CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2018-15326
https://notcve.org/view.php?id=CVE-2018-15326
In some situations on BIG-IP APM 14.0.0-14.0.0.2, 13.0.0-13.1.0.7, 12.1.0-12.1.3.5, or 11.6.0-11.6.3.2, the CRLDP Auth access policy agent may treat revoked certificates as valid when the BIG-IP APM system fails to download a new Certificate Revocation List. En algunas situaciones, en BIG-IP APM 14.0.0-14.0.0.2, 13.0.0-13.1.0.7, 12.1.0-12.1.3.5 o 11.6.0-11.6.3.2, el agente de la política de acceso CRLDP Auth podría tratar los certificados revocados como válidos cuando el sistema BIG-IP APM no descarga una nueva lista Certificate Revocation. • http://www.securityfocus.com/bid/106180 https://support.f5.com/csp/article/K34652116 • CWE-295: Improper Certificate Validation •
CVSS: 6.1EPSS: 0%CPEs: 26EXPL: 0CVE-2018-15312
https://notcve.org/view.php?id=CVE-2018-15312
On F5 BIG-IP 13.0.0-13.1.1.1 and 12.1.0-12.1.3.6, a reflected Cross-Site Scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an authenticated user to execute JavaScript for the currently logged-in user. En F5 BIG-IP 13.0.0-13.1.1.1 y 12.1.0-12.1.3.6, existe una vulnerabilidad Cross-Site Scripting (XSS) reflejado en una página sin revelar de la utilidad de configuración de BIG-IP que permite que un usuario sin configurar ejecute JavaScript para el usuario autenticado actual. • http://www.securitytracker.com/id/1041932 https://support.f5.com/csp/article/K44462254 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2018-15316
https://notcve.org/view.php?id=CVE-2018-15316
In F5 BIG-IP APM 13.0.0-13.1.1.1, APM Client 7.1.5-7.1.6, and/or Edge Client 7101-7160, the BIG-IP APM Edge Client component loads the policy library with user permission and bypassing the endpoint checks. En F5 BIG-IP APM 13.0.0-13.1.1.1, APM Client 7.1.5-7.1.6, y/o Edge Client 7101-7160, el componente BIG-IP APM Edge Client carga la biblioteca de políticas con permisos de usuario y omitiendo las comprobaciones de endpoint. • http://www.securityfocus.com/bid/105731 http://www.securitytracker.com/id/1041936 https://support.f5.com/csp/article/K51220077 •
CVSS: 6.1EPSS: 0%CPEs: 26EXPL: 0CVE-2018-15315
https://notcve.org/view.php?id=CVE-2018-15315
On F5 BIG-IP 13.0.0-13.1.1.1 and 12.1.0-12.1.3.6, there is a reflected Cross Site Scripting (XSS) vulnerability in an undisclosed Configuration Utility page. En F5 BIG-IP 13.0.0-13.1.1.1 y 12.1.0-12.1.3.6, hay una vulnerabilidad Cross-Site Scripting (XSS) reflejado en una página Configuration Utility sin revelar. • http://www.securitytracker.com/id/1041935 https://support.f5.com/csp/article/K41704442 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.8EPSS: 1%CPEs: 152EXPL: 0CVE-2018-5391 – The Linux kernel, versions 3.9+, IP implementation is vulnerable to denial of service conditions with low rates of specially modified packets
https://notcve.org/view.php?id=CVE-2018-5391
The Linux kernel, versions 3.9+, is vulnerable to a denial of service attack with low rates of specially modified packets targeting IP fragment re-assembly. An attacker may cause a denial of service condition by sending specially crafted IP fragments. Various vulnerabilities in IP fragmentation have been discovered and fixed over the years. The current vulnerability (CVE-2018-5391) became exploitable in the Linux kernel with the increase of the IP fragment reassembly queue size. El kernel de Linux en versiones a partir de la 3.9 es vulnerable a un ataque de denegación de servicio (DoS) con tasas bajas de paquetes especialmente modificados que apuntan hacia el reensamblado de fragmentos de IP. • http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-004.txt http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200115-01-linux-en http://www.openwall.com/lists/oss-security/2019/06/28/2 http://www.openwall.com/lists/oss-security/2019/07/06/3 http://www.openwall.com/lists/oss-security/2019/07/06/4 http://www.securityfocus.com/bid/105108 http://www.securitytracker.com/id/1041476 http://www.securitytracker.com/id/1041637 https://access.redhat.co • CWE-20: Improper Input Validation CWE-400: Uncontrolled Resource Consumption •