A number of vulnerabilities affect Junos Space releases before 13.1R1.6 which have been addressed in the 13.1R1.6 release:

• CVE-2013-5095 A reflected cross site scripting vulnerability affects Junos Space web based interface. This may allow a remote attacker to obtain sensitive information from Junos Space users (PR 884469).
• CVE-2013-5096 A vulnerability in Junos Space role based access control implementation may allow users with read-only privilege to make configuration changes (PR 863804).
• CVE-2013-5097 A password disclosure vulnerability may allow authenticated users to obtain a list of all users and their MD5 hashed passwords. One may then use dictionary type of attacks to retrieve the passwords (PR 879462).
• CVE-2012-0053, CVE-2011-4317, CVE-2011-3368 Apache http server used in Junos Space is affected by a number of vulnerabilities. Some of which may pose a security risk to Junos Space (PR 860167).

These vulnerabilities have been fixed in Junos Space 13.1R1.6 released 29th June 2013. All subsequent releases will also contain the fix.

There are no viable workarounds that can mitigate all these vulnerabilities.
To reduce exposure to Apache vulnerabilities use access lists or firewall filters to limit access to Junos Space from only trusted networks.

• KB16613: Overview of the Juniper Networks SIRT Monthly Security Bulletin Publication Process [juniper.net]
• KB16765: In which releases are vulnerabilities fixed? [juniper.net]
• KB16446: Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories [juniper.net]
• Report a Vulnerability - How to Contact the Juniper Networks Security Incident Response Team