CVSS: 7.2EPSS: 0%CPEs: 40EXPL: 0CVE-2018-15329
https://notcve.org/view.php?id=CVE-2018-15329
20 Dec 2018 — On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.1, or 12.1.0-12.1.3.7, or Enterprise Manager 3.1.1, when authenticated administrative users run commands in the Traffic Management User Interface (TMUI), also referred to as the BIG-IP Configuration utility, restrictions on allowed commands may not be enforced. En BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.1, o 12.1.0-12.1.3.7; o Enterprise Manager 3.1.1, cuando los usuarios administrativos autenticados ejecutan comandos en el TMUI (Traffic Management User Interface), tam... • https://support.f5.com/csp/article/K61620494 • CWE-862: Missing Authorization •
CVSS: 7.8EPSS: 0%CPEs: 39EXPL: 0CVE-2018-15330
https://notcve.org/view.php?id=CVE-2018-15330
20 Dec 2018 — On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.1, or 12.1.0-12.1.3.7, when a virtual server using the inflate functionality to process a gzip bomb as a payload, the BIG-IP system will experience a fatal error and may cause the Traffic Management Microkernel (TMM) to produce a core file. En BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.1, o 12.1.0-12.1.3.7, cuando un servidor virtual que emplea la funcionalidad "inflate" procesa una bomba gzip como carga útil, el sistema BIG-IP experimentará un error fatal y podría provoc... • https://support.f5.com/csp/article/K23328310 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 57EXPL: 0CVE-2018-15328
https://notcve.org/view.php?id=CVE-2018-15328
12 Dec 2018 — On BIG-IP 14.0.x, 13.x, 12.x, and 11.x, Enterprise Manager 3.1.1, BIG-IQ 6.x, 5.x, and 4.x, and iWorkflow 2.x, the passphrases for SNMPv3 users and trap destinations that are used for authentication and privacy are not handled by the BIG-IP system Secure Vault feature; they are written in the clear to the various configuration files. En BIG-IP 14.0.x, 13.x, 12.x y 11.x, Enterprise Manager 3.1.1, BIG-IQ 6.x, 5.x y 4.x, e iWorkflow 2.x, las frases de contraseña para los usuarios SNMPv3 y destinos de captura q... • http://www.securityfocus.com/bid/106258 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 1CVE-2018-20002 – Ubuntu Security Notice USN-4336-2
https://notcve.org/view.php?id=CVE-2018-20002
10 Dec 2018 — The _bfd_generic_read_minisymbols function in syms.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31, has a memory leak via a crafted ELF file, leading to a denial of service (memory consumption), as demonstrated by nm. La función _bfd_generic_read_minisymbols en syms.c en la biblioteca Binary File Descriptor (BFD), también conocida como libbfd, tal y como se distribuye en GNU Binutils 2.31, tiene una fuga de memoria mediante un archivo ELF manipulado, que condu... • http://www.securityfocus.com/bid/106142 • CWE-772: Missing Release of Resource after Effective Lifetime •
CVSS: 7.0EPSS: 0%CPEs: 7EXPL: 0CVE-2018-15332
https://notcve.org/view.php?id=CVE-2018-15332
06 Dec 2018 — The svpn component of the F5 BIG-IP APM client prior to version 7.1.7.2 for Linux and macOS runs as a privileged process and can allow an unprivileged user to get ownership of files owned by root on the local client host in a race condition. El componente svpn del cliente F5 BIG-IP APM en versiones anteriores a la 7.1.7.2 para Linux y macOS se ejecuta como proceso privilegiado y puede permitir que un usuario sin privilegios obtenga archivos propiedad de root en el host del cliente local en una condición de ... • http://www.securityfocus.com/bid/106135 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 7.8EPSS: 3%CPEs: 9EXPL: 1CVE-2018-16843 – nginx: Excessive memory consumption via flaw in HTTP/2 implementation
https://notcve.org/view.php?id=CVE-2018-16843
07 Nov 2018 — nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessive memory consumption. This issue affects nginx compiled with the ngx_http_v2_module (not compiled by default) if the 'http2' option of the 'listen' directive is used in a configuration file. nginx en versiones anteriores a la 1.15.6 y 1.14.1 tiene una vulnerabilidad en la implementación de HTTP/2 que puede permitir el consumo excesivo de memoria. Este problema afecta a nginx compilado con n... • https://github.com/flyniu666/ingress-nginx-0.21-1.19.5 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.8EPSS: 1%CPEs: 8EXPL: 0CVE-2018-16844 – nginx: Excessive CPU usage via flaw in HTTP/2 implementation
https://notcve.org/view.php?id=CVE-2018-16844
07 Nov 2018 — nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessive CPU usage. This issue affects nginx compiled with the ngx_http_v2_module (not compiled by default) if the 'http2' option of the 'listen' directive is used in a configuration file. nginx en versiones anteriores a la 1.15.6 y 1.14.1 tiene una vulnerabilidad en la implementación de HTTP/2 que puede permitir el uso excesivo de CPU. Este problema afecta a nginx compilado con ngx_http_v2_module... • http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00035.html • CWE-400: Uncontrolled Resource Consumption •
CVSS: 8.2EPSS: 0%CPEs: 10EXPL: 0CVE-2018-16845 – nginx: Denial of service and memory disclosure via mp4 module
https://notcve.org/view.php?id=CVE-2018-16845
07 Nov 2018 — nginx before versions 1.15.6, 1.14.1 has a vulnerability in the ngx_http_mp4_module, which might allow an attacker to cause infinite loop in a worker process, cause a worker process crash, or might result in worker process memory disclosure by using a specially crafted mp4 file. The issue only affects nginx if it is built with the ngx_http_mp4_module (the module is not built by default) and the .mp4. directive is used in the configuration file. Further, the attack is only possible if an attacker is able to ... • http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00035.html • CWE-201: Insertion of Sensitive Information Into Sent Data CWE-400: Uncontrolled Resource Consumption CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 5.9EPSS: 0%CPEs: 26EXPL: 0CVE-2018-15323
https://notcve.org/view.php?id=CVE-2018-15323
31 Oct 2018 — On BIG-IP 14.0.0-14.0.0.2 or 13.0.0-13.1.1.1, in certain circumstances, when processing traffic through a Virtual Server with an associated MQTT profile, the TMM process may produce a core file and take the configured HA action. En BIG-IP 14.0.0-14.0.0.2 o 13.0.0-13.1.1.1, en ciertas circunstancias, al procesar tráfico mediante un servidor virtual con un perfil MQTT asociado, el proceso TMM podría producir un archivo core y tomar la acción HA configurada. • https://support.f5.com/csp/article/K26583415 • CWE-20: Improper Input Validation •
CVSS: 7.8EPSS: 0%CPEs: 39EXPL: 0CVE-2018-15318
https://notcve.org/view.php?id=CVE-2018-15318
31 Oct 2018 — In BIG-IP 14.0.0-14.0.0.2, 13.1.0.4-13.1.1.1, or 12.1.3.4-12.1.3.6, If an MPTCP connection receives an abort signal while the initial flow is not the primary flow, the initial flow will remain after the closing procedure is complete. TMM may restart and produce a core file as a result of this condition. En BIG-IP 14.0.0-14.0.0.2, 13.1.0.4-13.1.1.1 o 12.1.3.4-12.1.3.6, si una conexión MPTCP recibe una señal de aborto mientras el flujo inicial no es el primario, el flujo inicial se mantendrá una vez se comple... • https://support.f5.com/csp/article/K16248201 • CWE-20: Improper Input Validation •