CVSS: 5.3EPSS: 0%CPEs: 78EXPL: 0CVE-2017-6153
https://notcve.org/view.php?id=CVE-2017-6153
01 Jun 2018 — Features in F5 BIG-IP 13.0.0-13.1.0.3, 12.1.0-12.1.3.1, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1 system that utilizes inflate functionality directly, via an iRule, or via the inflate code from PEM module are subjected to a service disruption via a "Zip Bomb" attack. Las características en el sistema F5 BIG-IP 13.0.0-13.1.0.3, 12.1.0-12.1.3.1, 11.6.1-11.6.3.1, 11.5.1-11.5.5 o 11.2.1 que emplean directamente la funcionalidad inflate, mediante un iRule o mediante el código inflate del módulo PEM están sujetos... • http://www.securitytracker.com/id/1041024 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 4.7EPSS: 0%CPEs: 44EXPL: 0CVE-2018-5516
https://notcve.org/view.php?id=CVE-2018-5516
02 May 2018 — On F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.2, or 11.2.1-11.6.3.1, Enterprise Manager 3.1.1, BIG-IQ Centralized Management 5.0.0-5.4.0 or 4.6.0, BIG-IQ Cloud and Orchestration 1.0.0, or F5 iWorkflow 2.0.2-2.3.0, authenticated users granted TMOS Shell (tmsh) access can access objects on the file system which would normally be disallowed by tmsh restrictions. This allows for authenticated, low privileged attackers to exfiltrate objects on the file system which should not be allowed. En F5 BIG-IP 13.0.0-13.1.0.5... • http://www.securitytracker.com/id/1040799 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 5.5EPSS: 0%CPEs: 39EXPL: 0CVE-2018-5519
https://notcve.org/view.php?id=CVE-2018-5519
02 May 2018 — On F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.3.3, or 11.2.1-11.6.3.1, administrative users by way of undisclosed methods can exploit the ssldump utility to write to arbitrary file paths. For users who do not have Advanced Shell access (for example, any user when licensed for Appliance Mode), this allows more permissive file access than intended. En F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.3.3 o 11.2.1-11.6.3.1, los usuarios administrativos pueden explotar la utilidad ssldump por medio de métodos no revelados par... • http://www.securitytracker.com/id/1040803 •
CVSS: 4.4EPSS: 0%CPEs: 39EXPL: 0CVE-2018-5520
https://notcve.org/view.php?id=CVE-2018-5520
02 May 2018 — On an F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.3.1, or 11.2.1-11.6.3.1 system configured in Appliance mode, the TMOS Shell (tmsh) may allow an administrative user to use the dig utility to gain unauthorized access to file system resources. En un sistema F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.3.1 o 11.2.1-11.6.3.1 configurado en modo Appliance, TMOS Shell (tmsh) podría permitir que un usuario administrativo emplee la utilidad dig para obtener acceso no autorizado a los recursos del sistema de archivos. • http://www.securitytracker.com/id/1040798 • CWE-863: Incorrect Authorization •
CVSS: 6.5EPSS: 0%CPEs: 52EXPL: 0CVE-2017-6158
https://notcve.org/view.php?id=CVE-2017-6158
13 Apr 2018 — In F5 BIG-IP 12.0.0-12.1.2, 11.6.0-11.6.1, 11.5.1-11.5.5, or 11.2.1 there is a vulnerability in TMM related to handling of invalid IP addresses. En F5 BIG-IP, de la versión 12.0.0 a la 12.1.2, de la versión 11.6.0 a la 11.6.1, de la versión 11.5.1 a la 11.5.5 o en la versión 11.2.1, hay una vulnerabilidad en TMM relacionada con la gestión de direcciones IP no válidas. • https://support.f5.com/csp/article/K19361245 •
CVSS: 9.8EPSS: 0%CPEs: 65EXPL: 0CVE-2018-5506
https://notcve.org/view.php?id=CVE-2018-5506
13 Apr 2018 — In F5 BIG-IP 13.0.0, 12.1.0-12.1.2, 11.6.1, 11.5.1-11.5.5, or 11.2.1 the Apache modules apache_auth_token_mod and mod_auth_f5_auth_token.cpp allow possible unauthenticated bruteforce on the em_server_ip authorization parameter to obtain which SSL client certificates used for mutual authentication between BIG-IQ or Enterprise Manager (EM) and managed BIG-IP devices. En F5 BIG-IP, en su versión 13.0.0, de la versión 12.1.0a la 12.1.2, la versión 11.6.1, de la versión 11.5.1 a la 11.5.5 o en la versión 11.2.1,... • https://support.f5.com/csp/article/K65355492 •
CVSS: 7.5EPSS: 0%CPEs: 78EXPL: 0CVE-2018-5510
https://notcve.org/view.php?id=CVE-2018-5510
13 Apr 2018 — On F5 BIG-IP 11.5.4 HF4-11.5.5, the Traffic Management Microkernel (TMM) may restart when processing a specific sequence of packets on IPv6 virtual servers. En F5 BIG-IP, en su versión 11.5.4 HF4-11.5.5, el TMM (Traffic Management Microkernel) podría reiniciarse al procesar una secuencia determinada de paquetes en los servidores virtuales IPv6. • https://support.f5.com/csp/article/K77671456 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 91EXPL: 0CVE-2018-5507
https://notcve.org/view.php?id=CVE-2018-5507
13 Apr 2018 — On F5 BIG-IP versions 13.0.0, 12.1.0-12.1.3.1, 11.6.1-11.6.2, or 11.5.1-11.5.5, vCMP guests running on VIPRION 2100, 4200 and 4300 series blades cannot correctly decrypt ciphertext from established SSL sessions with small MTU. En F5 BIG-IP, en versiones 13.0.0, de la versión 12.1.0 a la 12.1.3.1, de la versión 11.6.1 a la 11.6.2 o de la versión 11.5.1 a la 11.5.5, los invitados vCMP que se ejecutan en blades VIPRION de las series 2100, 4200 y 4300 no puedes descifrar correctamente el texto cifrado de las se... • https://support.f5.com/csp/article/K52521791 •
CVSS: 6.4EPSS: 0%CPEs: 52EXPL: 0CVE-2017-6156
https://notcve.org/view.php?id=CVE-2017-6156
13 Apr 2018 — When the F5 BIG-IP 12.1.0-12.1.1, 11.6.0-11.6.1, 11.5.1-11.5.5, or 11.2.1 system is configured with a wildcard IPSec tunnel endpoint, it may allow a remote attacker to disrupt or impersonate the tunnels that have completed phase 1 IPSec negotiations. The attacker must possess the necessary credentials to negotiate the phase 1 of the IPSec exchange to exploit this vulnerability; in many environment this limits the attack surface to other endpoints under the same administration. Cuando el sistema F5 BIG-IP, d... • https://support.f5.com/csp/article/K05263202 •
CVSS: 5.9EPSS: 0%CPEs: 22EXPL: 0CVE-2014-4024
https://notcve.org/view.php?id=CVE-2014-4024
19 Mar 2018 — SSL virtual servers in F5 BIG-IP systems 10.x before 10.2.4 HF9, 11.x before 11.2.1 HF12, 11.3.0 before HF10, 11.4.0 before HF8, 11.4.1 before HF5, 11.5.0 before HF5, and 11.5.1 before HF5, when used with third-party Secure Sockets Layer (SSL) accelerator cards, might allow remote attackers to have unspecified impact via a timing side-channel attack. Los servidores virtuales SSL en sistemas F5 BIG-IP, en versiones 10.x anteriores a la 10.2.4 HF9, versiones 11.x anteriores a la 11.2.1 HF12, versiones 11.3.0 ... • https://exchange.xforce.ibmcloud.com/vulnerabilities/95834 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •