CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2024-23314 – BIG-IP HTTP/2 vulnerability
https://notcve.org/view.php?id=CVE-2024-23314
14 Feb 2024 — When HTTP/2 is configured on BIG-IP or BIG-IP Next SPK systems, undisclosed responses can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated Cuando HTTP/2 está configurado en sistemas BIG-IP o BIG-IP Next SPK, las respuestas no reveladas pueden provocar la finalización del Microkernel de gestión de tráfico (TMM). Nota: Las versiones de software que han llegado al final del soporte técnico (EoTS) no se eval... • https://my.f5.com/manage/s/article/K000137675 • CWE-908: Use of Uninitialized Resource •
CVSS: 8.7EPSS: 0%CPEs: 3EXPL: 0CVE-2024-22093 – Appliance mode iControl REST vulnerability
https://notcve.org/view.php?id=CVE-2024-22093
14 Feb 2024 — When running in appliance mode, an authenticated remote command injection vulnerability exists in an undisclosed iControl REST endpoint on multi-bladed systems. A successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated Cuando se ejecuta en modo dispositivo, existe una vulnerabilidad de inyección remota de comandos autenticada en un endpoint iControl REST no revelado en sistemas multiblade. Un exploit... • https://my.f5.com/manage/s/article/K000137522 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2024-23979 – BIG-IP SSL Client Certificate LDAP and CRLDP Authentication profiles vulnerability
https://notcve.org/view.php?id=CVE-2024-23979
14 Feb 2024 — When SSL Client Certificate LDAP or Certificate Revocation List Distribution Point (CRLDP) authentication profile is configured on a virtual server, undisclosed requests can cause an increase in CPU resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated Cuando el perfil de autenticación LDAP del certificado de cliente SSL o punto de distribución de lista de revocación de certificados (CRLDP) se configura en un servidor virtual, las solicitudes no d... • https://my.f5.com/manage/s/article/K000134516 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2024-21771 – F5 AFM Signature Matching Vulnerability
https://notcve.org/view.php?id=CVE-2024-21771
14 Feb 2024 — For unspecified traffic patterns, BIG-IP AFM IPS engine may spend an excessive amount of time matching the traffic against signatures, resulting in Traffic Management Microkernel (TMM) restarting and traffic disruption. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated Para patrones de tráfico no especificados, el motor BIG-IP AFM IPS puede dedicar una cantidad excesiva de tiempo a comparar el tráfico con las firmas, lo que provoca el reinicio del microkernel de ge... • https://my.f5.com/manage/s/article/K000137595 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 6.7EPSS: 0%CPEs: 4EXPL: 0CVE-2024-21782 – BIG-IP and BIG-IQ secure copy vulnerability
https://notcve.org/view.php?id=CVE-2024-21782
14 Feb 2024 — BIG-IP or BIG-IQ Resource Administrators and Certificate Managers who have access to the secure copy (scp) utility but do not have access to Advanced shell (bash) can execute arbitrary commands with a specially crafted command string. This vulnerability is due to an incomplete fix for CVE-2020-5873. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated Los administradores de recursos y administradores de certificados de BIG-IP o BIG-IQ que tienen acceso a la utilidad d... • https://my.f5.com/manage/s/article/K98606833 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 6.0EPSS: 0%CPEs: 3EXPL: 0CVE-2024-23976 – BIG-IP Appliance mode iAppsLX vulnerability
https://notcve.org/view.php?id=CVE-2024-23976
14 Feb 2024 — When running in Appliance mode, an authenticated attacker assigned the Administrator role may be able to bypass Appliance mode restrictions utilizing iAppsLX templates on a BIG-IP system. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated Cuando se ejecuta en modo Dispositivo, un atacante autenticado al que se le haya asignado la función de Administrador puede eludir las restricciones del modo Dispositivo utilizando plantillas iAppsLX en un sistema BIG-IP. Nota: Las... • https://my.f5.com/manage/s/article/K91054692 • CWE-266: Incorrect Privilege Assignment •
CVSS: 8.3EPSS: 0%CPEs: 3EXPL: 0CVE-2024-22389 – BIG-IP iControl REST API Vulnerability
https://notcve.org/view.php?id=CVE-2024-22389
14 Feb 2024 — When BIG-IP is deployed in high availability (HA) and an iControl REST API token is updated, the change does not sync to the peer device. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated Cuando BIG-IP se implementa en alta disponibilidad (HA) y se actualiza un token de API REST de iControl, el cambio no se sincroniza con el dispositivo par. Nota: Las versiones de software que han llegado al final del soporte técnico (EoTS) no se evalúan • https://my.f5.com/manage/s/article/K32544615 • CWE-613: Insufficient Session Expiration •