CVSS: 7.5EPSS: 0%CPEs: 30EXPL: 0CVE-2016-9253
https://notcve.org/view.php?id=CVE-2016-9253
09 May 2017 — In F5 BIG-IP 12.1.0 through 12.1.2, specific websocket traffic patterns may cause a disruption of service for virtual servers configured to use the websocket profile. En F5 BIG-IP desde la versión 12.1.0 hasta la 12.1.2, patrones de tráfico websocket específicos, pueden causar una interrupción del servicio en servidores virtuales configurados para usar el perfil websocket. • http://www.securitytracker.com/id/1038415 • CWE-20: Improper Input Validation •
CVSS: 8.8EPSS: 0%CPEs: 40EXPL: 0CVE-2016-9251
https://notcve.org/view.php?id=CVE-2016-9251
09 May 2017 — In F5 BIG-IP 12.0.0 through 12.1.2, an authenticated attacker may be able to cause an escalation of privileges through a crafted iControl REST connection. En F5 BIG-IP desde la versión 12.0.0 hasta la 12.1.2, un atacante autenticado puede causar una escalada de privilegios a través de una conexión iControl REST manipulada. • http://www.securitytracker.com/id/1038414 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.3EPSS: 0%CPEs: 5EXPL: 0CVE-2017-0302
https://notcve.org/view.php?id=CVE-2017-0302
09 May 2017 — In F5 BIG-IP APM 12.0.0 through 12.1.2 and 13.0.0, an authenticated user with an established access session to the BIG-IP APM system may be able to cause a traffic disruption if the length of the requested URL is less than 16 characters. En F5 BIG-IP APM versiones 12.0.0 hasta la 12.1.2 y versión 13.0.0, un usuario autenticado con una sesión establecida de acceso al sistema BIG-IP APM podría causar una interrupción del tráfico si la longitud de la solicitud URL es menor de 16 caracteres. • http://www.securitytracker.com/id/1038408 • CWE-118: Incorrect Access of Indexable Resource ('Range Error') •
CVSS: 6.1EPSS: 0%CPEs: 4EXPL: 0CVE-2016-9257
https://notcve.org/view.php?id=CVE-2016-9257
09 May 2017 — In F5 BIG-IP APM 12.0.0 through 12.1.2, non-authenticated users may be able to inject JavaScript into a request that will then be rendered and executed in the context of the Administrative user when the Administrative user is viewing the Access System Logs, allowing the non-authenticated user to carry out a Cross Site Scripting (XSS) attack against the Administrative user. En F5 BIG-IP APM versiones 12.0.0 hasta la 12.1.2, usuarios no autenticados podrían inyectar código JavaScript en una petición que podrí... • http://www.securitytracker.com/id/1038416 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 103EXPL: 0CVE-2017-6128
https://notcve.org/view.php?id=CVE-2017-6128
01 May 2017 — An attacker may be able to cause a denial-of-service (DoS) attack against the sshd component in F5 BIG-IP, Enterprise Manager, BIG-IQ, and iWorkflow. Un atacante puede ser capaz de causar un ataque de denegación de servicio (DoS) contra el componente sshd en F5 BIG-IP, Enterprise Manager, BIG-IQ e iWorkflow • http://www.securitytracker.com/id/1038362 •
CVSS: 5.3EPSS: 0%CPEs: 6EXPL: 0CVE-2016-7467
https://notcve.org/view.php?id=CVE-2016-7467
11 Apr 2017 — The TMM SSO plugin in F5 BIG-IP APM 12.0.0 - 12.1.1, 11.6.0 - 11.6.1 HF1, 11.5.4 - 11.5.4 HF2, when configured as a SAML Identity Provider with a Service Provider (SP) connector, might allow traffic to be disrupted or failover initiated when a malformed, signed SAML authentication request from an authenticated user is sent via the SP connector. El plugin TMM SSO en F5 BIG-IP APM 12.0.0 - 12.1.1, 11.6.0 - 11.6.1 HF1, 11.5.4 - 11.5.4 HF2, cuando está configurado como un SAML Identity Provider con un conector ... • http://www.securityfocus.com/bid/97168 • CWE-20: Improper Input Validation •
CVSS: 7.4EPSS: 0%CPEs: 3EXPL: 0CVE-2017-6130
https://notcve.org/view.php?id=CVE-2017-6130
06 Apr 2017 — F5 SSL Intercept iApp 1.5.0 - 1.5.7 and SSL Orchestrator 2.0 is vulnerable to a Server-Side Request Forgery (SSRF) attack when deployed using the Dynamic Domain Bypass (DDB) feature feature plus SNAT Auto Map option for egress traffic. F5 SSL Intercept iApp 1.5.0 - 1.5.7 y SSL Orchestrator 2.0 es vulnerable a un ataque SSRF cuando se despliega utilizando la funcionalidad Dynamic Domain Bypass (DDB) más la opción SNAT Auto Map para el tráfico de salida. • https://support.f5.com/csp/article/K23001529 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2017-0305
https://notcve.org/view.php?id=CVE-2017-0305
06 Apr 2017 — F5 SSL Intercept iApp version 1.5.0 - 1.5.7 is vulnerable to an unauthenticated, remote attack that may allow modification of the BIG-IP system configuration, extraction of sensitive system files, and possible remote command execution on the system when deployed using the Explicit Proxy feature plus SNAT Auto Map option for egress traffic. F5 SSL Intercept iApp versión 1.5.0 - 1.5.7 es vulnerable a un ataque remoto no autenticado, que pueden permitir la modificación de la configuración del sistema BIG-IP, e... • https://support.f5.com/csp/article/K53244431 •
CVSS: 7.5EPSS: 0%CPEs: 156EXPL: 0CVE-2016-9252
https://notcve.org/view.php?id=CVE-2016-9252
27 Mar 2017 — The Traffic Management Microkernel (TMM) in F5 BIG-IP before 11.5.4 HF3, 11.6.x before 11.6.1 HF2 and 12.x before 12.1.2 does not properly handle minimum path MTU options for IPv6, which allows remote attackers to cause a denial-of-service (DoS) through unspecified vectors. El Traffic Management Microkernel (TMM) en F5 BIG-IP en versiones anteriores a 11.5.4 HF3, 11.6.x en versiones anteriores a 11.6.1 HF2 y 12.x en versiones anteriores a 12.1.2 no maneja adecuadamente las opciones MTU de ruta mínima para I... • http://www.securitytracker.com/id/1038132 • CWE-19: Data Processing Errors •
CVSS: 5.5EPSS: 0%CPEs: 123EXPL: 0CVE-2016-7474
https://notcve.org/view.php?id=CVE-2016-7474
27 Mar 2017 — In some cases the MCPD binary cache in F5 BIG-IP devices may allow a user with Advanced Shell access, or privileges to generate a qkview, to temporarily obtain normally unrecoverable information. En algunos casos la caché binaria MCPD en dispositivos F5 BIG-IP pueden permitir a un usuario con acceso Advanced Shell, o privilegios generar un qkview, para obtener temporalmente información normalmente irrecuperable. • http://www.securityfocus.com/bid/97198 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •