CVSS: 7.5EPSS: 0%CPEs: 42EXPL: 0CVE-2021-22975
https://notcve.org/view.php?id=CVE-2021-22975
12 Feb 2021 — On BIG-IP version 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, and 14.1.x before 14.1.3.1, under some circumstances, Traffic Management Microkernel (TMM) may restart on the BIG-IP system while passing large bursts of traffic. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. En BIG-IP versiones 16.0.x anteriores a 16.0.1.1, versiones 15.1.x anteriores a 15.1.2.1 y versiones 14.1.x anteriores a 14.1.3.1, en algunas circunstancias, Traffic Management Microkern... • https://support.f5.com/csp/article/K21971977 •
CVSS: 6.1EPSS: 0%CPEs: 42EXPL: 0CVE-2020-27719
https://notcve.org/view.php?id=CVE-2020-27719
24 Dec 2020 — On BIG-IP 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.3, a cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility. En BIG-IP versiones 16.0.0-16.0.0.1, 15.1.0-15.1.0.5 y 14.1.0-14.1.3, se presenta una vulnerabilidad de tipo cross-site scripting (XSS) en una página no revelada de la utilidad BIG-IP Configuration • https://support.f5.com/csp/article/K19166530 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.8EPSS: 0%CPEs: 22EXPL: 0CVE-2020-27715
https://notcve.org/view.php?id=CVE-2020-27715
24 Dec 2020 — On BIG-IP 15.1.0-15.1.0.5 and 14.1.0-14.1.3, crafted TLS request to the BIG-IP management interface via port 443 can cause high (~100%) CPU utilization by the httpd daemon. En BIG-IP 15.1.0-15.1.0.5 y 14.1.0-14.1.3, una petición TLS diseñada a la interfaz de administración de BIG-IP por medio del puerto 443 puede causar una alta utilización de CPU (~100%) por el demonio httpd • https://support.f5.com/csp/article/K25691186 •
CVSS: 4.9EPSS: 0%CPEs: 44EXPL: 0CVE-2020-27727
https://notcve.org/view.php?id=CVE-2020-27727
24 Dec 2020 — On BIG-IP version 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.3, and 13.1.0-13.1.3.4, when an authenticated administrative user installs RPMs using the iAppsLX REST installer, the BIG-IP system does not sufficiently validate user input, allowing the user read access to the filesystem. En BIG-IP versiones 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.3 y 13.1.0-13.1.3.4, cuando un usuario administrativo autenticado instala unas RPM usando el instalador REST iAppsLX, el sistema BIG-IP no comprueba suficient... • https://support.f5.com/csp/article/K50343630 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 28EXPL: 0CVE-2020-5949
https://notcve.org/view.php?id=CVE-2020-5949
11 Dec 2020 — On BIG-IP versions 14.0.0-14.0.1 and 13.1.0-13.1.3.4, certain traffic pattern sent to a virtual server configured with an FTP profile can cause the FTP channel to break. En BIG-IP versiones 14.0.0-14.0.1 y 13.1.0-13.1.3.4, un determinado patrón de tráfico enviado a un servidor virtual configurado con un perfil FTP puede causar que el canal FTP se interrumpa • https://support.f5.com/csp/article/K20984059 •
CVSS: 9.6EPSS: 0%CPEs: 44EXPL: 0CVE-2020-5948
https://notcve.org/view.php?id=CVE-2020-5948
11 Dec 2020 — On BIG-IP versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.2.7, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, undisclosed endpoints in iControl REST allow for a reflected XSS attack, which could lead to a complete compromise of the BIG-IP system if the victim user is granted the admin role. En BIG-IP versiones 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.2.7, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2 y 11.6.1- 11.6.5.2, los endpoints no divulgados en iControl REST permiten un ataque de tipo XSS refle... • https://support.f5.com/csp/article/K42696541 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 28EXPL: 0CVE-2020-5943
https://notcve.org/view.php?id=CVE-2020-5943
05 Nov 2020 — In versions 14.1.0-14.1.0.1 and 14.1.2.5-14.1.2.7, when a BIG-IP object is created or listed through the REST interface, the protected fields are obfuscated in the REST response, not protected via a SecureVault cryptogram as TMSH does. One example of protected fields is the GTM monitor password. En las versiones 14.1.0-14.1.0.1 y 14.1.2.5-14.1.2.7, cuando un objeto de BIG-IP es creado o listado por medio de la interfaz REST, los campos protegidos están ofuscados en la respuesta de REST, no se protegen por m... • https://support.f5.com/csp/article/K20059815 • CWE-327: Use of a Broken or Risky Cryptographic Algorithm •
CVSS: 8.5EPSS: 0%CPEs: 33EXPL: 0CVE-2020-5945
https://notcve.org/view.php?id=CVE-2020-5945
05 Nov 2020 — In BIG-IP versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.2.7, undisclosed TMUI page contains a stored cross site scripting vulnerability (XSS). The issue allows a minor privilege escalation for resource admin to escalate to full admin. En BIG-IP versiones 16.0.0-16.0.0.1, 15.1.0-15.1.0.5 y 14.1.0-14.1.2.7, la página TMUI no revelada contiene una vulnerabilidad de tipo cross site scripting almacenado. El problema permite una escalada de privilegios menor para un administrador de recursos esc... • https://support.f5.com/csp/article/K21540525 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 39EXPL: 0CVE-2020-5940
https://notcve.org/view.php?id=CVE-2020-5940
05 Nov 2020 — In versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.2.3, a stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Traffic Management User Interface (TMUI), also known as the BIG-IP Configuration utility. En las versiones 16.0.0-16.0.0.1, 15.1.0-15.1.0.5 y 14.1.0-14.1.2.3, se presenta una vulnerabilidad de tipo cross-site scripting (XSS) almacenado en una página no revelada de BIG-IP Traffic Management User Interface (TMUI), también se conoce como la utilidad BI... • https://support.f5.com/csp/article/K43310520 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 56EXPL: 0CVE-2020-5939
https://notcve.org/view.php?id=CVE-2020-5939
05 Nov 2020 — In versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.3, 15.0.0-15.0.1.3, 14.1.0-14.1.2.6, and 13.1.0-13.1.3.4, BIG-IP Virtual Edition (VE) systems on VMware, with an Intel-based 85299 Network Interface Controller (NIC) card and Single Root I/O Virtualization (SR-IOV) enabled on vSphere, may fail and leave the Traffic Management Microkernel (TMM) in a state where it cannot transmit traffic. En las versiones 16.0.0-16.0.0.1, 15.1.0-15.1.0.3, 15.0.0-15.0.1.3, 14.1.0-14.1.2.6 y 13.1.0-13.1.3.4, BIG-IP Virtual Edition (VE... • https://support.f5.com/csp/article/K75111593 •