CVSS: 7.5EPSS: 0%CPEs: 76EXPL: 0CVE-2023-40542 – BIG-IP TCP Profile vulnerability
https://notcve.org/view.php?id=CVE-2023-40542
When TCP Verified Accept is enabled on a TCP profile that is configured on a Virtual Server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated Cuando la aceptación verificada de TCP está habilitada en un perfil TCP configurado en un servidor virtual, las solicitudes no divulgadas pueden provocar un aumento en la utilización de recursos de memoria. Nota: Las versiones de software que han llegado al End of Technical Support (EoTS) no se evalúan • https://my.f5.com/manage/s/article/K000134652 • CWE-400: Uncontrolled Resource Consumption CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 8.1EPSS: 0%CPEs: 54EXPL: 0CVE-2023-40537 – Multi-blade VIPRION Configuration utility session cookie vulnerability
https://notcve.org/view.php?id=CVE-2023-40537
An authenticated user's session cookie may remain valid for a limited time after logging out from the BIG-IP Configuration utility on a multi-blade VIPRION platform. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. La cookie de sesión de un usuario autenticado puede permanecer válida por un tiempo limitado después de cerrar sesión en la utilidad de configuración BIG-IP en una plataforma VIPRION multiblade. Nota: Las versiones de software que han llegado al End of Technical Support (EoTS) no se evalúan. • https://my.f5.com/manage/s/article/K29141800 • CWE-613: Insufficient Session Expiration •
CVSS: 7.5EPSS: 0%CPEs: 39EXPL: 0CVE-2023-40534 – BIG-IP HTTP/2 vulnerability
https://notcve.org/view.php?id=CVE-2023-40534
When a client-side HTTP/2 profile and the HTTP MRF Router option are enabled for a virtual server, and an iRule using the HTTP_REQUEST event or Local Traffic Policy are associated with the virtual server, undisclosed requests can cause TMM to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Cuando un perfil HTTP/2 del lado del cliente y la opción HTTP MRF Router están habilitadas para un servidor virtual, y una iRule que utiliza el evento HTTP_REQUEST o la Política de Tráfico Local está asociada con el servidor virtual, las solicitudes no divulgadas pueden provocar la finalización de TMM. Nota: Las versiones de software que han llegado al End of Technical Support (EoTS) no se evalúan. • https://my.f5.com/manage/s/article/K000133467 • CWE-401: Missing Release of Memory after Effective Lifetime •
CVSS: 4.4EPSS: 0%CPEs: 6EXPL: 0CVE-2023-39447 – BIG-IP APM Guided Configuration vulnerability
https://notcve.org/view.php?id=CVE-2023-39447
When BIG-IP APM Guided Configurations are configured, undisclosed sensitive information may be logged in restnoded log. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Cuando se configura BIG-IP APM Guided Configurations, es posible que se registre información confidencial no divulgada en restnoded log. Nota: Las versiones de software que han llegado al End of Technical Support (EoTS) no se evalúan. • https://my.f5.com/manage/s/article/K47756555 • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 7.8EPSS: 0%CPEs: 7EXPL: 0CVE-2023-5450 – BIG-IP Edge Client for macOS vulnerability
https://notcve.org/view.php?id=CVE-2023-5450
An insufficient verification of data vulnerability exists in BIG-IP Edge Client Installer on macOS that may allow an attacker elevation of privileges during the installation process. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Existe una verificación insuficiente de la vulnerabilidad de los datos en BIG-IP Edge Client Installer en macOS que puede permitir que un atacante aumente sus privilegios durante el proceso de instalación. Nota: Las versiones de software que han llegado al End of Technical Support (EoTS) no se evalúan. • https://my.f5.com/manage/s/article/K000135040 • CWE-345: Insufficient Verification of Data Authenticity •