CVSS: 9.8EPSS: 71%CPEs: 70EXPL: 1CVE-2021-22991 – F5 BIG-IP Traffic Management Microkernel Buffer Overflow
https://notcve.org/view.php?id=CVE-2021-22991
11 Mar 2021 — On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, undisclosed requests to a virtual server may be incorrectly handled by the Traffic Management Microkernel (TMM) URI normalization, which may trigger a buffer overflow, resulting in a DoS attack. In certain situations, it may theoretically allow bypass of URL based access control or remote code execution (RCE). Note: Software versions which have reached End of Software ... • https://packetstorm.news/files/id/161752 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 8.3EPSS: 0%CPEs: 84EXPL: 0CVE-2021-22978
https://notcve.org/view.php?id=CVE-2021-22978
12 Feb 2021 — On BIG-IP version 16.0.x before 16.0.1, 15.1.x before 15.1.1, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.5, and all 12.1.x and 11.6.x versions, undisclosed endpoints in iControl REST allow for a reflected XSS attack, which could lead to a complete compromise of BIG-IP if the victim user is granted the admin role. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. En BIG-IP versiones 16.0.x anteriores a 16.0.1, versiones 15.1.x anteriores a 15.1.1, versiones 14... • https://support.f5.com/csp/article/K87502622 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 70EXPL: 0CVE-2021-22979
https://notcve.org/view.php?id=CVE-2021-22979
12 Feb 2021 — On BIG-IP version 16.0.x before 16.0.1, 15.1.x before 15.1.1, 14.1.x before 14.1.2.8, 13.1.x before 13.1.3.5, and all 12.1.x versions, a reflected Cross-Site Scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility when Fraud Protection Service is provisioned and allows an attacker to execute JavaScript in the context of the current logged-in user. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. En BIG-IP versiones 16.0.... • https://support.f5.com/csp/article/K63497634 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 58EXPL: 0CVE-2021-22974
https://notcve.org/view.php?id=CVE-2021-22974
12 Feb 2021 — On BIG-IP version 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, and 13.1.x before 13.1.3.6 and all versions of BIG-IQ 7.x and 6.x, an authenticated attacker with access to iControl REST over the control plane may be able to take advantage of a race condition to execute commands with an elevated privilege level. This vulnerability is due to an incomplete fix for CVE-2017-6167. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. En BIG-IP ve... • https://support.f5.com/csp/article/K68652018 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 7.5EPSS: 0%CPEs: 50EXPL: 0CVE-2021-22973
https://notcve.org/view.php?id=CVE-2021-22973
12 Feb 2021 — On BIG-IP version 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.5, and all 12.1.x versions, JSON parser function does not protect against out-of-bounds memory accesses or writes. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. En BIG-IP versiones 16.0.x anteriores a 16.0.1.1, versiones 15.1.x anteriores a 15.1.2, versiones 14.1.x anteriores a 14.1.3.1, versiones 13.1.x anteriores a 13.1.3.5 y todas las versiones de... • https://support.f5.com/csp/article/K13323323 • CWE-787: Out-of-bounds Write •
CVSS: 4.9EPSS: 0%CPEs: 44EXPL: 0CVE-2020-27727
https://notcve.org/view.php?id=CVE-2020-27727
24 Dec 2020 — On BIG-IP version 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.3, and 13.1.0-13.1.3.4, when an authenticated administrative user installs RPMs using the iAppsLX REST installer, the BIG-IP system does not sufficiently validate user input, allowing the user read access to the filesystem. En BIG-IP versiones 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.3 y 13.1.0-13.1.3.4, cuando un usuario administrativo autenticado instala unas RPM usando el instalador REST iAppsLX, el sistema BIG-IP no comprueba suficient... • https://support.f5.com/csp/article/K50343630 • CWE-20: Improper Input Validation •
CVSS: 4.3EPSS: 0%CPEs: 15EXPL: 0CVE-2020-27725
https://notcve.org/view.php?id=CVE-2020-27725
24 Dec 2020 — In version 15.1.0-15.1.0.5, 14.1.0-14.1.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2 of BIG-IP DNS, GTM, and Link Controller, zxfrd leaks memory when listing DNS zones. Zones can be listed via TMSH, iControl or SNMP; only users with access to those services can trigger this vulnerability. En las versiones 15.1.0-15.1.0.5, 14.1.0-14.1.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2 y 11.6.1-11.6.5.2 de BIG-IP DNS, GTM, y Link Controller, zxfrd filtra memoria al listar las zonas DNS. Las zonas pueden ser... • https://support.f5.com/csp/article/K25595031 • CWE-401: Missing Release of Memory after Effective Lifetime •
CVSS: 7.5EPSS: 0%CPEs: 12EXPL: 0CVE-2020-27721
https://notcve.org/view.php?id=CVE-2020-27721
24 Dec 2020 — In versions 16.0.0-16.0.0.1, 15.1.0-15.1.1, 14.1.0-14.1.3, 13.1.0-13.1.3.5, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, in a BIG-IP DNS / BIG-IP LTM GSLB deployment, under certain circumstances, the BIG-IP DNS system may stop using a BIG-IP LTM virtual server for DNS response. En las versiones 16.0.0-16.0.0.1, 15.1.0-15.1.1, 14.1.0-14.1.3, 13.1.0-13.1.3.5, 12.1.0-12.1.5.2 y 11.6.1-11.6.5.2 , en una implementación de BIG-IP DNS / BIG-IP LTM GSLB, bajo determinadas circunstancias, el sistema BIG-IP DNS puede dejar ... • https://support.f5.com/csp/article/K52035247 •
CVSS: 7.5EPSS: 0%CPEs: 28EXPL: 0CVE-2020-5949
https://notcve.org/view.php?id=CVE-2020-5949
11 Dec 2020 — On BIG-IP versions 14.0.0-14.0.1 and 13.1.0-13.1.3.4, certain traffic pattern sent to a virtual server configured with an FTP profile can cause the FTP channel to break. En BIG-IP versiones 14.0.0-14.0.1 y 13.1.0-13.1.3.4, un determinado patrón de tráfico enviado a un servidor virtual configurado con un perfil FTP puede causar que el canal FTP se interrumpa • https://support.f5.com/csp/article/K20984059 •
CVSS: 9.6EPSS: 0%CPEs: 44EXPL: 0CVE-2020-5948
https://notcve.org/view.php?id=CVE-2020-5948
11 Dec 2020 — On BIG-IP versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.2.7, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, undisclosed endpoints in iControl REST allow for a reflected XSS attack, which could lead to a complete compromise of the BIG-IP system if the victim user is granted the admin role. En BIG-IP versiones 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.2.7, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2 y 11.6.1- 11.6.5.2, los endpoints no divulgados en iControl REST permiten un ataque de tipo XSS refle... • https://support.f5.com/csp/article/K42696541 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •