CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2024-23607 – F5OS QKView utility vulnerability
https://notcve.org/view.php?id=CVE-2024-23607
A directory traversal vulnerability exists in the F5OS QKView utility that allows an authenticated attacker to read files outside the QKView directory. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Existe una vulnerabilidad de directory traversal en la utilidad F5OS QKView que permite a un atacante autenticado leer archivos fuera del directorio QKView. Nota: Las versiones de software que han llegado al final del soporte técnico (EoTS) no se evalúan. • https://my.f5.com/manage/s/article/K000132800 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.0EPSS: 0%CPEs: 3EXPL: 0CVE-2024-23976 – BIG-IP Appliance mode iAppsLX vulnerability
https://notcve.org/view.php?id=CVE-2024-23976
When running in Appliance mode, an authenticated attacker assigned the Administrator role may be able to bypass Appliance mode restrictions utilizing iAppsLX templates on a BIG-IP system. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated Cuando se ejecuta en modo Dispositivo, un atacante autenticado al que se le haya asignado la función de Administrador puede eludir las restricciones del modo Dispositivo utilizando plantillas iAppsLX en un sistema BIG-IP. Nota: Las versiones de software que han llegado al final del soporte técnico (EoTS) no se evalúan • https://my.f5.com/manage/s/article/K91054692 • CWE-266: Incorrect Privilege Assignment •
CVSS: 7.2EPSS: 0%CPEs: 3EXPL: 0CVE-2024-22389 – BIG-IP iControl REST API Vulnerability
https://notcve.org/view.php?id=CVE-2024-22389
When BIG-IP is deployed in high availability (HA) and an iControl REST API token is updated, the change does not sync to the peer device. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated Cuando BIG-IP se implementa en alta disponibilidad (HA) y se actualiza un token de API REST de iControl, el cambio no se sincroniza con el dispositivo par. Nota: Las versiones de software que han llegado al final del soporte técnico (EoTS) no se evalúan • https://my.f5.com/manage/s/article/K32544615 • CWE-613: Insufficient Session Expiration •
CVSS: 7.5EPSS: 0%CPEs: 14EXPL: 1CVE-2023-45886
https://notcve.org/view.php?id=CVE-2023-45886
The BGP daemon (bgpd) in IP Infusion ZebOS through 7.10.6 allow remote attackers to cause a denial of service by sending crafted BGP update messages containing a malformed attribute. BGP daemon (bgpd) en IP Infusion ZebOS hasta 7.10.6 permite a atacantes remotos provocar una Denegación de Servicio enviando mensajes de actualización de BGP manipulados que contienen un atributo con formato incorrecto. • https://blog.benjojo.co.uk/post/bgp-path-attributes-grave-error-handling https://my.f5.com/manage/s/article/K000137315 https://www.ipinfusion.com/doc_prod_cat/zebos https://www.kb.cert.org/vuls/id/347067 •
CVSS: 8.8EPSS: 0%CPEs: 100EXPL: 1CVE-2023-46748 – F5 BIG-IP Configuration Utility SQL Injection Vulnerability
https://notcve.org/view.php?id=CVE-2023-46748
An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an authenticated attacker with network access to the Configuration utility through the BIG-IP management port and/or self IP addresses to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated Existe una vulnerabilidad de inyección SQL autenticada en la utilidad de configuración BIG-IP que puede permitir que un atacante autenticado con acceso de red a la utilidad de configuración a través del puerto de administración BIG-IP y/o direcciones IP propias ejecute comandos arbitrarios del sistema. Nota: Las versiones de software que han llegado al End of Technical Support (EoTS) no se evalúan F5 BIG-IP Configuration utility contains an SQL injection vulnerability that may allow an authenticated attacker with network access through the BIG-IP management port and/or self IP addresses to execute system commands. This vulnerability can be used in conjunction with CVE-2023-46747. • https://my.f5.com/manage/s/article/K000137365 https://www.secpod.com/blog/f5-issues-warning-big-ip-vulnerability-used-in-active-exploit-chain • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •