CVSS: 5.3EPSS: 0%CPEs: 5EXPL: 0CVE-2017-0302
https://notcve.org/view.php?id=CVE-2017-0302
09 May 2017 — In F5 BIG-IP APM 12.0.0 through 12.1.2 and 13.0.0, an authenticated user with an established access session to the BIG-IP APM system may be able to cause a traffic disruption if the length of the requested URL is less than 16 characters. En F5 BIG-IP APM versiones 12.0.0 hasta la 12.1.2 y versión 13.0.0, un usuario autenticado con una sesión establecida de acceso al sistema BIG-IP APM podría causar una interrupción del tráfico si la longitud de la solicitud URL es menor de 16 caracteres. • http://www.securitytracker.com/id/1038408 • CWE-118: Incorrect Access of Indexable Resource ('Range Error') •
CVSS: 5.3EPSS: 1%CPEs: 6EXPL: 0CVE-2016-7467
https://notcve.org/view.php?id=CVE-2016-7467
11 Apr 2017 — The TMM SSO plugin in F5 BIG-IP APM 12.0.0 - 12.1.1, 11.6.0 - 11.6.1 HF1, 11.5.4 - 11.5.4 HF2, when configured as a SAML Identity Provider with a Service Provider (SP) connector, might allow traffic to be disrupted or failover initiated when a malformed, signed SAML authentication request from an authenticated user is sent via the SP connector. El plugin TMM SSO en F5 BIG-IP APM 12.0.0 - 12.1.1, 11.6.0 - 11.6.1 HF1, 11.5.4 - 11.5.4 HF2, cuando está configurado como un SAML Identity Provider con un conector ... • http://www.securityfocus.com/bid/97168 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 1%CPEs: 156EXPL: 0CVE-2016-9252
https://notcve.org/view.php?id=CVE-2016-9252
27 Mar 2017 — The Traffic Management Microkernel (TMM) in F5 BIG-IP before 11.5.4 HF3, 11.6.x before 11.6.1 HF2 and 12.x before 12.1.2 does not properly handle minimum path MTU options for IPv6, which allows remote attackers to cause a denial-of-service (DoS) through unspecified vectors. El Traffic Management Microkernel (TMM) en F5 BIG-IP en versiones anteriores a 11.5.4 HF3, 11.6.x en versiones anteriores a 11.6.1 HF2 y 12.x en versiones anteriores a 12.1.2 no maneja adecuadamente las opciones MTU de ruta mínima para I... • http://www.securitytracker.com/id/1038132 • CWE-19: Data Processing Errors •
CVSS: 5.5EPSS: 0%CPEs: 123EXPL: 0CVE-2016-7474
https://notcve.org/view.php?id=CVE-2016-7474
27 Mar 2017 — In some cases the MCPD binary cache in F5 BIG-IP devices may allow a user with Advanced Shell access, or privileges to generate a qkview, to temporarily obtain normally unrecoverable information. En algunos casos la caché binaria MCPD en dispositivos F5 BIG-IP pueden permitir a un usuario con acceso Advanced Shell, o privilegios generar un qkview, para obtener temporalmente información normalmente irrecuperable. • http://www.securityfocus.com/bid/97198 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.9EPSS: 0%CPEs: 30EXPL: 0CVE-2016-9245
https://notcve.org/view.php?id=CVE-2016-9245
07 Mar 2017 — In F5 BIG-IP systems 12.1.0 - 12.1.2, malicious requests made to virtual servers with an HTTP profile can cause the TMM to restart. The issue is exposed with BIG-IP APM profiles, regardless of settings. The issue is also exposed with the non-default "Normalize URI" configuration options used in iRules and/or BIG-IP LTM policies. An attacker may be able to disrupt traffic or cause the BIG-IP system to fail over to another device in the device group. En sistemas F5 BIG-IP 12.1.0 - 12.1.2, solicitudes malicios... • http://www.securityfocus.com/bid/96471 • CWE-284: Improper Access Control •
CVSS: 7.5EPSS: 69%CPEs: 115EXPL: 5CVE-2016-9244 – F5 BIG-IP SSL Virtual Server - 'Ticketbleed' Memory Disclosure
https://notcve.org/view.php?id=CVE-2016-9244
09 Feb 2017 — A BIG-IP virtual server configured with a Client SSL profile that has the non-default Session Tickets option enabled may leak up to 31 bytes of uninitialized memory. A remote attacker may exploit this vulnerability to obtain Secure Sockets Layer (SSL) session IDs from other sessions. It is possible that other data from uninitialized memory may be returned as well. Un servidor virtual BIG-IP configurado con un perfil Client SSL que tiene la opción Session Tickets no predeterminada habilitada podría perder ha... • https://packetstorm.news/files/id/141017 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.8EPSS: 0%CPEs: 30EXPL: 0CVE-2016-9249
https://notcve.org/view.php?id=CVE-2016-9249
31 Jan 2017 — An undisclosed traffic pattern received by a BIG-IP Virtual Server with TCP Fast Open enabled may cause the Traffic Management Microkernel (TMM) to restart, resulting in a Denial-of-Service (DoS). Un patrón de tráfico no revelado recibido por un servidor virtual BIG-IP con TCP Fast Open habilitado puede provocar el reinicio de Traffic Management Microkernel (TMM), resultando en una Denegación de Servicio (DoS). • http://www.securityfocus.com/bid/95825 • CWE-20: Improper Input Validation •
CVSS: 5.9EPSS: 0%CPEs: 20EXPL: 0CVE-2016-9247
https://notcve.org/view.php?id=CVE-2016-9247
10 Jan 2017 — Under certain conditions for BIG-IP systems using a virtual server with an associated FastL4 profile and TCP analytics profile, a specific sequence of packets may cause the Traffic Management Microkernel (TMM) to restart. Bajo ciertas condiciones para sistemas BIG-IP que utilizan un servidor virtual con un perfil asociado FastL4 y un perfil de análisis TCP, una secuencia especifica de paquetes podría provocar que el Traffic Management Microkernel (TMM) se reinicie. • http://www.securityfocus.com/bid/95405 • CWE-20: Improper Input Validation •
CVSS: 5.9EPSS: 1%CPEs: 27EXPL: 0CVE-2016-5024
https://notcve.org/view.php?id=CVE-2016-5024
03 Jan 2017 — Virtual servers in F5 BIG-IP systems 11.6.1 before 11.6.1 HF1 and 12.1.x before 12.1.2, when configured to parse RADIUS messages via an iRule, allow remote attackers to cause a denial of service (Traffic Management Microkernel restart) via crafted network traffic. Servicios virtuales en sistemas F5 BIG-IP 11.6.1 en versiones anteriores a 11.6.1 HF1 y 12.1.x en versiones anteriores a 12.1.2, cuando se configuran para analizar mensajes RADIUS a través de un iRule, permite a atacantes remotos provocar una dene... • http://www.securityfocus.com/bid/95228 • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 4%CPEs: 67EXPL: 0CVE-2016-5700
https://notcve.org/view.php?id=CVE-2016-5700
03 Oct 2016 — Virtual servers in F5 BIG-IP systems 11.5.0, 11.5.1 before HF11, 11.5.2, 11.5.3, 11.5.4 before HF2, 11.6.0 before HF8, 11.6.1 before HF1, 12.0.0 before HF4, and 12.1.0 before HF2, when configured with the HTTP Explicit Proxy functionality or SOCKS profile, allow remote attackers to modify the system configuration, read system files, and possibly execute arbitrary code via unspecified vectors. Servidores virtuales en sistemas F5 BIG-IP 11.5.0, 11.5.1 en versiones anteriores a HF11, 11.5.2, 11.5.3, 11.5.4 en ... • http://www.securityfocus.com/bid/93325 • CWE-284: Improper Access Control •