CVSS: 8.3EPSS: 0%CPEs: 84EXPL: 0CVE-2021-22978
https://notcve.org/view.php?id=CVE-2021-22978
12 Feb 2021 — On BIG-IP version 16.0.x before 16.0.1, 15.1.x before 15.1.1, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.5, and all 12.1.x and 11.6.x versions, undisclosed endpoints in iControl REST allow for a reflected XSS attack, which could lead to a complete compromise of BIG-IP if the victim user is granted the admin role. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. En BIG-IP versiones 16.0.x anteriores a 16.0.1, versiones 15.1.x anteriores a 15.1.1, versiones 14... • https://support.f5.com/csp/article/K87502622 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 70EXPL: 0CVE-2021-22979
https://notcve.org/view.php?id=CVE-2021-22979
12 Feb 2021 — On BIG-IP version 16.0.x before 16.0.1, 15.1.x before 15.1.1, 14.1.x before 14.1.2.8, 13.1.x before 13.1.3.5, and all 12.1.x versions, a reflected Cross-Site Scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility when Fraud Protection Service is provisioned and allows an attacker to execute JavaScript in the context of the current logged-in user. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. En BIG-IP versiones 16.0.... • https://support.f5.com/csp/article/K63497634 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 10EXPL: 0CVE-2021-22976
https://notcve.org/view.php?id=CVE-2021-22976
12 Feb 2021 — On BIG-IP Advanced WAF and ASM version 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.6, and all 12.1.x versions, when the BIG-IP ASM system processes WebSocket requests with JSON payloads, an unusually large number of parameters can cause excessive CPU usage in the BIG-IP ASM bd process. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. En BIG-IP Advanced WAF y ASM versiones 16.0.x anteriores a 16.0.1.1, versiones 15... • https://support.f5.com/csp/article/K88230177 •
CVSS: 7.5EPSS: 0%CPEs: 12EXPL: 0CVE-2020-27718
https://notcve.org/view.php?id=CVE-2020-27718
24 Dec 2020 — When a BIG-IP ASM or Advanced WAF system running version 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, or 11.6.1-11.6.5.2 processes requests with JSON payload, an unusually large number of parameters can cause excessive CPU usage in the BIG-IP ASM bd process. Cuando un sistema BIG-IP ASM o Advanced WAF ejecutándose en las versiones 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.3, 13.1.0-13.1.3.4, 12.1.0-12.1. 5.2, o 11.6.1-11.6.5.2, procesa peticiones con carga útil JSON... • https://support.f5.com/csp/article/K58102101 •
CVSS: 6.5EPSS: 0%CPEs: 42EXPL: 0CVE-2020-5938
https://notcve.org/view.php?id=CVE-2020-5938
29 Oct 2020 — On BIG-IP 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, when negotiating IPSec tunnels with configured, authenticated peers, the peer may negotiate a different key length than the BIG-IP configuration would otherwise allow. En BIG-IP versiones 13.1.0-13.1.3.4, 12.1.0-12.1.5.2 y 11.6.1-11.6.5.2, cuando se negocian túneles IPSec con peers autenticados configurados, el peer puede negociar una longitud de clave diferente a la que permitiría la configuración BIG-IP • https://support.f5.com/csp/article/K76610106 • CWE-326: Inadequate Encryption Strength •
CVSS: 5.9EPSS: 0%CPEs: 112EXPL: 0CVE-2020-5929
https://notcve.org/view.php?id=CVE-2020-5929
25 Sep 2020 — In versions 13.0.0-13.0.0 HF2, 12.1.0-12.1.2 HF1, and 11.6.1-11.6.2, BIG-IP platforms with Cavium Nitrox SSL hardware acceleration cards, a Virtual Server configured with a Client SSL profile, and using Anonymous (ADH) or Ephemeral (DHE) Diffie-Hellman key exchange and Single DH use option not enabled in the options list may be vulnerable to crafted SSL/TLS Handshakes that may result with a PMS (Pre-Master Secret) that starts in a 0 byte and may lead to a recovery of plaintext messages as BIG-IP TLS/SSL ADH... • https://support.f5.com/csp/article/K91158923 • CWE-203: Observable Discrepancy •
CVSS: 9.3EPSS: 0%CPEs: 70EXPL: 0CVE-2020-5922
https://notcve.org/view.php?id=CVE-2020-5922
26 Aug 2020 — In BIG-IP versions 15.0.0-15.1.0.4, 14.1.0-14.1.2.6, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.2, iControl REST does not implement Cross Site Request Forgery protections for users which make use of Basic Authentication in a web browser. En BIG-IP versiones 15.0.0-15.1.0.4, 14.1.0-14.1.2.6, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1 y 11.6.1-11.6.5.2, iControl REST no implementa protecciones de Cross Site Request Forgery para unos usuarios que usan la autenticación básica en un navegador web • https://support.f5.com/csp/article/K20606443 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 7.1EPSS: 0%CPEs: 84EXPL: 0CVE-2020-5912
https://notcve.org/view.php?id=CVE-2020-5912
26 Aug 2020 — In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the restjavad process's dump command does not follow current best coding practices and may overwrite arbitrary files. En BIG-IP versiones 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1 y 11.6.1- 11.6.5.1, el comando de volcado del proceso restjavad no sigue las mejores prácticas de codificación actuales y puede sobrescribir archivos arbitrarios • https://support.f5.com/csp/article/K12936322 •
CVSS: 7.4EPSS: 0%CPEs: 84EXPL: 0CVE-2020-5913
https://notcve.org/view.php?id=CVE-2020-5913
26 Aug 2020 — In versions 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.2, the BIG-IP Client or Server SSL profile ignores revoked certificates, even when a valid CRL is present. This impacts SSL/TLS connections and may result in a man-in-the-middle attack on the connections. En las versiones 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.1 y 11.6.1-11.6.5.2, el perfil SSL de Cliente o Servidor BIG-IP ignora los certificados revocados, incluso cuando hay una CRL v... • https://support.f5.com/csp/article/K72752002 • CWE-295: Improper Certificate Validation •
CVSS: 10.0EPSS: 94%CPEs: 84EXPL: 72CVE-2020-5902 – F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2020-5902
01 Jul 2020 — In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages. En BIG-IP versiones 15.0.0 hasta 15.1.0.3, 14.1.0 hasta 14.1.2.5, 13.1.0 hasta 13.1.3.3, 12.1.0 hasta 12.1.5.1 y 11.6.1 hasta 11.6.5.1, el Traffic Management User Interface (TMUI), también se conoce como la utilidad de Configuración, present... • https://packetstorm.news/files/id/175671 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •