CVSS: 7.5EPSS: 0%CPEs: 22EXPL: 0CVE-2021-23049
https://notcve.org/view.php?id=CVE-2021-23049
On BIG-IP version 16.0.x before 16.0.1.2 and 15.1.x before 15.1.3, when the iRules RESOLVER::summarize command is used on a virtual server, undisclosed requests can cause an increase in Traffic Management Microkernel (TMM) memory utilization resulting in an out-of-memory condition and a denial-of-service (DoS). Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En BIG-IP versiones 16.0.x anteriores a 16.0.1.2 y versiones 15.1.x anteriores a 15.1.3, cuando es usado el comando iRules RESOLVER::summarize en un servidor virtual, las peticiones no divulgadas pueden causar un aumento en el uso de la memoria del Traffic Management Microkernel (TMM), resultando en una condición de falta de memoria y una denegación de servicio (DoS). Nota: Las versiones de software que han alcanzado End of Technical Support (EoTS) no son evaluadas • https://support.f5.com/csp/article/K65397301 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.5EPSS: 0%CPEs: 66EXPL: 0CVE-2021-23048
https://notcve.org/view.php?id=CVE-2021-23048
On BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.3, 13.1.x before 13.1.4.1, and all versions of 12.1.x and 11.6.x, when GPRS Tunneling Protocol (GTP) iRules commands or a GTP profile is configured on a virtual server, undisclosed GTP messages can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En BIG-IP versiones 16.0.x anteriores a 16.0.1.2, versiones 15.1.x anteriores a 15.1.3.1, versiones 14.1.x anteriores a 14.1.4.3, versiones 13.1.x anteriores a 13.1.4.1, y todas las versiones de 12.1.x y 11.6.x, cuando los comandos iRules del GPRS Tunneling Protocol (GTP) o un perfil GTP están configurados en un servidor virtual, los mensajes GTP no revelados pueden causar la terminación del Traffic Management Microkernel (TMM). Nota: no son evaluadas las versiones de software que han llegado al End of Technical Support (EoTS) • https://support.f5.com/csp/article/K19012930 • CWE-20: Improper Input Validation •
CVSS: 5.3EPSS: 0%CPEs: 6EXPL: 0CVE-2021-23016
https://notcve.org/view.php?id=CVE-2021-23016
On BIG-IP APM versions 15.1.x before 15.1.3, 14.1.x before 14.1.4.1, 13.1.x before 13.1.4, and all versions of 16.0.x, 12.1.x, and 11.6.x, an attacker may be able to bypass APM's internal restrictions and retrieve static content that is hosted within APM by sending specifically crafted requests to an APM Virtual Server. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En BIG-IP APM versiones 15.1.x anteriores a 15.1.3, versiones 14.1.x anteriores a 14.1.4.1, versiones 13.1.x anteriores a 13.1.4 y todas las versiones de 16.0.x, 12.1.x y 11.6.x, un atacante puede ser capaz de omitir las restricciones internas de APM y recuperar contenido estático alojado en APM mediante el envío de peticiones diseñadas específicamente hacia un servidor virtual de APM. Nota: No se evalúan las versiones de software que hayan alcanzado el End of Technical Support (EoTS) • https://support.f5.com/csp/article/K75540265 •
CVSS: 7.2EPSS: 0%CPEs: 56EXPL: 0CVE-2021-23015
https://notcve.org/view.php?id=CVE-2021-23015
On BIG-IP 15.1.x before 15.1.3, 14.1.x before 14.1.4.2, 13.1.0.8 through 13.1.3.6, and all versions of 16.0.x, when running in Appliance Mode, an authenticated user assigned the 'Administrator' role may be able to bypass Appliance Mode restrictions utilizing undisclosed iControl REST endpoints. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En BIG-IP versiones 15.1.x anteriores a 15.1.3, versiones 14.1.x anteriores a 14.1.4.2, versiones 13.1.0.8 hasta 13.1.3.6 y todas las versiones de 16.0.x, cuando se ejecuta en Modo Appliance, un usuario autenticado que asignó el rol "Administrator" puede omitir las restricciones del Modo Appliance utilizando endpoints REST de iControl no revelados. Nota: No se evalúan las versiones de software que hayan alcanzado el End of Technical Support (EoTS) • https://support.f5.com/csp/article/K74151369 • CWE-863: Incorrect Authorization •
CVSS: 7.5EPSS: 0%CPEs: 28EXPL: 0CVE-2021-23009
https://notcve.org/view.php?id=CVE-2021-23009
On BIG-IP version 16.0.x before 16.0.1.1 and 15.1.x before 15.1.3, malformed HTTP/2 requests may cause an infinite loop which causes a Denial of Service for Data Plane traffic. TMM takes the configured HA action when the TMM process is aborted. There is no control plane exposure, this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En BIG-IP versión 16.0.x anterior a 16.0.1.1 y 15.1.x anterior a 15.1.3, las peticiones HTTP/2 malformadas pueden causar un bucle infinito que provoca una Denegación de Servicio para el Data Plane traffic. • https://support.f5.com/csp/article/K90603426 • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •