CVSS: 7.5EPSS: 0%CPEs: 44EXPL: 0CVE-2022-23017
https://notcve.org/view.php?id=CVE-2022-23017
25 Jan 2022 — On BIG-IP version 16.x before 16.1.0, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.5, and all versions of 13.1.x, when a virtual server is configured with a DNS profile with the Rapid Response Mode setting enabled and is configured on a BIG-IP system, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En BIG-IP versiones 16.x anteriores a 16.1.0, 15.1.x anteriores a 15.1.4.1, 14.1... • https://support.f5.com/csp/article/K28042514 • CWE-476: NULL Pointer Dereference •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2022-23018
https://notcve.org/view.php?id=CVE-2022-23018
25 Jan 2022 — On BIG-IP AFM version 16.1.x before 16.1.2, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.5, and 13.1.x beginning in 13.1.3.4, when a virtual server is configured with both HTTP protocol security and HTTP Proxy Connect profiles, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En BIG-IP AFM versiones 16.1.x anteriores a 16.1.2, 15.1.x anteriores a 15.1.4.1, 14.1.x anteriores a 14... • https://support.f5.com/csp/article/K24358905 • CWE-755: Improper Handling of Exceptional Conditions •
CVSS: 8.8EPSS: 0%CPEs: 12EXPL: 0CVE-2022-23013
https://notcve.org/view.php?id=CVE-2022-23013
25 Jan 2022 — On BIG-IP DNS & GTM version 16.x before 16.1.0, 15.1.x before 15.1.4, 14.1.x before 14.1.4.4, and all versions of 13.1.x, 12.1.x, and 11.6.x, a DOM-based cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to execute JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En BIG-IP DNS & GTM versiones 16.x anteriores a 16.1.0, 15.... • https://support.f5.com/csp/article/K29500533 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 22EXPL: 0CVE-2022-23012
https://notcve.org/view.php?id=CVE-2022-23012
25 Jan 2022 — On BIG-IP versions 15.1.x before 15.1.4.1 and 14.1.x before 14.1.4.5, when the HTTP/2 profile is configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En BIG-IP versiones 15.1.x anteriores a 15.1.4.1 y 14.1.x anteriores a 14.1.4.5, cuando es configurado el perfil HTTP/2 en un servidor virtual, las peticiones no reveladas pueden causar una terminación d... • https://support.f5.com/csp/article/K26310765 • CWE-415: Double Free •
CVSS: 7.5EPSS: 0%CPEs: 22EXPL: 0CVE-2022-23016
https://notcve.org/view.php?id=CVE-2022-23016
25 Jan 2022 — On versions 16.1.x before 16.1.2 and 15.1.x before 15.1.4.1, when BIG-IP SSL Forward Proxy with TLS 1.3 is configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En las versiones 16.1.x antes de 16.1.2 y 15.1.x antes de 15.1.4.1, cuando BIG-IP SSL Forward Proxy con TLS versión 1.3 está configurado en un servidor virtual, las peticiones no reveladas pued... • https://support.f5.com/csp/article/K91013510 • CWE-476: NULL Pointer Dereference •
CVSS: 7.5EPSS: 0%CPEs: 33EXPL: 0CVE-2022-23015
https://notcve.org/view.php?id=CVE-2022-23015
25 Jan 2022 — On BIG-IP versions 16.x before 16.1.0, 15.1.x before 15.1.4.1, and 14.1.2.6-14.1.4.4, when a Client SSL profile is configured on a virtual server with Client Certificate Authentication set to request/require and Session Ticket enabled and configured, processing SSL traffic can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En BIG-IP versiones 16.x anteriores a 16.1.0, 15.1.x anteriores a 15.1.4.1 y 14.1.2.6-14.1... • https://support.f5.com/csp/article/K08476614 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 6.8EPSS: 0%CPEs: 2EXPL: 0CVE-2022-23014
https://notcve.org/view.php?id=CVE-2022-23014
25 Jan 2022 — On versions 16.1.x before 16.1.2 and 15.1.x before 15.1.4.1, when BIG-IP APM portal access is configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En las versiones 16.1.x anteriores a 16.1.2 y 15.1.x anteriores a 15.1.4.1, cuando el acceso al portal de BIG-IP APM está configurado en un servidor virtual, las peticiones no reveladas pueden causar una te... • https://support.f5.com/csp/article/K93526903 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 69EXPL: 0CVE-2022-23011
https://notcve.org/view.php?id=CVE-2022-23011
25 Jan 2022 — On certain hardware BIG-IP platforms, in version 15.1.x before 15.1.4 and 14.1.x before 14.1.3, virtual servers may stop responding while processing TCP traffic due to an issue in the SYN Cookie Protection feature. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En determinadas plataformas de hardware BIG-IP, en la versión 15.1.x anteriores a 15.1.4 y 14.1.x anteriores a 14.1.3, los servidores virtuales pueden dejar de responder mientras procesan el tráfico TCP ... • https://support.f5.com/csp/article/K68755210 • CWE-682: Incorrect Calculation •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-23008
https://notcve.org/view.php?id=CVE-2022-23008
25 Jan 2022 — On NGINX Controller API Management versions 3.18.0-3.19.0, an authenticated attacker with access to the "user" or "admin" role can use undisclosed API endpoints on NGINX Controller API Management to inject JavaScript code that is executed on managed NGINX data plane instances. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En NGINX Controller API Management versiones 3.18.0-3.19.0, un atacante autenticado con acceso al rol "user" o "admin" puede usar endpoints ... • https://support.f5.com/csp/article/K57735782 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.5EPSS: 0%CPEs: 66EXPL: 0CVE-2022-23010
https://notcve.org/view.php?id=CVE-2022-23010
25 Jan 2022 — On BIG-IP versions 16.x before 16.1.0, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.4, and all versions of 13.1.x, 12.1.x, and 11.6.x, when a FastL4 profile and an HTTP profile are configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En BIG-IP versiones 16.x anteriores a 16.1.0, 15.1.x anteriores a 15.1.4.1, 14.1.x anteriores a 14.1.4.4 y todas las versiones de ... • https://support.f5.com/csp/article/K34360320 • CWE-404: Improper Resource Shutdown or Release •