CVSS: 7.8EPSS: 0%CPEs: 33EXPL: 0CVE-2022-35240 – BIG-IP Message Routing MQTT vulnerability CVE-2022-35240
https://notcve.org/view.php?id=CVE-2022-35240
04 Aug 2022 — In BIG-IP Versions 16.1.x before 16.1.2.2, 15.1.x before 15.1.6.1, and 14.1.x before 14.1.5, when the Message Routing (MR) Message Queuing Telemetry Transport (MQTT) profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En las versiones 16.1.x anteriores a 16.1.2.2, 15.1.x anteriores a 15.1.6.1 y 14.1.x anteriores a 14.1.5 de BIG-IP, cuando el perfil M... • https://support.f5.com/csp/article/K28405643 • CWE-404: Improper Resource Shutdown or Release •
CVSS: 7.8EPSS: 0%CPEs: 33EXPL: 0CVE-2022-35236 – HTTP2 profile vulnerability CVE-2022-35236
https://notcve.org/view.php?id=CVE-2022-35236
04 Aug 2022 — In BIG-IP Versions 16.1.x before 16.1.2.2, 15.1.x before 15.1.6.1, and 14.1.x before 14.1.5, when an HTTP2 profile is configured on a virtual server, undisclosed traffic can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En BIG-IP versiones 16.1.x antes de 16.1.2.2, 15.1.x antes de 15.1.6.1 y 14.1.x antes de 14.1.5, cuando es configurado un perfil HTTP2 en un servidor virtual, el tráfico no revelado puede causar... • https://support.f5.com/csp/article/K79933541 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 9.4EPSS: 0%CPEs: 33EXPL: 0CVE-2022-34865 – Traffic intelligence feeds vulnerability CVE-2022-34865
https://notcve.org/view.php?id=CVE-2022-34865
04 Aug 2022 — In BIG-IP Versions 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, Traffic Intelligence feeds, which use HTTPS, do not verify the remote endpoint identity, allowing for potential data poisoning. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En BIG-IP versiones 15.1.x anteriores a 15.1.6.1, 14.1.x anteriores a 14.1.5, y todas las versiones de 13.1.x, las alimentaciones de Inteligencia de Tráfico, que usan HTTPS, no verifican la identid... • https://support.f5.com/csp/article/K25046752 • CWE-295: Improper Certificate Validation •
CVSS: 7.8EPSS: 0%CPEs: 44EXPL: 1CVE-2022-34862 – TMM vulnerability CVE-2022-34862
https://notcve.org/view.php?id=CVE-2022-34862
04 Aug 2022 — In BIG-IP Versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, when an LTM virtual server is configured to perform normalization, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En BIG-IP versiones 16.1.x anteriores a 16.1.3.1, 15.1.x anteriores a 15.1.6.1, 14.1.x anteriores a 14.1.5, y todas las versiones de 13.1.x, cuando ... • https://support.f5.com/csp/article/K66510514 • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 6.8EPSS: 0%CPEs: 56EXPL: 0CVE-2022-34851 – BIG-IP and BIG-IQ iControl SOAP vulnerability CVE-2022-34851
https://notcve.org/view.php?id=CVE-2022-34851
04 Aug 2022 — In BIG-IP Versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and all versions of 13.1.x, and BIG-IQ Centralized Management all versions of 8.x, an authenticated attacker may cause iControl SOAP to become unavailable through undisclosed requests. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En BIG-IP versiones 17.0.x anteriores a 17.0.0.1, 16.1.x anteriores a 16.1.3.1, 15.1.x anteriores a 15.1.6.1, 14.1.x a... • https://support.f5.com/csp/article/K50310001 • CWE-20: Improper Input Validation •
CVSS: 7.8EPSS: 0%CPEs: 33EXPL: 0CVE-2022-34655 – TMM vulnerability CVE-2022-34655
https://notcve.org/view.php?id=CVE-2022-34655
04 Aug 2022 — In BIG-IP Versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.6.1, and 14.1.x before 14.1.5, when an iRule containing the HTTP::payload command is configured on a virtual server, undisclosed traffic can cause Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En BIG-IP versiones 16.0.x anteriores a 16.0.1.1, 15.1.x anteriores a 15.1.6.1 y 14.1.x anteriores a 14.1.5, cuando es configurado una iRule que contiene el c... • https://support.f5.com/csp/article/K93504311 • CWE-457: Use of Uninitialized Variable CWE-908: Use of Uninitialized Resource •
CVSS: 6.1EPSS: 0%CPEs: 55EXPL: 0CVE-2022-33968 – BIG-IP LTM and APM NTLM vulnerability CVE-2022-33968
https://notcve.org/view.php?id=CVE-2022-33968
04 Aug 2022 — In BIG-IP Versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and all versions of 13.1.x, when an LTM monitor or APM SSO is configured on a virtual server, and NTLM challenge-response is in use, undisclosed traffic can cause a buffer over-read. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En BIG-IP versiones 17.0.x anteriores a 17.0.0.1, 16.1.x anteriores a 16.1.3.1, 15.1.x anteriores a 15.1.6.1, 14.1.x ant... • https://support.f5.com/csp/article/K23465404 • CWE-125: Out-of-bounds Read •
CVSS: 6.7EPSS: 0%CPEs: 55EXPL: 0CVE-2022-33962 – BIG-IP iRule vulnerability CVE-2022-33962
https://notcve.org/view.php?id=CVE-2022-33962
04 Aug 2022 — In BIG-IP Versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and all versions of 13.1.x, certain iRules commands may allow an attacker to bypass the access control restrictions for a self IP address, regardless of the port lockdown settings. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En BIG-IP versiones 17.0.x anteriores a 17.0.0.1, 16.1.x anteriores a 16.1.3.1, 15.1.x anteriores a 15.1.6.1, 14.1.x anter... • https://support.f5.com/csp/article/K80970653 • CWE-269: Improper Privilege Management •
CVSS: 6.8EPSS: 0%CPEs: 4EXPL: 0CVE-2022-33947 – BIG-IP DNS TMUI Vulnerability CVE-2022-33947
https://notcve.org/view.php?id=CVE-2022-33947
04 Aug 2022 — In BIG-IP Versions 16.1.x before 16.1.3, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, a vulnerability exists in undisclosed pages of the BIG-IP DNS Traffic Management User Interface (TMUI) that allows an authenticated attacker with at least operator role privileges to cause the Tomcat process to restart and perform unauthorized DNS requests and operations through undisclosed requests. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. E... • https://support.f5.com/csp/article/K38893457 • CWE-502: Deserialization of Untrusted Data •
CVSS: 7.8EPSS: 0%CPEs: 44EXPL: 0CVE-2022-32455 – TMM vulnerability CVE-2022-32455
https://notcve.org/view.php?id=CVE-2022-32455
04 Aug 2022 — In BIG-IP Versions 16.1.x before 16.1.2.2, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, when a BIG-IP LTM Client SSL profile is configured on a virtual server to perform client certificate authentication with session tickets enabled, undisclosed requests cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En BIG-IP versiones 16.1.x anteriores a 16.1.2.2, 15.1.x anteriores a 15.... • https://support.f5.com/csp/article/K16852653 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •