CVE-2025-59988

In Junos Space versions prior to 16.1R1, due to an insufficient authorization check, readonly users on the administrative web interface can execute code on the device.

In Junos Space versions prior to 16.1R1, there is a vulnerability due to insufficient authorization checks that allows readonly users on the administrative web interface to create privileged users, enabling privilege escalation.

CVE-2016-4929 in Junos Space before version 15.2R2 contains a vulnerability that allows attackers to execute arbitrary code as a root user.

CVE-2016-4928 is a cross-site request forgery vulnerability in Junos Space before version 15.2R2 that allows remote attackers to perform certain administrative actions.

Insufficient validation of SSH keys in Junos Space before version 15.2R2 allows man-in-the-middle (MITM) type attacks while a Space device is communicating with managed devices.

CVE-2016-1265 allows a remote unauthenticated attacker with access to Junos Space to execute arbitrary code or gain access to devices managed by Junos Space. It exploits attack vectors such as CSRF, default authentication credentials, information leak, and command injection.

CVE-2016-4926 describes an insufficient authentication vulnerability in Junos Space before version 15.2R2, allowing remote users with access to the Junos Space web interface to perform certain administrative tasks without authentication.

A Cross-site Scripting (XSS) vulnerability was found in Juniper Networks Junos Space in the list filter field. It allows an attacker to inject malicious script tags that, when visited by another user (including an administrator), execute commands with the target's permissions. All versions before 24.1R5 Patch V3 are affected.

Junos Space before version 24.1R4 contains an XSS vulnerability that allows an attacker to inject script tags on the Generate Report page. When another user visits this page, the attacker can execute commands with the target's permissions, including administrator.

Junos Space before version 24.1R4 contains an XSS vulnerability that allows an attacker to inject script tags on template creation pages. When another user visits these pages, the attacker can execute commands with the target's permissions, including administrator.