Unscored severity · published Feb 9, 2009
CVE-2008-6096
Cross-site scripting (XSS) vulnerability in Juniper NetScreen ScreenOS before 5.4r10, 6.0r6, and 6.1r2 allows remote attackers to inject arbitrary web script or HTML via the user…
–
CVSS
1%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in Juniper NetScreen ScreenOS before 5.4r10, 6.0r6, and 6.1r2 allows remote attackers to inject arbitrary web script or HTML via the user name parameter to the (1) web interface login page or the (2) telnet login page.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 64% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NS
Netscreen Screenos · Juniper
1.6.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-6096
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-6096
Vendor Advisory
http://secunia.com/advisories/32078
www.layereddefense.com
http://www.layereddefense.com/netscreen01oct.html
www.securityfocus.com
http://www.securityfocus.com/bid/31528
www.vupen.com
http://www.vupen.com/english/advisories/2008/2713
More from Netscreen Screenos
5.4
CVE-2018-0059
A persistent cross-site scripting vulnerability in the graphical user interface of ScreenOS may allow a remote authenticated user to inject web script or HTML and steal sensitive…
–
CVE-2005-2640
Behavioral discrepancy information leak in Juniper Netscreen VPN running ScreenOS 5.2.0 and earlier, when using IKE with pre-shared key authentication, allows remote attackers to…
–
CVE-2004-1446
Unknown vulnerability in ScreenOS in Juniper Networks NetScreen firewall 3.x through 5.x allows remote attackers to cause a denial of service (device reboot or hang) via a crafted…
–
CVE-2002-1547
Netscreen running ScreenOS 4.0.0r6 and earlier allows remote attackers to cause a denial of service via a malformed SSH packet to the Secure Command Shell (SCS) management…
–
CVE-2002-2150
Firewalls from multiple vendors empty state tables more slowly than they are filled, which allows remote attackers to flood state tables with packet flooding attacks such as (1)…