CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2021-23019
https://notcve.org/view.php?id=CVE-2021-23019
01 Jun 2021 — The NGINX Controller 2.0.0 thru 2.9.0 and 3.x before 3.15.0 Administrator password may be exposed in the systemd.txt file that is included in the NGINX support package. La contraseña de administrador NGINX Controller versiones 2.0.0 a 2.9.0 y 3.x versiones anteriores a 3.15.0 puede estar expuesta en el archivo systemd.txt que se incluye en el paquete de soporte de NGINX • https://support.f5.com/csp/article/K04884013 • CWE-201: Insertion of Sensitive Information Into Sent Data CWE-522: Insufficiently Protected Credentials •
CVSS: 7.4EPSS: 0%CPEs: 1EXPL: 0CVE-2021-23018
https://notcve.org/view.php?id=CVE-2021-23018
01 Jun 2021 — Intra-cluster communication does not use TLS. The services within the NGINX Controller 3.x before 3.4.0 namespace are using cleartext protocols inside the cluster. Una comunicación dentro del clúster no usa TLS. Los servicios dentro del espacio de nombres de NGINX Controller 3.x versiones anteriores a 3.4.0 estan usando protocolos de texto sin cifrar dentro del clúster • https://support.f5.com/csp/article/K97002210 • CWE-319: Cleartext Transmission of Sensitive Information •
CVSS: 8.1EPSS: 40%CPEs: 25EXPL: 9CVE-2021-23017 – Nginx 1.20.0 - Denial of Service (DOS)
https://notcve.org/view.php?id=CVE-2021-23017
26 May 2021 — A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process crash or potential other impact. Se identificó un problema de seguridad en el solucionador de nginx, que podría permitir a un atacante que pueda falsificar paquetes UDP desde el servidor DNS para causar una sobrescritura de memoria de 1 byte, lo que causaría un bloqueo del proceso de trabajo u otro impacto potencia... • https://packetstorm.news/files/id/167720 • CWE-193: Off-by-one Error •
CVSS: 5.3EPSS: 0%CPEs: 6EXPL: 0CVE-2021-23016
https://notcve.org/view.php?id=CVE-2021-23016
10 May 2021 — On BIG-IP APM versions 15.1.x before 15.1.3, 14.1.x before 14.1.4.1, 13.1.x before 13.1.4, and all versions of 16.0.x, 12.1.x, and 11.6.x, an attacker may be able to bypass APM's internal restrictions and retrieve static content that is hosted within APM by sending specifically crafted requests to an APM Virtual Server. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En BIG-IP APM versiones 15.1.x anteriores a 15.1.3, versiones 14.1.x anteriores a 14.1.4.1, vers... • https://support.f5.com/csp/article/K75540265 •
CVSS: 7.2EPSS: 0%CPEs: 56EXPL: 0CVE-2021-23015
https://notcve.org/view.php?id=CVE-2021-23015
10 May 2021 — On BIG-IP 15.1.x before 15.1.3, 14.1.x before 14.1.4.2, 13.1.0.8 through 13.1.3.6, and all versions of 16.0.x, when running in Appliance Mode, an authenticated user assigned the 'Administrator' role may be able to bypass Appliance Mode restrictions utilizing undisclosed iControl REST endpoints. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En BIG-IP versiones 15.1.x anteriores a 15.1.3, versiones 14.1.x anteriores a 14.1.4.2, versiones 13.1.0.8 hasta 13.1.3.6 ... • https://support.f5.com/csp/article/K74151369 • CWE-863: Incorrect Authorization •
CVSS: 8.8EPSS: 0%CPEs: 6EXPL: 0CVE-2021-23014
https://notcve.org/view.php?id=CVE-2021-23014
10 May 2021 — On versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.3, and 14.1.x before 14.1.4, BIG-IP Advanced WAF and ASM are missing authorization checks for file uploads to a specific directory within the REST API which might allow Authenticated users with guest privileges to upload files. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En las versiones 16.0.x anteriores a 16.0.1.1, versiones 15.1.x anteriores a 15.1.3 y 14.1.x anteriores a 14.1.4, BIG-IP Advanced WAF y... • https://support.f5.com/csp/article/K23203045 • CWE-862: Missing Authorization •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2021-23010
https://notcve.org/view.php?id=CVE-2021-23010
10 May 2021 — On versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.5, and 12.1.x before 12.1.5.3, when the BIG-IP ASM/Advanced WAF system processes WebSocket requests with JSON payloads using the default JSON Content Profile in the ASM Security Policy, the BIG-IP ASM bd process may produce a core file. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En las versiones 16.0.x anterior a 16.0.1.1, 15.1.x anteriores a 15.1.2, 14.1.... • https://support.f5.com/csp/article/K18570111 •
CVSS: 7.5EPSS: 0%CPEs: 28EXPL: 0CVE-2021-23009
https://notcve.org/view.php?id=CVE-2021-23009
10 May 2021 — On BIG-IP version 16.0.x before 16.0.1.1 and 15.1.x before 15.1.3, malformed HTTP/2 requests may cause an infinite loop which causes a Denial of Service for Data Plane traffic. TMM takes the configured HA action when the TMM process is aborted. There is no control plane exposure, this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En BIG-IP versión 16.0.x anterior a 16.0.1.1 y 15.1.x anterior a 15.1.3, las peticiones HTTP/2 malformad... • https://support.f5.com/csp/article/K90603426 • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 8.2EPSS: 0%CPEs: 56EXPL: 0CVE-2021-23012
https://notcve.org/view.php?id=CVE-2021-23012
10 May 2021 — On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.3, 14.1.x before 14.1.4, and 13.1.x before 13.1.4, lack of input validation for items used in the system support functionality may allow users granted either "Resource Administrator" or "Administrator" roles to execute arbitrary bash commands on BIG-IP. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En BIG-IP las versiones 16.0.x anteriores a 16.0.1.1, versiones 15.1.x anteriores a 15.1.3, 14.1.x ant... • https://support.f5.com/csp/article/K04234247 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.5EPSS: 0%CPEs: 70EXPL: 0CVE-2021-23013
https://notcve.org/view.php?id=CVE-2021-23013
10 May 2021 — On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.3, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, the Traffic Management Microkernel (TMM) may stop responding when processing Stream Control Transmission Protocol (SCTP) traffic under certain conditions. This vulnerability affects TMM by way of a virtual server configured with an SCTP profile. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En BIG-IP versiones 16.0.x anteri... • https://support.f5.com/csp/article/K04234247 •