CVSS: 8.8EPSS: 0%CPEs: 6EXPL: 0CVE-2021-23014
https://notcve.org/view.php?id=CVE-2021-23014
10 May 2021 — On versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.3, and 14.1.x before 14.1.4, BIG-IP Advanced WAF and ASM are missing authorization checks for file uploads to a specific directory within the REST API which might allow Authenticated users with guest privileges to upload files. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En las versiones 16.0.x anteriores a 16.0.1.1, versiones 15.1.x anteriores a 15.1.3 y 14.1.x anteriores a 14.1.4, BIG-IP Advanced WAF y... • https://support.f5.com/csp/article/K23203045 • CWE-862: Missing Authorization •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2021-23010
https://notcve.org/view.php?id=CVE-2021-23010
10 May 2021 — On versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.5, and 12.1.x before 12.1.5.3, when the BIG-IP ASM/Advanced WAF system processes WebSocket requests with JSON payloads using the default JSON Content Profile in the ASM Security Policy, the BIG-IP ASM bd process may produce a core file. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En las versiones 16.0.x anterior a 16.0.1.1, 15.1.x anteriores a 15.1.2, 14.1.... • https://support.f5.com/csp/article/K18570111 •
CVSS: 7.5EPSS: 0%CPEs: 28EXPL: 0CVE-2021-23009
https://notcve.org/view.php?id=CVE-2021-23009
10 May 2021 — On BIG-IP version 16.0.x before 16.0.1.1 and 15.1.x before 15.1.3, malformed HTTP/2 requests may cause an infinite loop which causes a Denial of Service for Data Plane traffic. TMM takes the configured HA action when the TMM process is aborted. There is no control plane exposure, this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En BIG-IP versión 16.0.x anterior a 16.0.1.1 y 15.1.x anterior a 15.1.3, las peticiones HTTP/2 malformad... • https://support.f5.com/csp/article/K90603426 • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 8.2EPSS: 0%CPEs: 56EXPL: 0CVE-2021-23012
https://notcve.org/view.php?id=CVE-2021-23012
10 May 2021 — On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.3, 14.1.x before 14.1.4, and 13.1.x before 13.1.4, lack of input validation for items used in the system support functionality may allow users granted either "Resource Administrator" or "Administrator" roles to execute arbitrary bash commands on BIG-IP. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En BIG-IP las versiones 16.0.x anteriores a 16.0.1.1, versiones 15.1.x anteriores a 15.1.3, 14.1.x ant... • https://support.f5.com/csp/article/K04234247 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.5EPSS: 0%CPEs: 70EXPL: 0CVE-2021-23013
https://notcve.org/view.php?id=CVE-2021-23013
10 May 2021 — On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.3, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, the Traffic Management Microkernel (TMM) may stop responding when processing Stream Control Transmission Protocol (SCTP) traffic under certain conditions. This vulnerability affects TMM by way of a virtual server configured with an SCTP profile. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En BIG-IP versiones 16.0.x anteri... • https://support.f5.com/csp/article/K04234247 •
CVSS: 7.5EPSS: 0%CPEs: 84EXPL: 0CVE-2021-23011
https://notcve.org/view.php?id=CVE-2021-23011
10 May 2021 — On versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.3, 14.1.x before 14.1.4, 13.1.x before 13.1.4, 12.1.x before 12.1.6, and 11.6.x before 11.6.5.3, when the BIG-IP system is buffering packet fragments for reassembly, the Traffic Management Microkernel (TMM) may consume an excessive amount of resources, eventually leading to a restart and failover event. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En las versiones 16.0.x anteriores a 16.0.1.1, versiones 1... • https://support.f5.com/csp/article/K10751325 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 8.8EPSS: 0%CPEs: 10EXPL: 0CVE-2021-22993
https://notcve.org/view.php?id=CVE-2021-22993
31 Mar 2021 — On BIG-IP Advanced WAF and BIG-IP ASM versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, DOM-based XSS on DoS Profile properties page. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. En BIG-IP Advanced WAF y BIG-IP ASM versiones 16.0.x anteriores de 16.0.1.1, versiones 15.1.x anteriores a 15.1.2, versiones 14.1.x anteriores a 14.1.3.1, versiones 13.1.x anteriores a 13.1.3.6 y vers... • https://support.f5.com/csp/article/K55237223 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 32EXPL: 1CVE-2021-23007
https://notcve.org/view.php?id=CVE-2021-23007
31 Mar 2021 — On BIG-IP versions 14.1.4 and 16.0.1.1, when the Traffic Management Microkernel (TMM) process handles certain undisclosed traffic, it may start dropping all fragmented IP traffic. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. En BIG-IP versiones 14.1.4 y 16.0.1.1, cuando el proceso Traffic Management Microkernel (TMM) maneja cierto tráfico no revelado, puede comenzar a eliminar todo el tráfico IP fragmentado. Nota: No se evalúan las versiones de softwa... • https://support.f5.com/csp/article/K37451543 •
CVSS: 7.5EPSS: 0%CPEs: 84EXPL: 0CVE-2021-23004
https://notcve.org/view.php?id=CVE-2021-23004
31 Mar 2021 — On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, Multipath TCP (MPTCP) forwarding flows may be created on standard virtual servers without MPTCP enabled in the applied TCP profile. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. En BIG-IP versiones 16.0.x anteriores a 16.0.1.1, versiones 15.1.x anteriores a 15.1.2, versiones 14.1.x anteriores a ... • https://support.f5.com/csp/article/K31025212 •
CVSS: 4.3EPSS: 0%CPEs: 84EXPL: 0CVE-2021-23001
https://notcve.org/view.php?id=CVE-2021-23001
31 Mar 2021 — On versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, the upload functionality in BIG-IP Advanced WAF and BIG-IP ASM allows an authenticated user to upload files to the BIG-IP system using a call to an undisclosed iControl REST endpoint. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. En las versiones 16.0.x anteriores a 16.0.1.1, versiones 15.1.x anteriore... • https://support.f5.com/csp/article/K06440657 • CWE-434: Unrestricted Upload of File with Dangerous Type •