CVSS: 7.5EPSS: 0%CPEs: 40EXPL: 0CVE-2017-6145
https://notcve.org/view.php?id=CVE-2017-6145
iControl REST in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, and WebSafe 12.0.0 through 12.1.2 and 13.0.0 includes a service to convert authorization BIGIPAuthCookie cookies to X-F5-Auth-Token tokens. This service does not properly re-validate cookies when making that conversion, allowing once-valid but now expired cookies to be converted to valid tokens. iControl REST en F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM y WebSafe 12.0.0 hasta la versión 12.1.2 y 13.0.0 incluye un servicio para convertir las cookies de autorización BIGIPAuthCookie en tokens X-F5-Auth-Token. Este servicio no revalida correctamente las cookies cuando se realiza la conversión, permitiendo que cookies que fueron válidas otrora, pero que ahora han caducado, se conviertan en tokens válidos. • https://support.f5.com/csp/article/K22317030 • CWE-613: Insufficient Session Expiration •
CVSS: 5.9EPSS: 0%CPEs: 20EXPL: 0CVE-2017-6147
https://notcve.org/view.php?id=CVE-2017-6147
In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, and WebSafe 12.1.2-HF1 and 13.0.0, an undisclosed type of responses may cause TMM to restart, causing an interruption of service when "SSL Forward Proxy" setting is enabled in both the Client and Server SSL profiles assigned to a BIG-IP Virtual Server. En F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM y WebSafe 12.1.2-HF1 y 13.0.0, una serie de peticiones no reveladas puede provocar el reinicio del TMM y la interrupción del servicio, cuando la configuración "SSL Forward Proxy" está habilitada en los perfiles SSL del servidor y del cliente asignados a un BIG-IP Virtual Server. • http://www.securityfocus.com/bid/100981 https://support.f5.com/csp/article/K43945001 •
CVSS: 7.8EPSS: 1%CPEs: 45EXPL: 4CVE-2015-4047
https://notcve.org/view.php?id=CVE-2015-4047
racoon/gssapi.c in IPsec-Tools 0.8.2 allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon crash) via a series of crafted UDP requests. racoon/gssapi.c en IPsec-Tools 0.8.2 permite a atacantes remotos causar una denegación de servicios (referencia a puntero nulo y caída de demonio IKE) a través de una serie de solicitudes UDP manipuladas. • http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159482.html http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159549.html http://packetstormsecurity.com/files/131992/IPsec-Tools-0.8.2-Denial-Of-Service.html http://seclists.org/fulldisclosure/2015/May/81 http://seclists.org/fulldisclosure/2015/May/83 http://www.debian.org/security/2015/dsa-3272 http://www.openwall.com/lists/oss-security/2015/05/20/1 http://www.openwall.com/lists/oss-security/20 • CWE-476: NULL Pointer Dereference •