CVSS: 7.8EPSS: 0%CPEs: 78EXPL: 0CVE-2019-6685
https://notcve.org/view.php?id=CVE-2019-6685
On BIG-IP versions 15.0.0-15.0.1.1, 14.1.0-14.1.2.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, users with access to edit iRules are able to create iRules which can lead to an elevation of privilege, configuration modification, and arbitrary system command execution. En BIG-IP versiones 15.0.0 hasta 15.0.1.1, 14.1.0 hasta 14.1.2.2, 14.0.0 hasta 14.0.1, 13.1.0 hasta 13.1.3.1, 12.1.0 hasta 12.1.5 y 11.5.2 hasta 11.6.5.1, los usuarios con acceso para editar iRules son capaces de crear iRules lo que puede conllevar a una elevación de privilegios, modificación de la configuración y una ejecución arbitraria de comandos del sistema. • https://support.f5.com/csp/article/K30215839 • CWE-269: Improper Privilege Management •
CVSS: 7.5EPSS: 0%CPEs: 78EXPL: 0CVE-2019-6683
https://notcve.org/view.php?id=CVE-2019-6683
On versions 15.0.0-15.0.1.1, 14.1.0-14.1.2.2, 14.0.0-14.0.1, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, BIG-IP virtual servers with Loose Initiation enabled on a FastL4 profile may be subject to excessive flow usage under undisclosed conditions. En las versiones 15.0.0 hasta 15.0.1.1, 14.1.0 hasta 14.1.2.2, 14.0.0 hasta 14.0.1, 13.1.0 hasta 13.1.3.2, 12.1.0 hasta 12.1.5 y 11.5.2 hasta 11.6.5.1 , los servidores virtuales BIG-IP con Loose Initiation habilitado sobre un perfil FastL4 pueden estar sujetos a un uso de flujo excesivo bajo condiciones no reveladas. • https://support.f5.com/csp/article/K76328112 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 9.1EPSS: 2%CPEs: 81EXPL: 2CVE-2019-10744 – nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties
https://notcve.org/view.php?id=CVE-2019-10744
Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload. Las versiones de lodash inferiores a 4.17.12, son vulnerables a la Contaminación de Prototipo. La función defaultsDeep podría ser engañada para agregar o modificar las propiedades de Object.prototype usando una carga útil de constructor. A Prototype Pollution vulnerability was found in lodash. • https://github.com/ossf-cve-benchmark/CVE-2019-10744 https://access.redhat.com/errata/RHSA-2019:3024 https://security.netapp.com/advisory/ntap-20191004-0005 https://snyk.io/vuln/SNYK-JS-LODASH-450202 https://support.f5.com/csp/article/K47105354?utm_source=f5support&%3Butm_medium=RSS https://www.oracle.com/security-alerts/cpujan2021.html https://www.oracle.com/security-alerts/cpuoct2020.html https://access.redhat.com/security/cve/CVE-2019-10744 https://bugzilla.redhat.com/show_ • CWE-20: Improper Input Validation CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') •
CVSS: 7.5EPSS: 0%CPEs: 84EXPL: 0CVE-2019-12295
https://notcve.org/view.php?id=CVE-2019-12295
In Wireshark 3.0.0 to 3.0.1, 2.6.0 to 2.6.8, and 2.4.0 to 2.4.14, the dissection engine could crash. This was addressed in epan/packet.c by restricting the number of layers and consequently limiting recursion. En Wireshark versión 3.0.0 a 3.0.1, versión 2.6.0 a 2.6.8 y versión 2.4.0 a 2.4.14, el motor de disección podría fallar. Esto fue direccionado en epan/packet.c por la restricción del número de capas y por consiguiente limitando la recursión. • http://www.securityfocus.com/bid/108464 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15778 https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=7b6e197da4c497e229ed3ebf6952bae5c426a820 https://lists.debian.org/debian-lts-announce/2020/10/msg00036.html https://support.f5.com/csp/article/K06725231 https://support.f5.com/csp/article/K06725231?utm_source=f5support&%3Butm_medium=RSS https://usn.ubuntu.com/4133-1 https://www.wireshark.org/security/wnpa-sec-2019-19.html • CWE-674: Uncontrolled Recursion •
CVSS: 5.9EPSS: 1%CPEs: 180EXPL: 0CVE-2019-1559 – 0-byte record padding oracle
https://notcve.org/view.php?id=CVE-2019-1559
If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable "non-stitched" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). • http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00041.html http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00019.html http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00046.html http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00047.html http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00049.html http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00080.html http://www.securityfocus.com/bid/107174 https://access. • CWE-203: Observable Discrepancy CWE-325: Missing Cryptographic Step •