CVSS: 7.5EPSS: 0%CPEs: 22EXPL: 0CVE-2021-23049
https://notcve.org/view.php?id=CVE-2021-23049
On BIG-IP version 16.0.x before 16.0.1.2 and 15.1.x before 15.1.3, when the iRules RESOLVER::summarize command is used on a virtual server, undisclosed requests can cause an increase in Traffic Management Microkernel (TMM) memory utilization resulting in an out-of-memory condition and a denial-of-service (DoS). Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En BIG-IP versiones 16.0.x anteriores a 16.0.1.2 y versiones 15.1.x anteriores a 15.1.3, cuando es usado el comando iRules RESOLVER::summarize en un servidor virtual, las peticiones no divulgadas pueden causar un aumento en el uso de la memoria del Traffic Management Microkernel (TMM), resultando en una condición de falta de memoria y una denegación de servicio (DoS). Nota: Las versiones de software que han alcanzado End of Technical Support (EoTS) no son evaluadas • https://support.f5.com/csp/article/K65397301 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.5EPSS: 0%CPEs: 66EXPL: 0CVE-2021-23048
https://notcve.org/view.php?id=CVE-2021-23048
On BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.3, 13.1.x before 13.1.4.1, and all versions of 12.1.x and 11.6.x, when GPRS Tunneling Protocol (GTP) iRules commands or a GTP profile is configured on a virtual server, undisclosed GTP messages can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En BIG-IP versiones 16.0.x anteriores a 16.0.1.2, versiones 15.1.x anteriores a 15.1.3.1, versiones 14.1.x anteriores a 14.1.4.3, versiones 13.1.x anteriores a 13.1.4.1, y todas las versiones de 12.1.x y 11.6.x, cuando los comandos iRules del GPRS Tunneling Protocol (GTP) o un perfil GTP están configurados en un servidor virtual, los mensajes GTP no revelados pueden causar la terminación del Traffic Management Microkernel (TMM). Nota: no son evaluadas las versiones de software que han llegado al End of Technical Support (EoTS) • https://support.f5.com/csp/article/K19012930 • CWE-20: Improper Input Validation •
CVSS: 7.2EPSS: 0%CPEs: 56EXPL: 0CVE-2021-23015
https://notcve.org/view.php?id=CVE-2021-23015
On BIG-IP 15.1.x before 15.1.3, 14.1.x before 14.1.4.2, 13.1.0.8 through 13.1.3.6, and all versions of 16.0.x, when running in Appliance Mode, an authenticated user assigned the 'Administrator' role may be able to bypass Appliance Mode restrictions utilizing undisclosed iControl REST endpoints. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En BIG-IP versiones 15.1.x anteriores a 15.1.3, versiones 14.1.x anteriores a 14.1.4.2, versiones 13.1.0.8 hasta 13.1.3.6 y todas las versiones de 16.0.x, cuando se ejecuta en Modo Appliance, un usuario autenticado que asignó el rol "Administrator" puede omitir las restricciones del Modo Appliance utilizando endpoints REST de iControl no revelados. Nota: No se evalúan las versiones de software que hayan alcanzado el End of Technical Support (EoTS) • https://support.f5.com/csp/article/K74151369 • CWE-863: Incorrect Authorization •
CVSS: 7.5EPSS: 0%CPEs: 28EXPL: 0CVE-2021-23009
https://notcve.org/view.php?id=CVE-2021-23009
On BIG-IP version 16.0.x before 16.0.1.1 and 15.1.x before 15.1.3, malformed HTTP/2 requests may cause an infinite loop which causes a Denial of Service for Data Plane traffic. TMM takes the configured HA action when the TMM process is aborted. There is no control plane exposure, this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En BIG-IP versión 16.0.x anterior a 16.0.1.1 y 15.1.x anterior a 15.1.3, las peticiones HTTP/2 malformadas pueden causar un bucle infinito que provoca una Denegación de Servicio para el Data Plane traffic. • https://support.f5.com/csp/article/K90603426 • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 8.2EPSS: 0%CPEs: 56EXPL: 0CVE-2021-23012
https://notcve.org/view.php?id=CVE-2021-23012
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.3, 14.1.x before 14.1.4, and 13.1.x before 13.1.4, lack of input validation for items used in the system support functionality may allow users granted either "Resource Administrator" or "Administrator" roles to execute arbitrary bash commands on BIG-IP. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En BIG-IP las versiones 16.0.x anteriores a 16.0.1.1, versiones 15.1.x anteriores a 15.1.3, 14.1.x anteriores a 14.1.4 y versiones 13.1.x anteriores a 13.1.4, falta de validación de entrada para los elementos utilizados en la funcionalidad de soporte del sistema puede permitir que los usuarios a los que se les otorguen roles de "Resource Administrator" o "Administrator" ejecutar comandos bash arbitrarios en BIG-IP. Nota: No se evalúan las versiones de software que hayan alcanzado el End of Technical Support (EoTS) • https://support.f5.com/csp/article/K04234247 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •