CVSS: 8.7EPSS: 0%CPEs: 2EXPL: 0CVE-2024-41727 – BIG-IP TMM vulnerability
https://notcve.org/view.php?id=CVE-2024-41727
In BIG-IP tenants running on r2000 and r4000 series hardware, or BIG-IP Virtual Edition (VEs) using Intel E810 SR-IOV NIC, undisclosed traffic can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. • https://my.f5.com/manage/s/article/K000138833 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 8.2EPSS: 0%CPEs: 5EXPL: 0CVE-2024-41164 – BIG-IP MPTCP vulnerability
https://notcve.org/view.php?id=CVE-2024-41164
When TCP profile with Multipath TCP enabled (MPTCP) is configured on a Virtual Server, undisclosed traffic along with conditions beyond the attackers control can cause TMM to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. • https://my.f5.com/manage/s/article/K000138477 • CWE-476: NULL Pointer Dereference •
CVSS: 8.7EPSS: 0%CPEs: 3EXPL: 0CVE-2024-39778 – BIG-IP HSB vulnerability
https://notcve.org/view.php?id=CVE-2024-39778
When a stateless virtual server is configured on BIG-IP system with a High-Speed Bridge (HSB), undisclosed requests can cause TMM to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. • https://my.f5.com/manage/s/article/K05710614 • CWE CATEGORY •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2024-41723 – BIG-IP iControl REST vulnerability
https://notcve.org/view.php?id=CVE-2024-41723
Undisclosed requests to BIG-IP iControl REST can lead to information leak of user account names. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. • https://my.f5.com/manage/s/article/K10438187 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-34161 – NGINX HTTP/3 QUIC vulnerability
https://notcve.org/view.php?id=CVE-2024-34161
When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module and the network infrastructure supports a Maximum Transmission Unit (MTU) of 4096 or greater without fragmentation, undisclosed QUIC packets can cause NGINX worker processes to leak previously freed memory. Cuando NGINX Plus o NGINX OSS están configurados para usar el módulo HTTP/3 QUIC y la infraestructura de red admite una unidad de transmisión máxima (MTU) de 4096 o más sin fragmentación, los paquetes QUIC no revelados pueden hacer que los procesos de trabajo de NGINX pierdan memoria previamente liberada. • http://www.openwall.com/lists/oss-security/2024/05/30/4 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MLAOKJWDALQZBIV3WKGPJ6T5Z56D3PRD https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R7RPLWC35WHEUFCGKNFG62ESNID25TEZ https://my.f5.com/manage/s/article/K000139627 • CWE-416: Use After Free •