CVSS: 6.5EPSS: 0%CPEs: 52EXPL: 0CVE-2017-6158
https://notcve.org/view.php?id=CVE-2017-6158
13 Apr 2018 — In F5 BIG-IP 12.0.0-12.1.2, 11.6.0-11.6.1, 11.5.1-11.5.5, or 11.2.1 there is a vulnerability in TMM related to handling of invalid IP addresses. En F5 BIG-IP, de la versión 12.0.0 a la 12.1.2, de la versión 11.6.0 a la 11.6.1, de la versión 11.5.1 a la 11.5.5 o en la versión 11.2.1, hay una vulnerabilidad en TMM relacionada con la gestión de direcciones IP no válidas. • https://support.f5.com/csp/article/K19361245 •
CVSS: 9.8EPSS: 0%CPEs: 65EXPL: 0CVE-2018-5506
https://notcve.org/view.php?id=CVE-2018-5506
13 Apr 2018 — In F5 BIG-IP 13.0.0, 12.1.0-12.1.2, 11.6.1, 11.5.1-11.5.5, or 11.2.1 the Apache modules apache_auth_token_mod and mod_auth_f5_auth_token.cpp allow possible unauthenticated bruteforce on the em_server_ip authorization parameter to obtain which SSL client certificates used for mutual authentication between BIG-IQ or Enterprise Manager (EM) and managed BIG-IP devices. En F5 BIG-IP, en su versión 13.0.0, de la versión 12.1.0a la 12.1.2, la versión 11.6.1, de la versión 11.5.1 a la 11.5.5 o en la versión 11.2.1,... • https://support.f5.com/csp/article/K65355492 •
CVSS: 5.9EPSS: 0%CPEs: 22EXPL: 0CVE-2014-4024
https://notcve.org/view.php?id=CVE-2014-4024
19 Mar 2018 — SSL virtual servers in F5 BIG-IP systems 10.x before 10.2.4 HF9, 11.x before 11.2.1 HF12, 11.3.0 before HF10, 11.4.0 before HF8, 11.4.1 before HF5, 11.5.0 before HF5, and 11.5.1 before HF5, when used with third-party Secure Sockets Layer (SSL) accelerator cards, might allow remote attackers to have unspecified impact via a timing side-channel attack. Los servidores virtuales SSL en sistemas F5 BIG-IP, en versiones 10.x anteriores a la 10.2.4 HF9, versiones 11.x anteriores a la 11.2.1 HF12, versiones 11.3.0 ... • https://exchange.xforce.ibmcloud.com/vulnerabilities/95834 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.9EPSS: 0%CPEs: 65EXPL: 0CVE-2018-5501
https://notcve.org/view.php?id=CVE-2018-5501
01 Mar 2018 — In some circumstances, on F5 BIG-IP systems running 13.0.0, 12.1.0 - 12.1.3.1, any 11.6.x or 11.5.x release, or 11.2.1, TCP DNS profile allows excessive buffering due to lack of flow control. En algunas circunstancias, en sistemas F5 BIG-IP que ejecutan 13.0.0, 12.1.0 - 12.1.3.1, cualquier versión 11.6.x o 11.5.x o 11.2.1, el perfil TCP DNS permite el buffering excesivo debido a la falta de control de flujo. • http://www.securityfocus.com/bid/103211 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.5EPSS: 2%CPEs: 88EXPL: 0CVE-2017-6132
https://notcve.org/view.php?id=CVE-2017-6132
21 Dec 2017 — In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and Websafe software version 13.0.0, 12.0.0 to 12.1.2, 11.6.0 to 11.6.1 and 11.5.0 - 11.5.4, an undisclosed sequence of packets sent to BIG-IP High Availability state mirror listeners (primary and/or secondary IP) may cause TMM to restart. En F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM y Websafe, en versiones de software 13.0.0, de la 12.0.0 a la 12.1.2, de la 11.6.0 a la 11.6.1 y de la 11.5.0 a ... • http://www.securityfocus.com/bid/102333 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 176EXPL: 0CVE-2017-6140
https://notcve.org/view.php?id=CVE-2017-6140
21 Dec 2017 — On the BIG-IP 2000s, 2200s, 4000s, 4200v, i5600, i5800, i7600, i7800, i10600,i10800, and VIPRION 4450 blades, running version 11.5.0, 11.5.1, 11.5.2, 11.5.3, 11.5.4, 11.6.0, 11.6.1, 12.0.0, 12.1.0, 12.1.1 or 12.1.2 of BIG-IP LTM, AAM, AFM, Analytics, ASM, DNS, GTM or PEM, an undisclosed sequence of packets sent to Virtual Servers with client or server SSL profiles may cause disruption of data plane services. En los productos BIG-IP 2000s, 2200s, 4000s, 4200v, i5600, i5800, i7600, i7800, i10600,i10800 y los ... • http://www.securitytracker.com/id/1040042 • CWE-20: Improper Input Validation •
CVSS: 8.1EPSS: 2%CPEs: 104EXPL: 0CVE-2017-6164
https://notcve.org/view.php?id=CVE-2017-6164
21 Dec 2017 — In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, WebAccelerator and WebSafe software version 13.0.0, 12.0.0 - 12.1.2, 11.6.0 - 11.6.1 and 11.5.0 - 11.5.4, in some circumstances, Traffic Management Microkernel (TMM) does not properly handle certain malformed TLS1.2 records, which allows remote attackers to cause a denial-of-service (DoS) or possible remote command execution on the BIG-IP system. En F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, ... • http://www.securitytracker.com/id/1040054 • CWE-20: Improper Input Validation •
CVSS: 8.1EPSS: 7%CPEs: 47EXPL: 0CVE-2017-6157
https://notcve.org/view.php?id=CVE-2017-6157
27 Oct 2017 — In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and Websafe software version 12.0.0 to 12.1.1, 11.6.0 to 11.6.1, 11.5.0 - 11.5.4, virtual servers with a configuration using the HTTP Explicit Proxy functionality and/or SOCKS profile are vulnerable to an unauthenticated, remote attack that allows modification of BIG-IP system configuration, extraction of sensitive system files, and/or possible remote command execution on the BIG-IP system. En F5 BIG-IP LTM, AAM, AFM, Analytics,... • http://www.securityfocus.com/bid/101634 •
CVSS: 5.9EPSS: 4%CPEs: 26EXPL: 0CVE-2017-6160
https://notcve.org/view.php?id=CVE-2017-6160
27 Oct 2017 — In F5 BIG-IP AAM and PEM software version 12.0.0 to 12.1.1, 11.6.0 to 11.6.1, 11.4.1 to 11.5.4, a remote attacker may create maliciously crafted HTTP request to cause Traffic Management Microkernel (TMM) to restart and temporarily fail to process traffic. This issue is exposed on virtual servers using a Policy Enforcement profile or a Web Acceleration profile. Systems that do not have BIG-IP AAM module provisioned are not vulnerable. The Traffic Management Microkernel (TMM) may restart and temporarily fail ... • http://www.securityfocus.com/bid/101632 •
CVSS: 5.3EPSS: 2%CPEs: 109EXPL: 0CVE-2017-6161
https://notcve.org/view.php?id=CVE-2017-6161
27 Oct 2017 — In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, WebAccelerator software version 12.0.0 - 12.1.2, 11.6.0 - 11.6.1, 11.4.0 - 11.5.4, 11.2.1, when ConfigSync is configured, attackers on adjacent networks may be able to bypass the TLS protections usually used to encrypted and authenticate connections to mcpd. This vulnerability may allow remote attackers to cause a denial-of-service (DoS) attack via resource exhaustion. En F5 BIG-IP LTM, AAM, AFM, Analytics, APM, A... • http://www.securityfocus.com/bid/101636 • CWE-400: Uncontrolled Resource Consumption •