CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-22996
https://notcve.org/view.php?id=CVE-2021-22996
31 Mar 2021 — On all 7.x versions (fixed in 8.0.0), when set up for auto failover, a BIG-IQ Data Collection Device (DCD) cluster member that receives an undisclosed message may cause the corosync process to abort. This behavior may lead to a denial-of-service (DoS) and impact the stability of a BIG-IQ high availability (HA) cluster. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. En todas las versiones 7.x (corregidas en 8.0.0), cuando se configura para la conmutación auto... • https://support.f5.com/csp/article/K16352404 •
CVSS: 4.5EPSS: 0%CPEs: 9EXPL: 0CVE-2021-23002
https://notcve.org/view.php?id=CVE-2021-23002
31 Mar 2021 — When using BIG-IP APM 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, or all 12.1.x and 11.6.x versions or Edge Client versions 7.2.1.x before 7.2.1.1, 7.1.9.x before 7.1.9.8, or 7.1.8.x before 7.1.8.5, the session ID is visible in the arguments of the f5vpn.exe command when VPN is launched from the browser on a Windows system. Addressing this issue requires both the client and server fixes. Note: Software versions which have reached End of Software Development ... • https://support.f5.com/csp/article/K71891773 •
CVSS: 7.5EPSS: 0%CPEs: 28EXPL: 0CVE-2021-22999
https://notcve.org/view.php?id=CVE-2021-22999
31 Mar 2021 — On versions 15.0.x before 15.1.0 and 14.1.x before 14.1.4, the BIG-IP system provides an option to connect HTTP/2 clients to HTTP/1.x servers. When a client is slow to accept responses and it closes a connection prematurely, the BIG-IP system may indefinitely retain some streams unclosed. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. En las versiones 15.0.x anteriores a 15.1.0 y 14.1.x anteriores a 14.1.4, el sistema BIG-IP ofrece una opción para conectar c... • https://support.f5.com/csp/article/K02333782 •
CVSS: 7.5EPSS: 0%CPEs: 84EXPL: 0CVE-2021-23003
https://notcve.org/view.php?id=CVE-2021-23003
31 Mar 2021 — On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, the Traffic Management Microkernel (TMM) process may produce a core file when undisclosed MPTCP traffic passes through a standard virtual server. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. En BIG-IP versiones 16.0.x anteriores a 16.0.1.1, versiones 15.1.x anteriores a 15.1.2, versiones 14.1.x... • https://support.f5.com/csp/article/K43470422 •
CVSS: 7.5EPSS: 0%CPEs: 28EXPL: 0CVE-2021-23000
https://notcve.org/view.php?id=CVE-2021-23000
31 Mar 2021 — On BIG-IP versions 13.1.3.4-13.1.3.6 and 12.1.5.2, if the tmm.http.rfc.enforcement BigDB key is enabled in a BIG-IP system, or the Bad host header value is checked in the AFM HTTP security profile associated with a virtual server, in rare instances, a specific sequence of malicious requests may cause TMM to restart. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. En BIG-IP versiones 13.1.3.4-13.1.3.6 y 12.1.5.2, si la clave de BigDB tmm.http.rfc.enforcement e... • https://support.f5.com/csp/article/K34441555 •
CVSS: 6.1EPSS: 0%CPEs: 84EXPL: 0CVE-2021-22994
https://notcve.org/view.php?id=CVE-2021-22994
31 Mar 2021 — On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, undisclosed endpoints in iControl REST allow for a reflected XSS attack, which could lead to a complete compromise of the BIG-IP system if the victim user is granted the admin role. This vulnerability is due to an incomplete fix for CVE-2020-5948. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. En... • https://support.f5.com/csp/article/K66851119 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.1EPSS: 0%CPEs: 84EXPL: 0CVE-2021-22989
https://notcve.org/view.php?id=CVE-2021-22989
31 Mar 2021 — On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, when running in Appliance mode with Advanced WAF or BIG-IP ASM provisioned, the TMUI, also referred to as the Configuration utility, has an authenticated remote command execution vulnerability in undisclosed pages. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. En BIG-IP versiones 16.0.x anterior... • https://support.f5.com/csp/article/K56142644 •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2021-22995
https://notcve.org/view.php?id=CVE-2021-22995
31 Mar 2021 — On all 7.x and 6.x versions (fixed in 8.0.0), BIG-IQ high availability (HA) when using a Quorum device for automatic failover does not implement any form of authentication with the Corosync daemon. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. En todas las versiones 7.x y 6.x (corregidas en versión 8.0.0), la alta disponibilidad (HA) de BIG-IQ cuando se usa un dispositivo Quorum para la conmutación automática por error no implementa ninguna forma de autenti... • https://support.f5.com/csp/article/K13155201 • CWE-306: Missing Authentication for Critical Function •
CVSS: 9.0EPSS: 0%CPEs: 84EXPL: 0CVE-2021-22990
https://notcve.org/view.php?id=CVE-2021-22990
31 Mar 2021 — On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, on systems with Advanced WAF or BIG-IP ASM provisioned, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has an authenticated remote command execution vulnerability in undisclosed pages. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. En BIG-IP versiones... • https://support.f5.com/csp/article/K45056101 •
CVSS: 9.9EPSS: 0%CPEs: 84EXPL: 0CVE-2021-22987
https://notcve.org/view.php?id=CVE-2021-22987
31 Mar 2021 — On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3 when running in Appliance mode, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has an authenticated remote command execution vulnerability in undisclosed pages. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. En BIG-IP versiones 16.0.x anteriores a 16.0... • https://support.f5.com/csp/article/K18132488 •