CVSS: 6.8EPSS: 0%CPEs: 57EXPL: 0CVE-2022-41770 – BIG-IP and BIG-IQ iControl REST vulnerability CVE-2022-41770
https://notcve.org/view.php?id=CVE-2022-41770
19 Oct 2022 — In BIG-IP versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.7, 14.1.x before 14.1.5.1, and all versions of 13.1.x, and BIG-IQ all versions of 8.x and 7.x, an authenticated iControl REST user can cause an increase in memory resource utilization, via undisclosed requests. En BIG-IP versiones 17.0.x anteriores a 17.0.0.1, 16.1.x anteriores a 16.1.3.1, 15.1.x anteriores a 15.1.7, 14.1.x anteriores a 14.1.5.1, y todas las versiones de la 13.1.x, y en BIG-IQ todas las versiones de la 8.x... • https://support.f5.com/csp/article/K22505850 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 6.1EPSS: 0%CPEs: 44EXPL: 0CVE-2022-41694 – BIG-IP and BIG-IQ mcpd vulnerability CVE-2022-41694
https://notcve.org/view.php?id=CVE-2022-41694
19 Oct 2022 — In BIG-IP versions 16.1.x before 16.1.3, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, and BIG-IQ versions 8.x before 8.2.0.1 and all versions of 7.x, when an SSL key is imported on a BIG-IP or BIG-IQ system, undisclosed input can cause MCPD to terminate. En BIG-IP versiones 16.1.x anteriores a 16.1.3, 15.1.x anteriores a 15.1.6.1, 14.1.x anteriores a 14.1.5 y todas las versiones de la 13.1.x, y en las versiones de BIG-IQ 8.x anteriores a 8.2.0.1 y todas las versiones de la 7.x, ... • https://support.f5.com/csp/article/K64829234 • CWE-20: Improper Input Validation •
CVSS: 7.8EPSS: 0%CPEs: 55EXPL: 0CVE-2022-41624 – BIG-IP iRules vulnerability CVE-2022-41624
https://notcve.org/view.php?id=CVE-2022-41624
19 Oct 2022 — In BIG-IP versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.2, 15.1.x before 15.1.7, 14.1.x before 14.1.5.2, and 13.1.x before 13.1.5.1, when a sideband iRule is configured on a virtual server, undisclosed traffic can cause an increase in memory resource utilization. En BIG-IP versiones 17.0.x anteriores a 17.0.0.1, 16.1.x anteriores a 16.1.3.2, 15.1.x anteriores a 15.1.7, 14.1.x anteriores a 14.1.5.2 y 13.1.x anteriores a 13.1.5.1, cuando es configurada una iRule de banda lateral en un servidor virtual... • https://support.f5.com/csp/article/K43024307 • CWE-401: Missing Release of Memory after Effective Lifetime •
CVSS: 7.8EPSS: 0%CPEs: 44EXPL: 0CVE-2022-36795 – BIG-IP software SYN cookies vulnerability CVE-2022-36795
https://notcve.org/view.php?id=CVE-2022-36795
19 Oct 2022 — In BIG-IP versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.7, and 14.1.x before 14.1.5.1, when an LTM TCP profile with Auto Receive Window Enabled is configured on a virtual server, undisclosed traffic can cause the virtual server to stop processing new client connections. En BIG-IP versiones 17.0.x anteriores a 17.0.0.1, 16.1.x anteriores a 16.1.3.1, 15.1.x anteriores a 15.1.7 y 14.1.x anteriores a 14.1.5.1, cuando es configurado un perfil LTM TCP con la Ventana de Recepción Auto... • https://support.f5.com/csp/article/K52494562 • CWE-682: Incorrect Calculation •
CVSS: 8.3EPSS: 0%CPEs: 44EXPL: 0CVE-2022-35735 – BIG-IP monitor configuration vulnerability CVE-2022-35735
https://notcve.org/view.php?id=CVE-2022-35735
04 Aug 2022 — In BIG-IP Versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and all versions of 13.1.x, an authenticated attacker with Resource Administrator or Manager privileges can create or modify existing monitor objects in the Configuration utility in an undisclosed manner leading to a privilege escalation. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En BIG-IP versiones 16.1.x anteriores a 16.1.3.1, 15.1.x anteriores a 15.1.6.1, 14.1.x a... • https://support.f5.com/csp/article/K13213418 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 10.0EPSS: 0%CPEs: 59EXPL: 0CVE-2022-35728 – iControl REST vulnerability CVE-2022-35728
https://notcve.org/view.php?id=CVE-2022-35728
04 Aug 2022 — In BIG-IP Versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and all versions of 13.1.x, and BIG-IQ version 8.x before 8.2.0 and all versions of 7.x, an authenticated user's iControl REST token may remain valid for a limited time after logging out from the Configuration utility. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En BIG-IP versiones 17.0.x anteriores a 17.0.0.1, 16.1.x anteriores a 16.1.3.1, 15.1... • https://support.f5.com/csp/article/K55580033 • CWE-613: Insufficient Session Expiration •
CVSS: 9.1EPSS: 0%CPEs: 44EXPL: 0CVE-2022-35243 – Authenticated iControl REST in Appliance mode vulnerability CVE-2022-35243
https://notcve.org/view.php?id=CVE-2022-35243
04 Aug 2022 — In BIG-IP Versions 16.1.x before 16.1.3, 15.1.x before 15.1.5.1, 14.1.x before 14.1.5, and all versions of 13.1.x, when running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, using an undisclosed iControl REST endpoint. A successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En BIG-IP versiones 16.1.x anteriores a 16.1.3,... • https://support.f5.com/csp/article/K11010341 • CWE-269: Improper Privilege Management •
CVSS: 7.8EPSS: 0%CPEs: 33EXPL: 0CVE-2022-35240 – BIG-IP Message Routing MQTT vulnerability CVE-2022-35240
https://notcve.org/view.php?id=CVE-2022-35240
04 Aug 2022 — In BIG-IP Versions 16.1.x before 16.1.2.2, 15.1.x before 15.1.6.1, and 14.1.x before 14.1.5, when the Message Routing (MR) Message Queuing Telemetry Transport (MQTT) profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En las versiones 16.1.x anteriores a 16.1.2.2, 15.1.x anteriores a 15.1.6.1 y 14.1.x anteriores a 14.1.5 de BIG-IP, cuando el perfil M... • https://support.f5.com/csp/article/K28405643 • CWE-404: Improper Resource Shutdown or Release •
CVSS: 7.8EPSS: 0%CPEs: 33EXPL: 0CVE-2022-35236 – HTTP2 profile vulnerability CVE-2022-35236
https://notcve.org/view.php?id=CVE-2022-35236
04 Aug 2022 — In BIG-IP Versions 16.1.x before 16.1.2.2, 15.1.x before 15.1.6.1, and 14.1.x before 14.1.5, when an HTTP2 profile is configured on a virtual server, undisclosed traffic can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En BIG-IP versiones 16.1.x antes de 16.1.2.2, 15.1.x antes de 15.1.6.1 y 14.1.x antes de 14.1.5, cuando es configurado un perfil HTTP2 en un servidor virtual, el tráfico no revelado puede causar... • https://support.f5.com/csp/article/K79933541 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 9.4EPSS: 0%CPEs: 33EXPL: 0CVE-2022-34865 – Traffic intelligence feeds vulnerability CVE-2022-34865
https://notcve.org/view.php?id=CVE-2022-34865
04 Aug 2022 — In BIG-IP Versions 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, Traffic Intelligence feeds, which use HTTPS, do not verify the remote endpoint identity, allowing for potential data poisoning. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En BIG-IP versiones 15.1.x anteriores a 15.1.6.1, 14.1.x anteriores a 14.1.5, y todas las versiones de 13.1.x, las alimentaciones de Inteligencia de Tráfico, que usan HTTPS, no verifican la identid... • https://support.f5.com/csp/article/K25046752 • CWE-295: Improper Certificate Validation •