CVSS: 7.5EPSS: 0%CPEs: 57EXPL: 0CVE-2018-15328
https://notcve.org/view.php?id=CVE-2018-15328
12 Dec 2018 — On BIG-IP 14.0.x, 13.x, 12.x, and 11.x, Enterprise Manager 3.1.1, BIG-IQ 6.x, 5.x, and 4.x, and iWorkflow 2.x, the passphrases for SNMPv3 users and trap destinations that are used for authentication and privacy are not handled by the BIG-IP system Secure Vault feature; they are written in the clear to the various configuration files. En BIG-IP 14.0.x, 13.x, 12.x y 11.x, Enterprise Manager 3.1.1, BIG-IQ 6.x, 5.x y 4.x, e iWorkflow 2.x, las frases de contraseña para los usuarios SNMPv3 y destinos de captura q... • http://www.securityfocus.com/bid/106258 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.9EPSS: 0%CPEs: 26EXPL: 0CVE-2018-15323
https://notcve.org/view.php?id=CVE-2018-15323
31 Oct 2018 — On BIG-IP 14.0.0-14.0.0.2 or 13.0.0-13.1.1.1, in certain circumstances, when processing traffic through a Virtual Server with an associated MQTT profile, the TMM process may produce a core file and take the configured HA action. En BIG-IP 14.0.0-14.0.0.2 o 13.0.0-13.1.1.1, en ciertas circunstancias, al procesar tráfico mediante un servidor virtual con un perfil MQTT asociado, el proceso TMM podría producir un archivo core y tomar la acción HA configurada. • https://support.f5.com/csp/article/K26583415 • CWE-20: Improper Input Validation •
CVSS: 7.8EPSS: 0%CPEs: 39EXPL: 0CVE-2018-15318
https://notcve.org/view.php?id=CVE-2018-15318
31 Oct 2018 — In BIG-IP 14.0.0-14.0.0.2, 13.1.0.4-13.1.1.1, or 12.1.3.4-12.1.3.6, If an MPTCP connection receives an abort signal while the initial flow is not the primary flow, the initial flow will remain after the closing procedure is complete. TMM may restart and produce a core file as a result of this condition. En BIG-IP 14.0.0-14.0.0.2, 13.1.0.4-13.1.1.1 o 12.1.3.4-12.1.3.6, si una conexión MPTCP recibe una señal de aborto mientras el flujo inicial no es el primario, el flujo inicial se mantendrá una vez se comple... • https://support.f5.com/csp/article/K16248201 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 26EXPL: 0CVE-2018-15320
https://notcve.org/view.php?id=CVE-2018-15320
31 Oct 2018 — On BIG-IP 14.0.0-14.0.0.2 or 13.0.0-13.1.1.1, undisclosed traffic patterns may lead to denial of service conditions for the BIG-IP system. The configuration which exposes this condition is the BIG-IP self IP address which is part of a VLAN group and has the Port Lockdown setting configured with anything other than "allow-all". En BIG-IP 14.0.0-14.0.0.2 o 13.0.0-13.1.1.1, los patrones de tráfico no divulgados podrían conducir a denegaciones de servicio (DoS) para el sistema BIG-IP. La configuración que expon... • https://support.f5.com/csp/article/K72442354 •
CVSS: 4.3EPSS: 0%CPEs: 26EXPL: 0CVE-2018-15325
https://notcve.org/view.php?id=CVE-2018-15325
31 Oct 2018 — In BIG-IP 14.0.0-14.0.0.2 or 13.0.0-13.1.1.1, iControl and TMSH usage by authenticated users may leak a small amount of memory when executing commands En BIG-IP 14.0.0-14.0.0.2 o 13.0.0-13.1.1.1, el uso de iControl y TMSH por parte de usuarios podría filtrar una pequeña cantidad de memoria al ejecutar comandos. • https://support.f5.com/csp/article/K77313277 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.5EPSS: 0%CPEs: 65EXPL: 0CVE-2018-15317
https://notcve.org/view.php?id=CVE-2018-15317
31 Oct 2018 — In BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.5, 12.1.0-12.1.4.1, and 11.2.1-11.6.3.2, an attacker sending specially crafted SSL records to a SSL Virtual Server will cause corruption in the SSL data structures leading to intermittent decrypt BAD_RECORD_MAC errors. Clients will be unable to access the application load balanced by a virtual server with an SSL profile until tmm is restarted. En BIG-IP versión 14.0.0 hasta 4.0.0.2, versión 13.0.0 hasta 13.1.1.5, versión 12.1.0 hasta 12.1.4.1 y versión 11.2.1 hasta 1... • https://support.f5.com/csp/article/K43625118 •
CVSS: 7.2EPSS: 0%CPEs: 27EXPL: 0CVE-2018-15327
https://notcve.org/view.php?id=CVE-2018-15327
31 Oct 2018 — In BIG-IP 14.0.0-14.0.0.2 or 13.0.0-13.1.1.1 or Enterprise Manager 3.1.1, when authenticated administrative users run commands in the Traffic Management User Interface (TMUI), also referred to as the BIG-IP Configuration utility, restrictions on allowed commands may not be enforced. En BIG-IP14.0.0-14.0.0.2 o 13.0.0-13.1.1.1, o Enterprise Manager 3.1.1, cuando los usuarios administrativos autenticados ejecutan comandos en el TMUI (Traffic Management User Interface), también llamado utilidad BIG-IP Configura... • https://support.f5.com/csp/article/K20222812 • CWE-862: Missing Authorization •
CVSS: 6.5EPSS: 0%CPEs: 71EXPL: 0CVE-2018-15322
https://notcve.org/view.php?id=CVE-2018-15322
31 Oct 2018 — On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.0.7, 12.1.0-12.1.3.5, 11.6.0-11.6.3.2, or 11.2.1-11.5.6, BIG-IQ Centralized Management 6.0.0-6.0.1, 5.0.0-5.4.0 or 4.6.0, BIG-IQ Cloud and Orchestration 1.0.0, iWorkflow 2.0.1-2.3.0, or Enterprise Manager 3.1.1 a BIG-IP user granted with tmsh access may cause the BIG-IP system to experience denial-of-service (DoS) when the BIG-IP user uses the tmsh utility to run the edit cli preference command and proceeds to save the changes to another filename repeatedly. This actio... • https://support.f5.com/csp/article/K28003839 •
CVSS: 7.8EPSS: 0%CPEs: 39EXPL: 0CVE-2018-15319
https://notcve.org/view.php?id=CVE-2018-15319
31 Oct 2018 — On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.1, or 12.1.0-12.1.3.6, malicious requests made to virtual servers with an HTTP profile can cause the TMM to restart. The issue is exposed with the non-default "normalize URI" configuration options used in iRules and/or BIG-IP LTM policies. En BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.1 o 12.1.0-12.1.3.6, las peticiones maliciosas realizadas a los servidores virtuales con un perfil HTTP pueden provocar que TMM se reinicie. El problema está expuesto a las opciones de confi... • http://www.securityfocus.com/bid/107052 • CWE-20: Improper Input Validation •
CVSS: 5.5EPSS: 0%CPEs: 70EXPL: 0CVE-2018-15321
https://notcve.org/view.php?id=CVE-2018-15321
31 Oct 2018 — When BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.0.5, 12.1.0-12.1.3.5, 11.6.0-11.6.3.2, or 11.2.1-11.5.6, BIG-IQ Centralized Management 5.0.0-5.4.0 or 4.6.0, BIG-IQ Cloud and Orchestration 1.0.0, iWorkflow 2.1.0-2.3.0, or Enterprise Manager 3.1.1 is licensed for Appliance Mode, Admin and Resource administrator roles can by-pass BIG-IP Appliance Mode restrictions to overwrite critical system files. Attackers of high privilege level are able to overwrite critical system files which bypasses security controls in place... • https://support.f5.com/csp/article/K01067037 • CWE-269: Improper Privilege Management •