CVSS: 7.5EPSS: 0%CPEs: 84EXPL: 0CVE-2021-23011
https://notcve.org/view.php?id=CVE-2021-23011
10 May 2021 — On versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.3, 14.1.x before 14.1.4, 13.1.x before 13.1.4, 12.1.x before 12.1.6, and 11.6.x before 11.6.5.3, when the BIG-IP system is buffering packet fragments for reassembly, the Traffic Management Microkernel (TMM) may consume an excessive amount of resources, eventually leading to a restart and failover event. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En las versiones 16.0.x anteriores a 16.0.1.1, versiones 1... • https://support.f5.com/csp/article/K10751325 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 9.8EPSS: 0%CPEs: 6EXPL: 0CVE-2021-23008
https://notcve.org/view.php?id=CVE-2021-23008
10 May 2021 — On version 15.1.x before 15.1.3, 14.1.x before 14.1.4, 13.1.x before 13.1.4, 12.1.x before 12.1.6, and all versions of 16.0.x and 11.6.x., BIG-IP APM AD (Active Directory) authentication can be bypassed via a spoofed AS-REP (Kerberos Authentication Service Response) response sent over a hijacked KDC (Kerberos Key Distribution Center) connection or from an AD server compromised by an attacker. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En la versión 15.1.x a... • https://support.f5.com/csp/article/K51213246 • CWE-287: Improper Authentication •
CVSS: 8.8EPSS: 0%CPEs: 10EXPL: 0CVE-2021-22993
https://notcve.org/view.php?id=CVE-2021-22993
31 Mar 2021 — On BIG-IP Advanced WAF and BIG-IP ASM versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, DOM-based XSS on DoS Profile properties page. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. En BIG-IP Advanced WAF y BIG-IP ASM versiones 16.0.x anteriores de 16.0.1.1, versiones 15.1.x anteriores a 15.1.2, versiones 14.1.x anteriores a 14.1.3.1, versiones 13.1.x anteriores a 13.1.3.6 y vers... • https://support.f5.com/csp/article/K55237223 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2021-23006
https://notcve.org/view.php?id=CVE-2021-23006
31 Mar 2021 — On all 7.x and 6.x versions (fixed in 8.0.0), undisclosed BIG-IQ pages have a reflected cross-site scripting vulnerability. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. En todas las versiones 7.x y 6.x (corregidas en la versión 8.0.0), las páginas de BIG-IQ no reveladas presentan una vulnerabilidad de tipo cross-site scripting reflejado. Nota: No se evalúan las versiones de software que han alcanzado End of Software Development (EoSD). • https://support.f5.com/csp/article/K30585021 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 32EXPL: 1CVE-2021-23007
https://notcve.org/view.php?id=CVE-2021-23007
31 Mar 2021 — On BIG-IP versions 14.1.4 and 16.0.1.1, when the Traffic Management Microkernel (TMM) process handles certain undisclosed traffic, it may start dropping all fragmented IP traffic. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. En BIG-IP versiones 14.1.4 y 16.0.1.1, cuando el proceso Traffic Management Microkernel (TMM) maneja cierto tráfico no revelado, puede comenzar a eliminar todo el tráfico IP fragmentado. Nota: No se evalúan las versiones de softwa... • https://support.f5.com/csp/article/K37451543 •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2021-23005
https://notcve.org/view.php?id=CVE-2021-23005
31 Mar 2021 — On all 7.x and 6.x versions (fixed in 8.0.0), when using a Quorum device for BIG-IQ high availability (HA) for automatic failover, BIG-IQ does not make use of Transport Layer Security (TLS) with the Corosync protocol. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. En todas las versiones 7.x y 6.x (corregidas en la versión 8.0.0), cuando se utiliza un dispositivo Quorum para alta disponibilidad (HA) de BIG-IQ para la conmutación automática por error, BIG-IQ n... • https://support.f5.com/csp/article/K01243064 •
CVSS: 7.5EPSS: 0%CPEs: 84EXPL: 0CVE-2021-23004
https://notcve.org/view.php?id=CVE-2021-23004
31 Mar 2021 — On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, Multipath TCP (MPTCP) forwarding flows may be created on standard virtual servers without MPTCP enabled in the applied TCP profile. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. En BIG-IP versiones 16.0.x anteriores a 16.0.1.1, versiones 15.1.x anteriores a 15.1.2, versiones 14.1.x anteriores a ... • https://support.f5.com/csp/article/K31025212 •
CVSS: 4.3EPSS: 0%CPEs: 84EXPL: 0CVE-2021-23001
https://notcve.org/view.php?id=CVE-2021-23001
31 Mar 2021 — On versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, the upload functionality in BIG-IP Advanced WAF and BIG-IP ASM allows an authenticated user to upload files to the BIG-IP system using a call to an undisclosed iControl REST endpoint. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. En las versiones 16.0.x anteriores a 16.0.1.1, versiones 15.1.x anteriore... • https://support.f5.com/csp/article/K06440657 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 5.3EPSS: 0%CPEs: 84EXPL: 0CVE-2021-22998
https://notcve.org/view.php?id=CVE-2021-22998
31 Mar 2021 — On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, SYN flood protection thresholds are not enforced in secure network address translation (SNAT) listeners. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. En BIG-IP versiones 16.0.x anteriores a 16.0.1.1, versiones 15.1.x anteriores a 15.1.2.1, versiones 14.1.x anteriores a 14.1.4, versiones 13.1.x ... • https://support.f5.com/csp/article/K31934524 •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-22997
https://notcve.org/view.php?id=CVE-2021-22997
31 Mar 2021 — On all 7.x and 6.x versions (fixed in 8.0.0), BIG-IQ HA ElasticSearch service does not implement any form of authentication for the clustering transport services, and all data used by ElasticSearch for transport is unencrypted. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. En todas las versiones 7.x y 6.x (corregidas en 8.0.0), el servicio BIG-IQ HA ElasticSearch no implementa ninguna forma de autenticación para los servicios de transporte de clustering, y ... • https://support.f5.com/csp/article/K34074377 • CWE-306: Missing Authentication for Critical Function •