CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 1CVE-2012-1777 – F5 FirePass SSL VPN 6.x / 7.x SQL Injection
https://notcve.org/view.php?id=CVE-2012-1777
SQL injection vulnerability in my.activation.php3 in F5 FirePass 6.0.0 through 6.1.0 and 7.0.0 allows remote attackers to execute arbitrary SQL commands via the state parameter. Una vulnerabilidad de inyección SQL en my.activation.php3 en F5 FirePass v6.0.0 a 6.1.0 y v7.0.0 permite a atacantes remotos ejecutar comandos SQL a través del parámetro state. F5 FirePass SSL VPN versions 6.0.0 through 6.1.0 and 7.0.0 suffers from a remote SQL injection vulnerability that allows for remote root access. • http://packetstormsecurity.org/files/111276/F5-FirePass-SSL-VPN-6.x-7.x-SQL-Injection.html http://seclists.org/fulldisclosure/2012/Mar/324 http://secunia.com/advisories/48455 http://support.f5.com/kb/en-us/solutions/public/13000/400/sol13463.html http://www.securitytracker.com/id?1026834 https://exchange.xforce.ibmcloud.com/vulnerabilities/74198 https://exchange.xforce.ibmcloud.com/vulnerabilities/74450 https://www.sec-consult.com/files/20120328-0_F5_FirePass_SSL_VPN_unauthenticated_remote_ro • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.1EPSS: 1%CPEs: 26EXPL: 0CVE-2011-3188 – kernel: net: improve sequence number generation
https://notcve.org/view.php?id=CVE-2011-3188
The (1) IPv4 and (2) IPv6 implementations in the Linux kernel before 3.1 use a modified MD4 algorithm to generate sequence numbers and Fragment Identification values, which makes it easier for remote attackers to cause a denial of service (disrupted networking) or hijack network sessions by predicting these values and sending crafted packets. Las implementaciones de (1) IPv4 y (2) IPv6 en el kernel de Linux antes de v3.1 utiliza una versión modificada de algoritmo MD4 para generar números de secuencia y valores de los fragmentos de identificación, lo que hace que sea más fácil para los atacantes remotos causar una denegación de servicio (red interrumpida) o secuestrar sesiones de red mediante la predicción de estos valores y el envío de paquetes manipulados. • http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=6e5714eaf77d79ae1c8b47e3e040ff5411b717ec http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=bc0b96b54a21246e377122d54569eef71cec535f http://marc.info/?l=bugtraq&m=139447903326211&w=2 http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.1 http://www.openwall.com/lists/oss-security/2011/08/23/2 https://bugzilla.redhat.com/show_bug.cgi?id=732658 https://github.com/torval •
CVSS: 4.3EPSS: 0%CPEs: 7EXPL: 0CVE-2009-2119
https://notcve.org/view.php?id=CVE-2009-2119
Cross-site scripting (XSS) vulnerability in the login interface (my.logon.php3) in F5 FirePass SSL VPN 5.5 through 5.5.2 and 6.0 through 6.0.3 allows remote attackers to inject arbitrary web script or HTML via a base64-encoded xcho parameter. Vulnerabilidad de ejecución de secuencias de comandos cruzados(XSS) en el interface de autenticación de F5 FirePass SSL VPN v5.5 hasta v5.5.2 y 6.0 hasta v6.0.3 , permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección a través de un campo password manipulado. NOTA: algunos de estos detalles se han obtenido de terceros. • http://osvdb.org/55040 http://secunia.com/advisories/35418 http://secunia.com/advisories/35426 http://www.securityfocus.com/archive/1/504232/100/0/threaded http://www.securityfocus.com/bid/35312 http://www.securitytracker.com/id?1022387 http://www.vupen.com/english/advisories/2009/1570 https://exchange.xforce.ibmcloud.com/vulnerabilities/51064 https://www.fox-it.com/nl/nieuws-en-events/nieuws/laatste-nieuws/nieuwsartikel/f5-firepass-cross-site-scripting-vulnerability/106 https://w • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 2.6EPSS: 0%CPEs: 14EXPL: 3CVE-2007-6704 – F5 Networks FirePass 4100 SSL VPN - 'Download_Plugin.php3' Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2007-6704
Multiple cross-site scripting (XSS) vulnerabilities in F5 FirePass 4100 SSL VPN 5.4.1 through 5.5.2 and 6.0 through 6.0.1, when pre-logon sequences are enabled, allow remote attackers to inject arbitrary web script or HTML via the query string to (1) my.activation.php3 and (2) my.logon.php3. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en F5 FirePass 4100 SSL VPN 5.4.1 hasta 5.5.2 y 6.0 hasta 6.0.1, cuando las secuencias pre-logon están activadas, permiten a atacantes remotos inyectar web script o HMTL de su elección a través de la cadena de consulta de (1) my.activation.php3 y (2) my.logon.php3. • https://www.exploit-db.com/exploits/30834 https://www.exploit-db.com/exploits/30833 http://secunia.com/advisories/27904 http://securityreason.com/securityalert/3712 http://www.osvdb.org/38980 http://www.osvdb.org/38981 http://www.procheckup.com/Vulnerability_PR07-14.php http://www.procheckup.com/Vulnerability_PR07-15a.php http://www.securityfocus.com/archive/1/484411/100/0/threaded http://www.securityfocus.com/archive/1/484413/100/0/threaded http://www.securityfocus.com • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 14EXPL: 1CVE-2007-5979 – F5 FirePass 4100 SSL VPN - 'Download_Plugin.php3' Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2007-5979
Cross-site scripting (XSS) vulnerability in download_plugin.php3 in F5 Firepass 4100 SSL VPN 5.4 through 5.5.2 and 6.0 through 6.0.1 allows remote attackers to inject arbitrary web script or HTML via the backurl parameter. Vulnerabilidad de secuencia de comandos en sitios cruzados (XSS) en download_plugin.php3 en F5 Firepass 4100 SSL VPN 5.4 hasta la 5.5.2 y 6.0 hasta la 6.0.1 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del parámetro backurl. • https://www.exploit-db.com/exploits/30755 http://osvdb.org/38665 http://secunia.com/advisories/27647 http://securityreason.com/securityalert/3364 http://www.procheckup.com/Vulnerability_PR07-13.php http://www.securityfocus.com/archive/1/483601/100/0/threaded http://www.securityfocus.com/bid/26412 http://www.securitytracker.com/id?1018937 http://www.vupen.com/english/advisories/2007/3847 https://exchange.xforce.ibmcloud.com/vulnerabilities/38439 https://support.f5.com/kb/en- • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •