CVSS: 9.1EPSS: 0%CPEs: 3EXPL: 0CVE-2020-5869
https://notcve.org/view.php?id=CVE-2020-5869
24 Apr 2020 — In BIG-IQ 5.2.0-7.0.0, high availability (HA) synchronization is not secure by TLS and may allow on-path attackers to read / modify confidential data in transit. En BIG -IQ versiones 5.2.0-7.0.0, la sincronización de alta disponibilidad (HA) no es segura por TLS y puede permitir a atacantes sobre la ruta leer y modificar datos confidenciales en tránsito. • https://support.f5.com/csp/article/K28855111 • CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel •
CVSS: 10.0EPSS: 1%CPEs: 2EXPL: 0CVE-2020-5868
https://notcve.org/view.php?id=CVE-2020-5868
24 Apr 2020 — In BIG-IQ 6.0.0-7.0.0, a remote access vulnerability has been discovered that may allow a remote user to execute shell commands on affected systems using HTTP requests to the BIG-IQ user interface. En BIG-IQ versión 6.0.0-7.0.0, se ha descubierto una vulnerabilidad de acceso remoto que puede permitir a un usuario remoto ejecutar comandos de shell en los sistemas afectados usando peticiones HTTP en la interfaz de usuario de BIG-IQ. • https://support.f5.com/csp/article/K37130415 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 8.1EPSS: 0%CPEs: 4EXPL: 0CVE-2020-5867
https://notcve.org/view.php?id=CVE-2020-5867
23 Apr 2020 — In versions prior to 3.3.0, the NGINX Controller Agent installer script 'install.sh' uses HTTP instead of HTTPS to check and install packages En versiones anteriores a la versión 3.3.0, el instalador de NGINX Controller Agent "install.sh" usa HTTP en lugar de HTTPS para comprobar e instalar paquetes. • https://security.netapp.com/advisory/ntap-20200430-0005 • CWE-319: Cleartext Transmission of Sensitive Information CWE-494: Download of Code Without Integrity Check •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2020-5866
https://notcve.org/view.php?id=CVE-2020-5866
23 Apr 2020 — In versions of NGINX Controller prior to 3.3.0, the helper.sh script, which is used optionally in NGINX Controller to change settings, uses sensitive items as command-line arguments. En las versiones de NGINX Controller anteriores a la versión 3.3.0, el script helper.sh, que es usado opcionalmente en NGINX Controller para cambiar la configuración, usa elementos confidenciales como argumentos de línea de comandos. • https://security.netapp.com/advisory/ntap-20200430-0005 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.4EPSS: 0%CPEs: 3EXPL: 0CVE-2020-5864
https://notcve.org/view.php?id=CVE-2020-5864
23 Apr 2020 — In versions of NGINX Controller prior to 3.2.0, communication between NGINX Controller and NGINX Plus instances skip TLS verification by default. En las versiones de NGINX Controller anteriores a 3.2.0, una comunicación entre NGINX Controller y las instancias NGINX Plus omite una verificación de TLS por defecto. • https://security.netapp.com/advisory/ntap-20200430-0005 • CWE-295: Improper Certificate Validation •
CVSS: 5.8EPSS: 0%CPEs: 4EXPL: 0CVE-2020-5865
https://notcve.org/view.php?id=CVE-2020-5865
23 Apr 2020 — In versions prior to 3.3.0, the NGINX Controller is configured to communicate with its Postgres database server over unencrypted channels, making the communicated data vulnerable to interception via man-in-the-middle (MiTM) attacks. En versiones anteriores a la versión 3.3.0, el NGINX Controller está configurado para comunicarse con su servidor de base de datos Postgres sobre canales no cifrados, haciendo que los datos comunicados sean vulnerables a una intercepción por medio de ataques de tipo man-in-the-m... • https://security.netapp.com/advisory/ntap-20200430-0005 • CWE-319: Cleartext Transmission of Sensitive Information •
CVSS: 7.5EPSS: 0%CPEs: 33EXPL: 0CVE-2020-5862
https://notcve.org/view.php?id=CVE-2020-5862
27 Mar 2020 — On BIG-IP 15.1.0-15.1.0.1, 15.0.0-15.0.1.1, and 14.1.0-14.1.2.2, under certain conditions, TMM may crash or stop processing new traffic with the DPDK/ENA driver on AWS systems while sending traffic. This issue does not affect any other platforms, hardware or virtual, or any other cloud provider since the affected driver is specific to AWS. En BIG-IP versiones 15.1.0-15.1.0.1, 15.0.0-15.0.1.1 y 14.1.0-14.1.2.2, bajo determinadas condiciones, TMM puede bloquear o detener el procesamiento de tráfico nuevo con ... • https://support.f5.com/csp/article/K01054113 •
CVSS: 8.6EPSS: 0%CPEs: 4EXPL: 0CVE-2020-5863
https://notcve.org/view.php?id=CVE-2020-5863
27 Mar 2020 — In NGINX Controller versions prior to 3.2.0, an unauthenticated attacker with network access to the Controller API can create unprivileged user accounts. The user which is created is only able to upload a new license to the system but cannot view or modify any other components of the system. En NGINX Controller versiones anteriores a 3.2.0, un atacante no autenticado con acceso de red a la API Controller puede crear cuentas de usuario no privilegiados. El usuario que es creado solo es capaz de cargar una nu... • https://security.netapp.com/advisory/ntap-20200430-0005 •
CVSS: 7.5EPSS: 0%CPEs: 11EXPL: 0CVE-2020-5861
https://notcve.org/view.php?id=CVE-2020-5861
27 Mar 2020 — On BIG-IP 12.1.0-12.1.5, the TMM process may produce a core file in some cases when Ram Cache incorrectly optimizes stored data resulting in memory errors. En BIG-IP versiones 12.1.0-12.1.5, el proceso TMM puede producir un archivo principal en algunos casos cuando Ram Cache optimiza incorrectamente los datos almacenados resultando en errores de memoria. • https://support.f5.com/csp/article/K22113131 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.8EPSS: 0%CPEs: 68EXPL: 0CVE-2020-5858
https://notcve.org/view.php?id=CVE-2020-5858
27 Mar 2020 — On BIG-IP 15.0.0-15.0.1.2, 14.1.0-14.1.2.2, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5.1 and BIG-IQ 7.0.0, 6.0.0-6.1.0, and 5.2.0-5.4.0, users with non-administrator roles (for example, Guest or Resource Administrator) with tmsh shell access can execute arbitrary commands with elevated privilege via a crafted tmsh command. En BIG-IP versiones 15.0.0-15.0.1.2, 14.1.0-14.1.2.2, 13.1.0-13.1.3.2, 12.1.0-12.1.5 y 11.5.2-11.6.5.1 y BIG-IQ versiones 7.0. 0, 6.0.0-6.1.0 y 5.2.0-5.4.0, los usuarios con roles ... • https://support.f5.com/csp/article/K36814487 •