on the device. |
| CVE-2017-2307 | Medium | 2017-05-30 | Outside Waratek scope | No public exploit | A reflected cross site scripting vulnerability in the administrative interface of Juniper Networks Junos Space versions prior to 16.1R1 may allow remote attackers to steal sensitive information or perform certain administrative actions on Junos Space. |
| CVE-2016-4931 | Medium | 2017-03-20 | Outside Waratek scope | No public exploit | XML entity injection in Junos Space before 15.2R2 allows attackers to cause a denial of service. |
| CVE-2016-4930 | Medium | 2017-03-20 | Outside Waratek scope | No public exploit | Cross-site scripting (XSS) vulnerability in Junos Space before 15.2R2 allows remote attackers to steal sensitive information or perform certain administrative actions. |
| CVE-2015-2620 | Medium | 2015-07-16 | Outside Waratek scope | No public exploit | Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.23 and earlier allows remote authenticated users to affect confidentiality via unknown vectors related to Server : Security : Privileges. |
| CVE-2015-0501 | Medium | 2015-04-16 | Outside Waratek scope | No public exploit | Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier, and 5.6.23 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : Compiling. |
| CVE-2014-6559 | Medium | 2014-10-15 | Outside Waratek scope | No public exploit | Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier, and 5.6.20 and earlier, allows remote attackers to affect confidentiality via vectors related to C API SSL CERTIFICATE HANDLING. |
| CVE-2014-6496 | Medium | 2014-10-15 | Outside Waratek scope | No public exploit | Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier, and 5.6.20 and earlier, allows remote attackers to affect availability via vectors related to CLIENT:SSL:yaSSL, a different vulnerability than CVE-2014-6494. |
| CVE-2014-6495 | Medium | 2014-10-15 | Outside Waratek scope | No public exploit | Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier, and 5.6.19 and earlier, allows remote attackers to affect availability via vectors related to SERVER:SSL:yaSSL. |
| CVE-2014-6494 | Medium | 2014-10-15 | Outside Waratek scope | No public exploit | Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier, and 5.6.20 and earlier, allows remote attackers to affect availability via vectors related to CLIENT:SSL:yaSSL, a different vulnerability than CVE-2014-6496. |
| CVE-2014-6478 | Medium | 2014-10-15 | Outside Waratek scope | No public exploit | Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier, and 5.6.19 and earlier, allows remote attackers to affect integrity via vectors related to SERVER:SSL:yaSSL. |
| CVE-2014-0460 | Medium | 2014-04-16 | Protected by Waratek | No public exploit | Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality and integrity via vectors related to JNDI. |
| CVE-2014-0453 | Medium | 2014-04-16 | Outside Waratek scope | No public exploit | Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Security. |
| CVE-2013-5097 | Medium | 2013-08-16 | Outside Waratek scope | No public exploit | Juniper Junos Space before 13.1R1.6, as used on the JA1500 appliance and in other contexts, does not properly restrict access to the list of user accounts and their MD5 password hashes, which makes it easier for remote authenticated users to obtain sensitive information via a dictionary attack, aka PR 879462. |
| CVE-2013-5096 | Medium | 2013-08-16 | Outside Waratek scope | No public exploit | Juniper Junos Space before 13.1R1.6, as used on the JA1500 appliance and in other contexts, does not properly implement role-based access control, which allows remote authenticated users to modify the configuration by leveraging the read-only privilege, aka PR 863804. |
| CVE-2013-5095 | Medium | 2013-08-16 | Outside Waratek scope | No public exploit | Cross-site scripting (XSS) vulnerability in the web-based interface in Juniper Junos Space before 13.1R1.6, as used on the JA1500 appliance and in other contexts, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka PR 884469. |
| CVE-2013-3497 | Medium | 2013-05-08 | Outside Waratek scope | No public exploit | Juniper Junos Space before 12.3P2.8, as used on the JA1500 appliance and in other contexts, includes a cleartext password in a configuration tab, which makes it easier for physically proximate attackers to obtain the password by reading the workstation screen. |