CVSS: 5.3EPSS: 0%CPEs: 109EXPL: 0CVE-2017-6161
https://notcve.org/view.php?id=CVE-2017-6161
In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, WebAccelerator software version 12.0.0 - 12.1.2, 11.6.0 - 11.6.1, 11.4.0 - 11.5.4, 11.2.1, when ConfigSync is configured, attackers on adjacent networks may be able to bypass the TLS protections usually used to encrypted and authenticate connections to mcpd. This vulnerability may allow remote attackers to cause a denial-of-service (DoS) attack via resource exhaustion. En F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, WebAccelerator en versiones de software de la 12.0.0 a la 12.1.2, de la 11.6.0 a la 11.6.1, de la 11.4.0 a la 11.5.4 y en la versión 11.2.1, cuando ConfigSync está configurado, los atacantes en redes adyacentes pueden omitir las protecciones TLS, normalmente utilizadas para cifrar y autenticar conexiones al mcpd. Esta vulnerabilidad podría permitir que atacantes remotos provoquen un ataque de denegación de servicio (DoS) mediante el agotamiento de recursos. • http://www.securityfocus.com/bid/101636 http://www.securitytracker.com/id/1039675 http://www.securitytracker.com/id/1039676 https://support.f5.com/csp/article/K62279530 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 5.9EPSS: 0%CPEs: 50EXPL: 0CVE-2017-6162
https://notcve.org/view.php?id=CVE-2017-6162
In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, Websafe software version 12.0.0 to 12.1.2, 11.6.0 to 11.6.1, 11.4.0 to 11.5.4, 11.2.1, in some cases TMM may crash when processing TCP traffic. This vulnerability affects TMM via a virtual server configured with TCP profile. Traffic processing is disrupted while Traffic Management Microkernel (TMM) restarts. If the affected BIG-IP system is configured to be part of a device group, it will trigger a failover to the peer device. En F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, Websafe en versiones de software de la 12.0.0 a la 12.1.2, de la 11.6.0 a la 11.6.1, de la 11.4.0 a la 11.5.4 y en la versión 11.2.1, en algunos casos, TMM podría cerrarse de manera inesperada cuando procesa tráfico TCP. • http://www.securityfocus.com/bid/101635 http://www.securitytracker.com/id/1039673 https://support.f5.com/csp/article/K13421245 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.4EPSS: 0%CPEs: 136EXPL: 0CVE-2016-7469
https://notcve.org/view.php?id=CVE-2016-7469
A stored cross-site scripting (XSS) vulnerability in the Configuration utility device name change page in BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, PSM, WebAccelerator, WOM and WebSafe version 12.0.0 - 12.1.2, 11.4.0 - 11.6.1, and 11.2.1 allows an authenticated user to inject arbitrary web script or HTML. Exploitation requires Resource Administrator or Administrator privileges, and it could cause the Configuration utility client to become unstable. Una vulnerabilidad de tipo cross-site scripting (XSS) almacenada en la página de cambio de nombre del dispositivo de la utilidad Configuration en BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, PSM, WebAccelerator, WOM y WebSafe versión 12.0.0 hasta 12.1.2, versión 11.4.0 hasta 11.6.1, y versión 11.2.1, permite a un usuario autenticado inyectar un script web o HTML arbitrario. La explotación requiere administrador de recursos o permisos de administrador, y podría causar que el cliente de la utilidad Configuration se vuelva inestable. • http://www.securityfocus.com/bid/95320 http://www.securitytracker.com/id/1037559 http://www.securitytracker.com/id/1037560 https://support.f5.com/csp/article/K97285349 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.9EPSS: 0%CPEs: 176EXPL: 0CVE-2014-6031
https://notcve.org/view.php?id=CVE-2014-6031
Buffer overflow in the mcpq daemon in F5 BIG-IP systems 10.x before 10.2.4 HF12, 11.x before 11.2.1 HF15, 11.3.x, 11.4.x before 11.4.1 HF9, 11.5.x before 11.5.2 HF1, and 11.6.0 before HF4, and Enterprise Manager 2.1.0 through 2.3.0 and 3.x before 3.1.1 HF5 allows remote authenticated administrators to cause a denial of service via unspecified vectors. Desbordamiento de buffer en el demonio mcpq en sistemas F5 BIG-IP, versiones 10.x anteriores a la 10.2.4 HF12, 11.x anteriores a la 11.2.1 HF15, 11.3.x, 11.4.x anteriores a la 11.4.1 HF9, 11.5.x anteriores a la 11.5.2 HF1 y 11.6.0 anteriores a la HF4 y Enterprise Manager, versiones de la 2.1.0 a la 2.3.0 y 3.x anteriores a la 3.1.1 HF5, que permitiría a administradores autenticados causar una denegación de servicio a través de vectores no especificados. • https://support.f5.com/csp/article/K16196 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 0%CPEs: 68EXPL: 0CVE-2016-7476
https://notcve.org/view.php?id=CVE-2016-7476
The Traffic Management Microkernel (TMM) in F5 BIG-IP LTM, AAM, AFM, APM, ASM, GTM, Link Controller, PEM, PSM, and WebSafe 11.6.0 before 11.6.0 HF6, 11.5.0 before 11.5.3 HF2, and 11.3.0 before 11.4.1 HF10 may suffer from a memory leak while handling certain types of TCP traffic. Remote attackers may cause a denial of service (DoS) by way of a crafted TCP packet. El Traffic Management Microkernel (TMM) en F5 BIG-IP LTM, AAM, AFM, APM, ASM, GTM, Link Controller, PEM, PSM y WebSafe versión 11.6.0 y anteriores a 11.6.0 HF6, versión 11.5.0 y anteriores a 11.5.3 HF2 , y versión 11.3.0 y anteriores a 11.4.1 HF10, puede sufrir una fuga de memoria al manejar ciertos tipos de tráfico TCP. Los atacantes remotos pueden causar una denegación de servicio (DoS) a través de un paquete TCP manipulado. • http://www.securityfocus.com/bid/94353 http://www.securitytracker.com/id/1037274 https://support.f5.com/csp/#/article/K87416818 • CWE-20: Improper Input Validation •