CVSS: 9.1EPSS: 2%CPEs: 81EXPL: 2CVE-2019-10744 – nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties
https://notcve.org/view.php?id=CVE-2019-10744
Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload. Las versiones de lodash inferiores a 4.17.12, son vulnerables a la Contaminación de Prototipo. La función defaultsDeep podría ser engañada para agregar o modificar las propiedades de Object.prototype usando una carga útil de constructor. A Prototype Pollution vulnerability was found in lodash. • https://github.com/ossf-cve-benchmark/CVE-2019-10744 https://access.redhat.com/errata/RHSA-2019:3024 https://security.netapp.com/advisory/ntap-20191004-0005 https://snyk.io/vuln/SNYK-JS-LODASH-450202 https://support.f5.com/csp/article/K47105354?utm_source=f5support&%3Butm_medium=RSS https://www.oracle.com/security-alerts/cpujan2021.html https://www.oracle.com/security-alerts/cpuoct2020.html https://access.redhat.com/security/cve/CVE-2019-10744 https://bugzilla.redhat.com/show_ • CWE-20: Improper Input Validation CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') •
CVSS: 5.3EPSS: 0%CPEs: 78EXPL: 0CVE-2019-6640
https://notcve.org/view.php?id=CVE-2019-6640
On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.1-11.5.8, SNMP exposes sensitive configuration objects over insecure transmission channels. This issue is exposed when a passphrase is inserted into various profile types and accessed using SNMPv2. En BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4 y 11.5.1-11.5 .8, SNMP expone objetos de configuración sensibles sobre canales de transmisión no seguros. Este problema se expone cuando una frase de contraseña se inserta en varios tipos de perfil y se accede mediante SNMPv2. • http://www.securityfocus.com/bid/109089 https://support.f5.com/csp/article/K40443301 https://support.f5.com/csp/article/K40443301?utm_source=f5support&%3Butm_medium=RSS • CWE-319: Cleartext Transmission of Sensitive Information •
CVSS: 6.5EPSS: 0%CPEs: 26EXPL: 0CVE-2019-6638
https://notcve.org/view.php?id=CVE-2019-6638
On BIG-IP 14.1.0-14.1.0.5 and 14.0.0-14.0.0.4, Malformed http requests made to an undisclosed iControl REST endpoint can lead to infinite loop of the restjavad process. En BIG-IP 14.1.0-14.1.0.5 y 14.0.0-14.0.0.4, las solicitudes http mal formadas realizadas en un punto final REST de iControl no revelado pueden llevar a un bucle infinito del proceso de restjavad. • http://www.securityfocus.com/bid/109106 https://support.f5.com/csp/article/K67825238 https://support.f5.com/csp/article/K67825238?utm_source=f5support&%3Butm_medium=RSS • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 6.5EPSS: 0%CPEs: 52EXPL: 0CVE-2019-6634
https://notcve.org/view.php?id=CVE-2019-6634
On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, a high volume of malformed analytics report requests leads to instability in restjavad process. This causes issues with both iControl REST and some portions of TMUI. The attack requires an authenticated user with any role. En BIG-IP versiones 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, y 12.1.0-12.1.4 un gran volumen de solicitudes de informes de análisis mal formados conduce a la inestabilidad en el proceso de restjavad. Esto causa problemas tanto con iControl REST como con algunas partes de TMUI. • http://www.securityfocus.com/bid/109104 https://support.f5.com/csp/article/K64855220 •
CVSS: 4.4EPSS: 0%CPEs: 78EXPL: 0CVE-2019-6635
https://notcve.org/view.php?id=CVE-2019-6635
On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.1-11.5.8, when the BIG-IP system is licensed for Appliance mode, a user with either the Administrator or the Resource Administrator role can bypass Appliance mode restrictions. En BIG-IP versiones 4.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, y 11.5.1-11.5.8, cuando el sistema BIG-IP tiene licencia para el modo Appliance, un usuario con los roles de administrador o administrador de recursos puede saltarse las restricciones del Appliance Mode. • http://www.securityfocus.com/bid/109098 https://support.f5.com/csp/article/K11330536 https://support.f5.com/csp/article/K11330536?utm_source=f5support&%3Butm_medium=RSS •