Page 15 of 311 results (0.030 seconds)

CVSS: 9.8EPSS: 97%CPEs: 66EXPL: 50

CVE-2022-1388 – F5 BIG-IP Missing Authentication Vulnerability

https://notcve.org/view.php?id=CVE-2022-1388

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated En F5 BIG-IP versiones 16.1.x anteriores a 16.1.2.2, versiones 15.1.x anteriores a 15.1.5.1, versiones 14.1.x anteriores a 14.1.4.6, versiones 13.1.x anteriores a 13.1.5 y todas las versiones 12.1.x y 11.6.x, las peticiones no reveladas pueden omitir la autenticación REST de iControl. Nota: las versiones de software que han alcanzado el Fin del Soporte Técnico (EoTS) no son evaluadas F5 BIG-IP contains a missing authentication in critical function vulnerability which can allow for remote code execution, creation or deletion of files, or disabling services. • https://github.com/alt3kx/CVE-2022-1388_PoC https://www.exploit-db.com/exploits/50932 https://github.com/horizon3ai/CVE-2022-1388 https://github.com/0xf4n9x/CVE-2022-1388 https://github.com/doocop/CVE-2022-1388-EXP https://github.com/ZephrFish/F5-CVE-2022-1388-Exploit https://github.com/numanturle/CVE-2022-1388 https://github.com/sherlocksecurity/CVE-2022-1388-Exploit-POC https://github.com/Al1ex/CVE-2022-1388 https://github.com/jheeree/CVE-2022-1388-checker https: • CWE-306: Missing Authentication for Critical Function •

CVSS: 5.5EPSS: 0%CPEs: 33EXPL: 0

CVE-2022-27636

https://notcve.org/view.php?id=CVE-2022-27636

On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, as well as F5 BIG-IP APM Clients 7.x versions prior to 7.2.1.5, BIG-IP Edge Client may log sensitive APM session-related information when VPN is launched on a Windows system. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated En F5 BIG-IP APM versiones 16.1.x anteriores a 16.1.2.2, las versiones 15.1.x anteriores a 15.1.5.1, las versiones 14.1.x anteriores a 14.1.4.6, las versiones 13.1.x anteriores a 13.1.5, y todas las versiones de 12.1. x y 11.6.x, así como las versiones de F5 BIG-IP APM Clients 7.x anteriores a 7.2.1.5, BIG-IP Edge Client puede registrar información confidencial relacionada con la sesión de APM cuando es iniciada la VPN en un sistema Windows. Nota: Las versiones de software que han alcanzado el Fin del Soporte Técnico (EoTS) no son evaluadas • https://support.f5.com/csp/article/K57110035 • CWE-532: Insertion of Sensitive Information into Log File •

CVSS: 7.5EPSS: 0%CPEs: 19EXPL: 0

CVE-2022-27230

https://notcve.org/view.php?id=CVE-2022-27230

On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP APM, and F5 BIG-IP Guided Configuration (GC) all versions prior to 9.0, a reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of F5 BIG-IP Guided Configuration that allows an attacker to execute JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated En todas las versiones de 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, y 11.6.x de F5 BIG-IP APM, y F5 BIG-IP Guided Configuration (GC) todas las versiones anteriores a 9.0, Se presenta una vulnerabilidad de tipo cross-site scripting (XSS) reflejado en una página no revelada de F5 BIG-IP Guided Configuration que permite a un atacante ejecutar JavaScript en el contexto del usuario actualmente conectado. Nota: Las versiones de software que han alcanzado el Fin del Soporte Técnico (EoTS) no son evaluadas • https://support.f5.com/csp/article/K21317311 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 7.5EPSS: 0%CPEs: 341EXPL: 0

CVE-2022-27189

https://notcve.org/view.php?id=CVE-2022-27189

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, when an Internet Content Adaptation Protocol (ICAP) profile is configured on a virtual server, undisclosed traffic can cause an increase in Traffic Management Microkernel (TMM) memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated En F5 BIG-IP versiones 16.1.x anteriores a 16.1.2.2, en las versiones 15.1.x anteriores a 15.1.5.1, en las versiones 14.1.x anteriores a 14.1.4.6, en las versiones 13.1.x anteriores a 13.1.5 y en todas las versiones de 12.1.x y 11.6.x, cuando es configurado un perfil de protocolo de adaptación de contenidos de Internet (ICAP) en un servidor virtual, el tráfico no revelado puede causar un aumento en el uso de recursos de memoria del Traffic Management Microkernel (TMM). Nota: Las versiones de software que han alcanzado el Fin del Soporte Técnico (EoTS) no son evaluadas • https://support.f5.com/csp/article/K16187341 • CWE-681: Incorrect Conversion between Numeric Types •

CVSS: 5.3EPSS: 0%CPEs: 18EXPL: 0

CVE-2022-27181

https://notcve.org/view.php?id=CVE-2022-27181

On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, when APM is configured on a virtual server and the associated access profile is configured with APM AAA NTLM Auth, undisclosed requests can cause an increase in internal resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated En F5 BIG-IP APM versiones 16.1.x anteriores a 16.1.2.2, en las versiones 15.1.x anteriores a 15.1.5.1, en las versiones 14.1.x anteriores a 14.1.4.6, en las versiones 13.1.x anteriores a 13.1.5 y en todas las versiones de 12.1.x y 11.6.x, cuando APM está configurado en un servidor virtual y el perfil de acceso asociado está configurado con APM AAA NTLM Auth, las peticiones no reveladas pueden causar un aumento en el uso de recursos internos. Nota: Las versiones de software que han alcanzado el Fin del Soporte Técnico (EoTS) no son evaluadas • https://support.f5.com/csp/article/K93543114 • CWE-400: Uncontrolled Resource Consumption •