CVSS: 7.5EPSS: 0%CPEs: 76EXPL: 0CVE-2023-40542 – BIG-IP TCP Profile vulnerability
https://notcve.org/view.php?id=CVE-2023-40542
When TCP Verified Accept is enabled on a TCP profile that is configured on a Virtual Server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated Cuando la aceptación verificada de TCP está habilitada en un perfil TCP configurado en un servidor virtual, las solicitudes no divulgadas pueden provocar un aumento en la utilización de recursos de memoria. Nota: Las versiones de software que han llegado al End of Technical Support (EoTS) no se evalúan • https://my.f5.com/manage/s/article/K000134652 • CWE-400: Uncontrolled Resource Consumption CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 8.1EPSS: 0%CPEs: 54EXPL: 0CVE-2023-40537 – Multi-blade VIPRION Configuration utility session cookie vulnerability
https://notcve.org/view.php?id=CVE-2023-40537
An authenticated user's session cookie may remain valid for a limited time after logging out from the BIG-IP Configuration utility on a multi-blade VIPRION platform. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. La cookie de sesión de un usuario autenticado puede permanecer válida por un tiempo limitado después de cerrar sesión en la utilidad de configuración BIG-IP en una plataforma VIPRION multiblade. Nota: Las versiones de software que han llegado al End of Technical Support (EoTS) no se evalúan. • https://my.f5.com/manage/s/article/K29141800 • CWE-613: Insufficient Session Expiration •
CVSS: 7.8EPSS: 0%CPEs: 7EXPL: 0CVE-2023-5450 – BIG-IP Edge Client for macOS vulnerability
https://notcve.org/view.php?id=CVE-2023-5450
An insufficient verification of data vulnerability exists in BIG-IP Edge Client Installer on macOS that may allow an attacker elevation of privileges during the installation process. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Existe una verificación insuficiente de la vulnerabilidad de los datos en BIG-IP Edge Client Installer en macOS que puede permitir que un atacante aumente sus privilegios durante el proceso de instalación. Nota: Las versiones de software que han llegado al End of Technical Support (EoTS) no se evalúan. • https://my.f5.com/manage/s/article/K000135040 • CWE-345: Insufficient Verification of Data Authenticity •
CVSS: 7.5EPSS: 81%CPEs: 444EXPL: 7CVE-2023-44487 – HTTP/2 Rapid Reset Attack Vulnerability
https://notcve.org/view.php?id=CVE-2023-44487
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. El protocolo HTTP/2 permite una denegación de servicio (consumo de recursos del servidor) porque la cancelación de solicitudes puede restablecer muchas transmisiones rápidamente, como se explotó en la naturaleza entre agosto y octubre de 2023. A flaw was found in handling multiplexed streams in the HTTP/2 protocol. A client can repeatedly make a request for a new multiplex stream and immediately send an RST_STREAM frame to cancel it. This creates extra work for the server setting up and tearing down the streams while not hitting any server-side limit for the maximum number of active streams per connection, resulting in a denial of service due to server resource consumption. • https://github.com/imabee101/CVE-2023-44487 https://github.com/studiogangster/CVE-2023-44487 https://github.com/bcdannyboy/CVE-2023-44487 https://github.com/sigridou/CVE-2023-44487- https://github.com/ByteHackr/CVE-2023-44487 https://github.com/ReToCode/golang-CVE-2023-44487 http://www.openwall.com/lists/oss-security/2023/10/13/4 http://www.openwall.com/lists/oss-security/2023/10/13/9 http://www.openwall.com/lists/oss-security/2023/10/18/4 http://www. • CWE-400: Uncontrolled Resource Consumption •
CVSS: 8.2EPSS: 0%CPEs: 6EXPL: 0CVE-2023-43125 – BIG-IP APM Clients TunnelCrack vulnerability
https://notcve.org/view.php?id=CVE-2023-43125
BIG-IP APM clients may send IP traffic outside of the VPN tunnel. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated Los clientes BIG-IP APM pueden enviar tráfico IP fuera del túnel VPN. Nota: Las versiones de software que han llegado al Final del Soporte Técnico (EoTS) no se evalúan • https://my.f5.com/manage/s/article/K000136909 • CWE-319: Cleartext Transmission of Sensitive Information •