CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-21849 – BIG-IP Websockets vulnerability
https://notcve.org/view.php?id=CVE-2024-21849
14 Feb 2024 — When an Advanced WAF/ASM security policy and a Websockets profile are configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Cuando se configura una política de seguridad WAF/ASM avanzada y un perfil Websockets en un servidor virtual, el tráfico no divulgado puede hacer que finalice el proceso de Microkernel de gestión de tráfico (TMM). Nota: Las... • https://my.f5.com/manage/s/article/K000135873 • CWE-466: Return of Pointer Value Outside of Expected Range •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2024-21771 – F5 AFM Signature Matching Vulnerability
https://notcve.org/view.php?id=CVE-2024-21771
14 Feb 2024 — For unspecified traffic patterns, BIG-IP AFM IPS engine may spend an excessive amount of time matching the traffic against signatures, resulting in Traffic Management Microkernel (TMM) restarting and traffic disruption. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated Para patrones de tráfico no especificados, el motor BIG-IP AFM IPS puede dedicar una cantidad excesiva de tiempo a comparar el tráfico con las firmas, lo que provoca el reinicio del microkernel de ge... • https://my.f5.com/manage/s/article/K000137595 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 6.7EPSS: 0%CPEs: 4EXPL: 0CVE-2024-21782 – BIG-IP and BIG-IQ secure copy vulnerability
https://notcve.org/view.php?id=CVE-2024-21782
14 Feb 2024 — BIG-IP or BIG-IQ Resource Administrators and Certificate Managers who have access to the secure copy (scp) utility but do not have access to Advanced shell (bash) can execute arbitrary commands with a specially crafted command string. This vulnerability is due to an incomplete fix for CVE-2020-5873. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated Los administradores de recursos y administradores de certificados de BIG-IP o BIG-IQ que tienen acceso a la utilidad d... • https://my.f5.com/manage/s/article/K98606833 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 6.0EPSS: 0%CPEs: 3EXPL: 0CVE-2024-23976 – BIG-IP Appliance mode iAppsLX vulnerability
https://notcve.org/view.php?id=CVE-2024-23976
14 Feb 2024 — When running in Appliance mode, an authenticated attacker assigned the Administrator role may be able to bypass Appliance mode restrictions utilizing iAppsLX templates on a BIG-IP system. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated Cuando se ejecuta en modo Dispositivo, un atacante autenticado al que se le haya asignado la función de Administrador puede eludir las restricciones del modo Dispositivo utilizando plantillas iAppsLX en un sistema BIG-IP. Nota: Las... • https://my.f5.com/manage/s/article/K91054692 • CWE-266: Incorrect Privilege Assignment •
CVSS: 8.3EPSS: 0%CPEs: 3EXPL: 0CVE-2024-22389 – BIG-IP iControl REST API Vulnerability
https://notcve.org/view.php?id=CVE-2024-22389
14 Feb 2024 — When BIG-IP is deployed in high availability (HA) and an iControl REST API token is updated, the change does not sync to the peer device. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated Cuando BIG-IP se implementa en alta disponibilidad (HA) y se actualiza un token de API REST de iControl, el cambio no se sincroniza con el dispositivo par. Nota: Las versiones de software que han llegado al final del soporte técnico (EoTS) no se evalúan • https://my.f5.com/manage/s/article/K32544615 • CWE-613: Insufficient Session Expiration •
CVSS: 6.8EPSS: 0%CPEs: 42EXPL: 0CVE-2023-5388 – nss: timing attack against RSA decryption
https://notcve.org/view.php?id=CVE-2023-5388
10 Jan 2024 — NSS was susceptible to a timing side-channel attack when performing RSA decryption. This attack could potentially allow an attacker to recover the private data. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9. NSS era susceptible a un ataque de canal lateral de sincronización al realizar el descifrado RSA. Este ataque podría permitir potencialmente que un atacante recupere los datos privados. • https://bugzilla.mozilla.org/show_bug.cgi?id=1780432 • CWE-208: Observable Timing Discrepancy •
CVSS: 7.8EPSS: 0%CPEs: 14EXPL: 1CVE-2023-45886
https://notcve.org/view.php?id=CVE-2023-45886
21 Nov 2023 — The BGP daemon (bgpd) in IP Infusion ZebOS through 7.10.6 allow remote attackers to cause a denial of service by sending crafted BGP update messages containing a malformed attribute. BGP daemon (bgpd) en IP Infusion ZebOS hasta 7.10.6 permite a atacantes remotos provocar una Denegación de Servicio enviando mensajes de actualización de BGP manipulados que contienen un atributo con formato incorrecto. • https://blog.benjojo.co.uk/post/bgp-path-attributes-grave-error-handling •
CVSS: 9.0EPSS: 1%CPEs: 100EXPL: 1CVE-2023-46748 – F5 BIG-IP Configuration Utility SQL Injection Vulnerability
https://notcve.org/view.php?id=CVE-2023-46748
26 Oct 2023 — An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an authenticated attacker with network access to the Configuration utility through the BIG-IP management port and/or self IP addresses to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated Existe una vulnerabilidad de inyección SQL autenticada en la utilidad de configuración BIG-IP que puede permitir que un atacante autenticado c... • https://my.f5.com/manage/s/article/K000137365 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 10.0EPSS: 97%CPEs: 100EXPL: 12CVE-2023-46747 – F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2023-46747
26 Oct 2023 — Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated Las solicitudes no divulgadas pueden omitir la autenticación de la utilidad de configuración, lo que permite a un atacante con acceso de red al sistema BIG-IP a través del puerto de administración... • https://packetstorm.news/files/id/177444 • CWE-288: Authentication Bypass Using an Alternate Path or Channel CWE-306: Missing Authentication for Critical Function •
CVSS: 7.4EPSS: 0%CPEs: 1EXPL: 0CVE-2023-45226 – BIG-IP Next SPK SSH vulnerability
https://notcve.org/view.php?id=CVE-2023-45226
10 Oct 2023 — The BIG-IP SPK TMM (Traffic Management Module) f5-debug-sidecar and f5-debug-sshd containers contains hardcoded credentials that may allow an attacker with the ability to intercept traffic to impersonate the SPK Secure Shell (SSH) server on those containers. This is only exposed when ssh debug is enabled. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated Los contenedores BIG-IP SPK TMM (Módulo de gestión de tráfico) f5-debug-sidecar y f5-debug-sshd contienen creden... • https://my.f5.com/manage/s/article/K000135874 • CWE-798: Use of Hard-coded Credentials •