CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2018-5503
https://notcve.org/view.php?id=CVE-2018-5503
22 Mar 2018 — On F5 BIG-IP versions 13.0.0 - 13.1.0.3 or 12.0.0 - 12.1.3.1, TMM may restart when processing a specifically crafted page through a virtual server with an associated PEM policy that has content insertion as an action. Desde la versión 13.0.0 hasta la 13.1.0.3 o desde la 12.0.0 hasta la 12.1.3.1 de F5 BIG-IP, el TMM podría reiniciarse al procesar una página específicamente manipulada mediante un servidor virtual con una política PEM asociada que tiene la inserción de contenido como acción. • http://www.securitytracker.com/id/1040560 • CWE-20: Improper Input Validation •
CVSS: 5.9EPSS: 0%CPEs: 2EXPL: 0CVE-2018-5505
https://notcve.org/view.php?id=CVE-2018-5505
22 Mar 2018 — On F5 BIG-IP versions 13.1.0 - 13.1.0.3, when ASM and AVR are both provisioned, TMM may restart while processing DNS requests when the virtual server is configured with a DNS profile and the Protocol setting is set to TCP. Desde la versión 13.0.0 hasta la 13.1.0.3 de F5 BIG-IP, cuando se proporciona tanto ASM como AVR, TMM podría reiniciarse al procesar peticiones DNS cuando el servidor virtual está configurado con un perfil DNS y la opción Protocol está marcada como TCP. • http://www.securityfocus.com/bid/103505 •
CVSS: 7.5EPSS: 0%CPEs: 13EXPL: 0CVE-2018-5502
https://notcve.org/view.php?id=CVE-2018-5502
22 Mar 2018 — On F5 BIG-IP versions 13.0.0 - 13.1.0.3, attackers may be able to disrupt services on the BIG-IP system with maliciously crafted client certificate. This vulnerability affects virtual servers associated with Client SSL profile which enables the use of client certificate authentication. Client certificate authentication is not enabled by default in Client SSL profile. There is no control plane exposure. Desde la versión 13.0.0 hasta la 13.1.0.3 de F5 BIG-IP, los atacantes podrían ser capaces de interrumpir s... • http://www.securitytracker.com/id/1040561 • CWE-295: Improper Certificate Validation •
CVSS: 9.3EPSS: 0%CPEs: 25EXPL: 0CVE-2018-5504
https://notcve.org/view.php?id=CVE-2018-5504
22 Mar 2018 — In some circumstances, the Traffic Management Microkernel (TMM) does not properly handle certain malformed Websockets requests/responses, which allows remote attackers to cause a denial-of-service (DoS) or possible remote code execution on the F5 BIG-IP system running versions 13.0.0 - 13.1.0.3 or 12.1.0 - 12.1.3.1. En algunas circunstancias, el TMM (Traffic Management Microkernel) no gestiona correctamente algunas peticiones/respuestas Websockets mal formadas. Esto permite que atacantes remotos provoquen u... • http://www.securitytracker.com/id/1040558 •
CVSS: 7.8EPSS: 0%CPEs: 15EXPL: 0CVE-2018-5509
https://notcve.org/view.php?id=CVE-2018-5509
22 Mar 2018 — On F5 BIG-IP versions 13.0.0 or 12.1.0 - 12.1.3.1, when a specifically configured virtual server receives traffic of an undisclosed nature, TMM will crash and take the configured failover action, potentially causing a denial of service. The configuration which exposes this issue is not common and in general does not work when enabled in previous versions of BIG-IP. Starting in 12.1.0, BIG-IP will crash if the configuration which exposes this issue is enabled and the virtual server receives non TCP traffic. ... • http://www.securityfocus.com/bid/103504 • CWE-20: Improper Input Validation •
CVSS: 5.9EPSS: 0%CPEs: 22EXPL: 0CVE-2014-4024
https://notcve.org/view.php?id=CVE-2014-4024
19 Mar 2018 — SSL virtual servers in F5 BIG-IP systems 10.x before 10.2.4 HF9, 11.x before 11.2.1 HF12, 11.3.0 before HF10, 11.4.0 before HF8, 11.4.1 before HF5, 11.5.0 before HF5, and 11.5.1 before HF5, when used with third-party Secure Sockets Layer (SSL) accelerator cards, might allow remote attackers to have unspecified impact via a timing side-channel attack. Los servidores virtuales SSL en sistemas F5 BIG-IP, en versiones 10.x anteriores a la 10.2.4 HF9, versiones 11.x anteriores a la 11.2.1 HF12, versiones 11.3.0 ... • https://exchange.xforce.ibmcloud.com/vulnerabilities/95834 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.7EPSS: 0%CPEs: 1EXPL: 0CVE-2017-6152
https://notcve.org/view.php?id=CVE-2017-6152
08 Mar 2018 — A local user on F5 BIG-IQ Centralized Management 5.1.0-5.2.0 with the Access Manager role has privileges to change the passwords of other users on the system, including the local admin account password. Un usuario local en F5 BIG-IQ Centralized Management 5.1.0-5.2.0 con el rol Access Manager tiene privilegios para cambiar las contraseñas de otros usuarios en el sistema, incluyendo la contraseña de la cuenta del administrador local. • http://www.securityfocus.com/bid/103441 • CWE-269: Improper Privilege Management •
CVSS: 7.8EPSS: 0%CPEs: 20EXPL: 0CVE-2017-6150
https://notcve.org/view.php?id=CVE-2017-6150
01 Mar 2018 — Under certain conditions for F5 BIG-IP systems 13.0.0 or 12.1.0 - 12.1.3.1, using FastL4 profiles, when the Reassemble IP Fragments option is disabled (default), some specific large fragmented packets may restart the Traffic Management Microkernel (TMM). Bajo ciertas condiciones para los sistemas F5 BIG-IP 13.0.0 o 12.1.0 - 12.1.3.1 que emplean perfiles FastL4, cuando la opción Reassemble IP Fragments está deshabilitada (por defecto), algunos paquetes grandes fragmentados podrían reiniciar el TMM (Traffic M... • http://www.securityfocus.com/bid/103235 • CWE-20: Improper Input Validation •
CVSS: 5.9EPSS: 0%CPEs: 65EXPL: 0CVE-2018-5501
https://notcve.org/view.php?id=CVE-2018-5501
01 Mar 2018 — In some circumstances, on F5 BIG-IP systems running 13.0.0, 12.1.0 - 12.1.3.1, any 11.6.x or 11.5.x release, or 11.2.1, TCP DNS profile allows excessive buffering due to lack of flow control. En algunas circunstancias, en sistemas F5 BIG-IP que ejecutan 13.0.0, 12.1.0 - 12.1.3.1, cualquier versión 11.6.x o 11.5.x o 11.2.1, el perfil TCP DNS permite el buffering excesivo debido a la falta de control de flujo. • http://www.securityfocus.com/bid/103211 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 5.9EPSS: 0%CPEs: 39EXPL: 0CVE-2018-5500
https://notcve.org/view.php?id=CVE-2018-5500
01 Mar 2018 — On F5 BIG-IP systems running 13.0.0, 12.1.0 - 12.1.3.1, or 11.6.1 - 11.6.2, every Multipath TCP (MCTCP) connection established leaks a small amount of memory. Virtual server using TCP profile with Multipath TCP (MCTCP) feature enabled will be affected by this issue. En sistemas F5 BIG-IP que ejecutan las versiones 13.0.0, 12.1.0 - 12.1.3.1 o 11.6.1 - 11.6.2, cada conexión Multipath TCP (MCTCP) que se establece filtra una pequeña cantidad de memoria. Los servidores virtuales que emplean el perfil TCP con la ... • http://www.securityfocus.com/bid/103217 • CWE-400: Uncontrolled Resource Consumption •