CVSS: 7.8EPSS: 0%CPEs: 9EXPL: 0CVE-2021-22980
https://notcve.org/view.php?id=CVE-2021-22980
In Edge Client version 7.2.x before 7.2.1.1, 7.1.9.x before 7.1.9.8, and 7.1.x-7.1.8.x before 7.1.8.5, an untrusted search path vulnerability in the BIG-IP APM Client Troubleshooting Utility (CTU) for Windows could allow an attacker to load a malicious DLL library from its current directory. User interaction is required to exploit this vulnerability in that the victim must run this utility on the Windows system. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. En Edge Client versiones 7.2.x anteriores a 7.2.1.1, versiones 7.1.9.x anteriores 7.1.9.8 y versiones 7.1.x-7.1.8.x anteriores a 7.1.8.5, una vulnerabilidad de ruta de búsqueda no confiable en BIG-IP APM Client Troubleshooting Utility (CTU) para Windows, podría permitir a un atacante cargar una biblioteca DLL maliciosa desde su directorio actual. Es requerida una interacción del usuario para explotar esta vulnerabilidad, ya que la víctima debe ejecutar esta utilidad en el sistema Windows. • https://support.f5.com/csp/article/K29282483 • CWE-426: Untrusted Search Path •
CVSS: 5.8EPSS: 0%CPEs: 28EXPL: 0CVE-2021-22981
https://notcve.org/view.php?id=CVE-2021-22981
On all versions of BIG-IP 12.1.x and 11.6.x, the original TLS protocol includes a weakness in the master secret negotiation that is mitigated by the Extended Master Secret (EMS) extension defined in RFC 7627. TLS connections that do not use EMS are vulnerable to man-in-the-middle attacks during renegotiation. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. En todas las versiones de BIG-IP 12.1.x y 11.6.x, el protocolo TLS original incluye una debilidad en la negociación del secreto maestro que es mitigada por la extensión Extended Master Secret (EMS) definida en RFC 7627. Las conexiones TLS que no utilizan EMS son vulnerables a ataques man-in-the-middle durante la renegociación. • https://support.f5.com/csp/article/K09121542 •
CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 0CVE-2021-22985
https://notcve.org/view.php?id=CVE-2021-22985
On BIG-IP APM version 16.0.x before 16.0.1.1, under certain conditions, when processing VPN traffic with APM, TMM consumes excessive memory. A malicious, authenticated VPN user may abuse this to perform a DoS attack against the APM. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. En BIG-IP APM versiones 16.0.x anteriores a 16.0.1.1, bajo determinadas condiciones, al procesar tráfico VPN con APM, TMM consume memoria excesiva. Un usuario de VPN autenticado y malicioso puede abusar de esto para llevar a cabo un ataque de DoS contra APM. • https://support.f5.com/csp/article/K88162221 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.2EPSS: 0%CPEs: 3EXPL: 0CVE-2021-22982
https://notcve.org/view.php?id=CVE-2021-22982
On BIG-IP DNS and GTM version 13.1.x before 13.1.0.4, and all versions of 12.1.x and 11.6.x, big3d does not securely handle and parse certain payloads resulting in a buffer overflow. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. En BIG-IP DNS y GTM versiones 13.1.x anteriores a 13.1.0.4, y en todas las versiones de 12.1.x y 11.6.x, big3d no maneja ni analiza de forma segura determinadas cargas útiles, resultando en un desbordamiento del búfer. Nota: No son evaluadas las versiones de software que han alcanzado End of Software Development (EoSD) • https://support.f5.com/csp/article/K72708443 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 7.5EPSS: 0%CPEs: 10EXPL: 0CVE-2021-22976
https://notcve.org/view.php?id=CVE-2021-22976
On BIG-IP Advanced WAF and ASM version 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.6, and all 12.1.x versions, when the BIG-IP ASM system processes WebSocket requests with JSON payloads, an unusually large number of parameters can cause excessive CPU usage in the BIG-IP ASM bd process. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. En BIG-IP Advanced WAF y ASM versiones 16.0.x anteriores a 16.0.1.1, versiones 15.1.x anteriores 15.1.2, versiones 14.1.x anteriores a 14.1.3.1, versiones 13.1.x anteriores a 13.1.3.6, y todas las versiones 12.1.x, cuando el sistema BIG-IP ASM procesa las peticiones de WebSocket con cargas útiles JSON, una cantidad inusualmente grande de parámetros puede causar un uso excesivo de la CPU en el proceso bd de BIG-IP ASM. Nota: No son evaluadas las versiones de software que han alcanzado End of Software Development (EoSD) • https://support.f5.com/csp/article/K88230177 •