CVSS: 4.4EPSS: 0%CPEs: 39EXPL: 0CVE-2018-5520
https://notcve.org/view.php?id=CVE-2018-5520
On an F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.3.1, or 11.2.1-11.6.3.1 system configured in Appliance mode, the TMOS Shell (tmsh) may allow an administrative user to use the dig utility to gain unauthorized access to file system resources. En un sistema F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.3.1 o 11.2.1-11.6.3.1 configurado en modo Appliance, TMOS Shell (tmsh) podría permitir que un usuario administrativo emplee la utilidad dig para obtener acceso no autorizado a los recursos del sistema de archivos. • http://www.securitytracker.com/id/1040798 https://support.f5.com/csp/article/K02043709 • CWE-863: Incorrect Authorization •
CVSS: 7.8EPSS: 0%CPEs: 13EXPL: 0CVE-2018-5512
https://notcve.org/view.php?id=CVE-2018-5512
On F5 BIG-IP 13.1.0-13.1.0.5, when Large Receive Offload (LRO) and SYN cookies are enabled (default settings), undisclosed traffic patterns may cause TMM to restart. En F5 BIG-IP 13.1.0-13.1.0.5, cuando las cookies Large Receive Offload (LRO) y SYN están habilitadas (configuración por defecto), los patrones de tráfico no revelados pueden hacer que TMM se reinicie. • http://www.securityfocus.com/bid/104095 http://www.securitytracker.com/id/1040801 https://support.f5.com/csp/article/K51754851 •
CVSS: 7.5EPSS: 0%CPEs: 13EXPL: 0CVE-2018-5514
https://notcve.org/view.php?id=CVE-2018-5514
On F5 BIG-IP 13.1.0-13.1.0.5, maliciously crafted HTTP/2 request frames can lead to denial of service. There is data plane exposure for virtual servers when the HTTP2 profile is enabled. There is no control plane exposure to this issue. En F5 BIG-IP 13.1.0-13.1.0.5, los frames de petición HTTP/2 maliciosamente manipulados pueden conducir a una denegación de servicio (DoS). Hay una exposición del plano de datos para los servidores virtuales cuando el perfil HTTP2 está habilitado. • http://www.securityfocus.com/bid/104097 http://www.securitytracker.com/id/1040804 https://support.f5.com/csp/article/K45320419 • CWE-20: Improper Input Validation •
CVSS: 7.2EPSS: 3%CPEs: 30EXPL: 1CVE-2018-5511 – VMware Workstation 14.1.5 / VMware Player 15.0.2 - Host VMX Process Impersonation Hijack Privilege Escalation
https://notcve.org/view.php?id=CVE-2018-5511
On F5 BIG-IP 13.1.0-13.1.0.3 or 13.0.0, when authenticated administrative users execute commands in the Traffic Management User Interface (TMUI), also referred to as the BIG-IP Configuration utility, restrictions on allowed commands may not be enforced. En F5 BIG-IP, de la versión 13.1.0 a la 13.1.0.3 o en la versión 13.0.0, cuando los usuarios administrativos autenticados ejecutan comandos en el TMUI (Traffic Management User Interface), también llamado utilidad BIG-IP Configuration, podrían no aplicarse las restricciones sobre los comandos permitidos. The VMX process (vmware-vmx.exe) process configures and hosts an instance of VM. As is common with desktop virtualization platforms the VM host usually has privileged access into the OS such as mapping physical memory which represents a security risk. To mitigate this the VMX process is created with an elevated integrity level by the authentication daemon (vmware-authd.exe) which runs at SYSTEM. • https://www.exploit-db.com/exploits/46600 http://packetstormsecurity.com/files/152213/VMware-Host-VMX-Process-Impersonation-Hijack-Privilege-Escalation.html https://support.f5.com/csp/article/K30500703 • CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') •
CVSS: 7.5EPSS: 0%CPEs: 13EXPL: 0CVE-2018-5502
https://notcve.org/view.php?id=CVE-2018-5502
On F5 BIG-IP versions 13.0.0 - 13.1.0.3, attackers may be able to disrupt services on the BIG-IP system with maliciously crafted client certificate. This vulnerability affects virtual servers associated with Client SSL profile which enables the use of client certificate authentication. Client certificate authentication is not enabled by default in Client SSL profile. There is no control plane exposure. Desde la versión 13.0.0 hasta la 13.1.0.3 de F5 BIG-IP, los atacantes podrían ser capaces de interrumpir servicios en el sistema BIG-IP con un certificado de cliente maliciosamente manipulado. • http://www.securitytracker.com/id/1040561 https://support.f5.com/csp/article/K43121447 • CWE-295: Improper Certificate Validation •