cve,link,title,description,vendor,products,score,severity,epss,cisa,cisa_published,article,ransomware,exploited,exploited_date,poc,trended,trended_no_1,trended_no_1_date,published,trended_score
CVE-2024-30381,https://securityvulnerability.io/vulnerability/CVE-2024-30381,Unauthorized Access to Sensitive Information in Paragon Active Assurance Control Center,"A vulnerability has been identified within the Juniper Networks Paragon Active Assurance Control Center that allows unauthorized access to sensitive information. Specifically, the issue resides in the 'netrounds-probe-login' daemon, also known as probe_serviced, which facilitates various operations related to the Test Agent Appliance. This daemon inadvertently exposes functions that allow network-adjacent attackers with root access to retrieve sensitive details about downstream devices by accessing an internal database object. This vulnerability affects specific versions of the Paragon Active Assurance, including versions 4.1.0 and 4.2.0, highlighting a significant security risk for users relying on this platform.",Juniper Networks,Paragon Active Assurance,8.4,HIGH,0.0004299999854993075,false,,false,false,false,,,false,false,,2024-04-12T14:56:38.299Z,0
CVE-2024-21589,https://securityvulnerability.io/vulnerability/CVE-2024-21589,Paragon Active Assurance Control Center: Information disclosure vulnerability,"An Improper Access Control vulnerability exists in the Juniper Networks Paragon Active Assurance Control Center, allowing unauthenticated network-based attackers to gain unauthorized access to sensitive reports. This vulnerability could enable malicious actors to exfiltrate user data by bypassing authentication requirements. The issue originated from a feature introduced in version 3.1.0, designed to permit selective sharing of account data. It is crucial for users of the affected versions to assess their systems and apply necessary mitigations, as the SaaS offering of Paragon Active Assurance remains unaffected.",Juniper Networks,Paragon Active Assurance,7.4,HIGH,0.0011099999537691474,false,,false,false,false,,,false,false,,2024-01-12T01:15:00.000Z,0
CVE-2023-28971,https://securityvulnerability.io/vulnerability/CVE-2023-28971,Paragon Active Assurance: Enabling the timescaledb enables IP forwarding,"A vulnerability exists in the timescaledb feature of Juniper Networks' Paragon Active Assurance that allows attackers to bypass critical firewall restrictions set for internal communications. This issue primarily affects customers managing their own on-premises Control Centers, where the timescaledb feature, when activated, disrupts existing firewall configurations. This results in unintended communication pathways between Test Agents and the Control Center, potentially exposing sensitive internal data. It's crucial to note that this vulnerability does not impact customers utilizing the Software as a Service (SaaS) version of Paragon Active Assurance, as the problematic service is not enabled.",Juniper Networks,Paragon Active Assurance,7.2,HIGH,0.0004400000034365803,false,,false,false,false,,,false,false,,2023-04-17T00:00:00.000Z,0
CVE-2022-22229,https://securityvulnerability.io/vulnerability/CVE-2022-22229,Paragon Active Assurance (Formerly Netrounds): Stored Cross-site Scripting (XSS) vulnerability in web administration,"An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability, a stored XSS (or persistent), in the Control Center Controller web pages of Juniper Networks Paragon Active Assurance (Formerly Netrounds) allows a high-privilege attacker with 'WRITE' permissions to store one or more malicious scripts that will infect any other authorized user's account when they accidentally trigger the malicious script(s) while managing the device. Triggering these attacks enables the attacker to execute commands with the permissions up to that of the superuser account. This issue affects: Juniper Networks Paragon Active Assurance (Formerly Netrounds) All versions prior to 3.1.1; 3.2 versions prior to 3.2.1.",Juniper Networks,Paragon Active Assurance (formerly Netrounds),8.4,HIGH,0.0004400000034365803,false,,false,false,true,2024-08-03T04:16:18.000Z,,false,false,,2022-10-18T03:15:00.000Z,0
CVE-2022-22190,https://securityvulnerability.io/vulnerability/CVE-2022-22190,Paragon Active Assurance Control Center: Information disclosure vulnerability in crafted URL,"An Improper Access Control vulnerability in the Juniper Networks Paragon Active Assurance Control Center allows an unauthenticated attacker to leverage a crafted URL to generate PDF reports, potentially containing sensitive configuration information. A feature was introduced in version 3.1 of the Paragon Active Assurance Control Center which allows users to selective share account data using a unique identifier. Knowing the proper format of the URL and the identifier of an existing object in an application it is possible to get access to that object without being logged in, even if the object is not shared, resulting in the opportunity for malicious exfiltration of user data. Note that the Paragon Active Assurance Control Center SaaS offering is not affected by this issue. This issue affects Juniper Networks Paragon Active Assurance version 3.1.0.",Juniper Networks,Paragon Active Assurance,7.4,HIGH,0.0016799999866634607,false,,false,false,false,,,false,false,,2022-04-14T16:15:00.000Z,0
CVE-2021-0232,https://securityvulnerability.io/vulnerability/CVE-2021-0232,Paragon Active Assurance: Authentication bypass vulnerability in Control Center,"An authentication bypass vulnerability in the Juniper Networks Paragon Active Assurance Control Center may allow an attacker with specific information about the deployment to mimic an already registered Test Agent and access its configuration including associated inventory details. If the issue occurs, the affected Test Agent will not be able to connect to the Control Center. This issue affects Juniper Networks Paragon Active Assurance Control Center All versions prior to 2.35.6; 2.36 versions prior to 2.36.2.",Juniper Networks,Paragon Active Assurance,7.4,HIGH,0.0024399999529123306,false,,false,false,false,,,false,false,,2021-04-22T20:15:00.000Z,0