CVSS: 9.8EPSS: 0%CPEs: 65EXPL: 0CVE-2018-5506
https://notcve.org/view.php?id=CVE-2018-5506
13 Apr 2018 — In F5 BIG-IP 13.0.0, 12.1.0-12.1.2, 11.6.1, 11.5.1-11.5.5, or 11.2.1 the Apache modules apache_auth_token_mod and mod_auth_f5_auth_token.cpp allow possible unauthenticated bruteforce on the em_server_ip authorization parameter to obtain which SSL client certificates used for mutual authentication between BIG-IQ or Enterprise Manager (EM) and managed BIG-IP devices. En F5 BIG-IP, en su versión 13.0.0, de la versión 12.1.0a la 12.1.2, la versión 11.6.1, de la versión 11.5.1 a la 11.5.5 o en la versión 11.2.1,... • https://support.f5.com/csp/article/K65355492 •
CVSS: 7.2EPSS: 2%CPEs: 30EXPL: 2CVE-2018-5511 – VMware Workstation 14.1.5 / VMware Player 15.0.2 - Host VMX Process Impersonation Hijack Privilege Escalation
https://notcve.org/view.php?id=CVE-2018-5511
13 Apr 2018 — On F5 BIG-IP 13.1.0-13.1.0.3 or 13.0.0, when authenticated administrative users execute commands in the Traffic Management User Interface (TMUI), also referred to as the BIG-IP Configuration utility, restrictions on allowed commands may not be enforced. En F5 BIG-IP, de la versión 13.1.0 a la 13.1.0.3 o en la versión 13.0.0, cuando los usuarios administrativos autenticados ejecutan comandos en el TMUI (Traffic Management User Interface), también llamado utilidad BIG-IP Configuration, podrían no aplicarse la... • https://packetstorm.news/files/id/152213 • CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') •
CVSS: 7.5EPSS: 0%CPEs: 91EXPL: 0CVE-2018-5507
https://notcve.org/view.php?id=CVE-2018-5507
13 Apr 2018 — On F5 BIG-IP versions 13.0.0, 12.1.0-12.1.3.1, 11.6.1-11.6.2, or 11.5.1-11.5.5, vCMP guests running on VIPRION 2100, 4200 and 4300 series blades cannot correctly decrypt ciphertext from established SSL sessions with small MTU. En F5 BIG-IP, en versiones 13.0.0, de la versión 12.1.0 a la 12.1.3.1, de la versión 11.6.1 a la 11.6.2 o de la versión 11.5.1 a la 11.5.5, los invitados vCMP que se ejecutan en blades VIPRION de las series 2100, 4200 y 4300 no puedes descifrar correctamente el texto cifrado de las se... • https://support.f5.com/csp/article/K52521791 •
CVSS: 7.5EPSS: 0%CPEs: 13EXPL: 0CVE-2018-5502
https://notcve.org/view.php?id=CVE-2018-5502
22 Mar 2018 — On F5 BIG-IP versions 13.0.0 - 13.1.0.3, attackers may be able to disrupt services on the BIG-IP system with maliciously crafted client certificate. This vulnerability affects virtual servers associated with Client SSL profile which enables the use of client certificate authentication. Client certificate authentication is not enabled by default in Client SSL profile. There is no control plane exposure. Desde la versión 13.0.0 hasta la 13.1.0.3 de F5 BIG-IP, los atacantes podrían ser capaces de interrumpir s... • http://www.securitytracker.com/id/1040561 • CWE-295: Improper Certificate Validation •
CVSS: 9.3EPSS: 0%CPEs: 25EXPL: 0CVE-2018-5504
https://notcve.org/view.php?id=CVE-2018-5504
22 Mar 2018 — In some circumstances, the Traffic Management Microkernel (TMM) does not properly handle certain malformed Websockets requests/responses, which allows remote attackers to cause a denial-of-service (DoS) or possible remote code execution on the F5 BIG-IP system running versions 13.0.0 - 13.1.0.3 or 12.1.0 - 12.1.3.1. En algunas circunstancias, el TMM (Traffic Management Microkernel) no gestiona correctamente algunas peticiones/respuestas Websockets mal formadas. Esto permite que atacantes remotos provoquen u... • http://www.securitytracker.com/id/1040558 •
CVSS: 5.9EPSS: 0%CPEs: 65EXPL: 0CVE-2018-5501
https://notcve.org/view.php?id=CVE-2018-5501
01 Mar 2018 — In some circumstances, on F5 BIG-IP systems running 13.0.0, 12.1.0 - 12.1.3.1, any 11.6.x or 11.5.x release, or 11.2.1, TCP DNS profile allows excessive buffering due to lack of flow control. En algunas circunstancias, en sistemas F5 BIG-IP que ejecutan 13.0.0, 12.1.0 - 12.1.3.1, cualquier versión 11.6.x o 11.5.x o 11.2.1, el perfil TCP DNS permite el buffering excesivo debido a la falta de control de flujo. • http://www.securityfocus.com/bid/103211 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 5.9EPSS: 0%CPEs: 39EXPL: 0CVE-2018-5500
https://notcve.org/view.php?id=CVE-2018-5500
01 Mar 2018 — On F5 BIG-IP systems running 13.0.0, 12.1.0 - 12.1.3.1, or 11.6.1 - 11.6.2, every Multipath TCP (MCTCP) connection established leaks a small amount of memory. Virtual server using TCP profile with Multipath TCP (MCTCP) feature enabled will be affected by this issue. En sistemas F5 BIG-IP que ejecutan las versiones 13.0.0, 12.1.0 - 12.1.3.1 o 11.6.1 - 11.6.2, cada conexión Multipath TCP (MCTCP) que se establece filtra una pequeña cantidad de memoria. Los servidores virtuales que emplean el perfil TCP con la ... • http://www.securityfocus.com/bid/103217 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 6.5EPSS: 0%CPEs: 33EXPL: 0CVE-2017-6134
https://notcve.org/view.php?id=CVE-2017-6134
21 Dec 2017 — In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and WebSafe software version 13.0.0, 12.1.0 - 12.1.2 and 11.5.1 - 11.6.1, an undisclosed sequence of packets, sourced from an adjacent network may cause TMM to crash. En F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM y WebSafe, en versiones de software 13.0.0, de la 12.1.0 a la 12.1.2 y de la 11.5.1 a la 11.6.1, una secuencia de paquetes no revelada cuyo origen es una red adyacente podría hacer que ... • http://www.securityfocus.com/bid/102466 • CWE-20: Improper Input Validation •
CVSS: 5.9EPSS: 0%CPEs: 22EXPL: 0CVE-2017-6136
https://notcve.org/view.php?id=CVE-2017-6136
21 Dec 2017 — In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and WebSafe software version 13.0.0 and 12.0.0 - 12.1.2, undisclosed traffic patterns sent to BIG-IP virtual servers, with the TCP Fast Open and Tail Loss Probe options enabled in the associated TCP profile, may cause a disruption of service to the Traffic Management Microkernel (TMM). En F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM y WebSafe, en versiones 13.0.0 y de la 12.0.0 a la 12.1.2, los pa... • http://www.securitytracker.com/id/1040046 • CWE-20: Improper Input Validation •
CVSS: 7.8EPSS: 0%CPEs: 13EXPL: 0CVE-2017-6151
https://notcve.org/view.php?id=CVE-2017-6151
21 Dec 2017 — In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, WebAccelerator and WebSafe software version 13.0.0, undisclosed requests made to BIG-IP virtual servers which make use of the "HTTP/2 profile" may result in a disruption of service to TMM. En F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, WebAccelerator y WebSafe, en su versión 13.0.0, las solicitudes no reveladas enviadas a los servidores virtuales BIG-IP que utilizan ... • http://www.securitytracker.com/id/1040052 •