CVSS: 4.3EPSS: 0%CPEs: 66EXPL: 0CVE-2019-6598
https://notcve.org/view.php?id=CVE-2019-6598
In BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.0.7, 12.1.0-12.1.3.5, 11.6.1-11.6.3.2, or 11.5.1-11.5.8 or Enterprise Manager 3.1.1, malformed requests to the Traffic Management User Interface (TMUI), also referred to as the BIG-IP Configuration utility, may lead to disruption of TMUI services. This attack requires an authenticated user with any role (other than the No Access role). The No Access user role cannot login and does not have the access level to perform the attack. En BIG-IP, 14.0.0-14.0.0.2, 13.0.0-13.1.0.7, 12.1.0-12.1.3.5, 11.6.1-11.6.3.2, o 11.5.1-11.5.8 o Enterprise Manager 3.1.1, las peticiones mal formadas al TMUI (Traffic Management User Interface), también llamado utilidad BIG-IP Configuration, podría conducir a la interrupción de los servicios TMUI. Este ataque requiere un usuario autenticado con cualquier rol (aparte del rol "No Access"). • https://support.f5.com/csp/article/K44603900 •
CVSS: 5.9EPSS: 0%CPEs: 39EXPL: 0CVE-2019-6593
https://notcve.org/view.php?id=CVE-2019-6593
On BIG-IP 11.5.1-11.5.4, 11.6.1, and 12.1.0, a virtual server configured with a Client SSL profile may be vulnerable to a chosen ciphertext attack against CBC ciphers. When exploited, this may result in plaintext recovery of encrypted messages through a man-in-the-middle (MITM) attack, despite the attacker not having gained access to the server's private key itself. (CVE-2019-6593 also known as Zombie POODLE and GOLDENDOODLE.) En BIG-IP 11.5.1-11.5.4, 11.6.1 y 12.1.0, un servidor virtual que está configurado con un perfil SSL del cliente podría ser vulnerable a un ataque de texto cifrado escogido contra cifrados CBC. Su explotación puede conducir a la recuperación en texto plano de mensajes cifrados mediante un ataque Man-in-the-Middle (MitM), a pesar de que el atacante no haya obtenido acceso a la clave privada del servidor. • https://support.f5.com/csp/article/K10065173 • CWE-327: Use of a Broken or Risky Cryptographic Algorithm •
CVSS: 5.9EPSS: 0%CPEs: 91EXPL: 0CVE-2019-6594
https://notcve.org/view.php?id=CVE-2019-6594
On BIG-IP 11.5.1-11.6.3.2, 12.1.3.4-12.1.3.7, 13.0.0 HF1-13.1.1.1, and 14.0.0-14.0.0.2, Multi-Path TCP (MPTCP) does not protect against multiple zero length DATA_FINs in the reassembly queue, which can lead to an infinite loop in some circumstances. BIG-IP, en sus versiones 11.5.1-11.6.3.2, 12.1.3.4-12.1.3.7, 13.0.0 HF1-13.1.1.1 y 14.0.0-14.0.0.2, Multi-Path TCP (MPTCP), no protege contra manera correcta contra múltiples DATA_FIN de longitud cero en la cola de reensamblado, lo que podría conducir a un bucle infinito en algunas circunstancias. • https://support.f5.com/csp/article/K91026261 • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2019-6595
https://notcve.org/view.php?id=CVE-2019-6595
Cross-site scripting (XSS) vulnerability in F5 BIG-IP Access Policy Manager (APM) 11.5.x and 11.6.x Admin Web UI. Hay una vulnerabilidad de Cross-Site Scripting (XSS) en F5 BIG-IP Access Policy Manager en las versiones 11.5.x y 11.6.x Admin Web UI. • http://www.securityfocus.com/bid/107173 https://support.f5.com/csp/article/K31424926 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0CVE-2018-15334
https://notcve.org/view.php?id=CVE-2018-15334
A cross-site request forgery (CSRF) vulnerability in the APM webtop 11.2.1 or greater may allow attacker to force an APM webtop session to log out and require re-authentication. Una vulnerabilidad Cross-Site Request Forgery (CSRF) en APM webtop, en versiones 11.2.1 o posteriores, podría permitir que un atacante fuerce una sesión de APM webtop a que cierre la sesión y requiera reautenticarse. • http://www.securityfocus.com/bid/106364 https://support.f5.com/csp/article/K74114570 • CWE-352: Cross-Site Request Forgery (CSRF) •