CVSS: 8.1EPSS: 6%CPEs: 47EXPL: 0CVE-2017-6157
https://notcve.org/view.php?id=CVE-2017-6157
27 Oct 2017 — In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and Websafe software version 12.0.0 to 12.1.1, 11.6.0 to 11.6.1, 11.5.0 - 11.5.4, virtual servers with a configuration using the HTTP Explicit Proxy functionality and/or SOCKS profile are vulnerable to an unauthenticated, remote attack that allows modification of BIG-IP system configuration, extraction of sensitive system files, and/or possible remote command execution on the BIG-IP system. En F5 BIG-IP LTM, AAM, AFM, Analytics,... • http://www.securityfocus.com/bid/101634 •
CVSS: 5.9EPSS: 0%CPEs: 43EXPL: 0CVE-2017-6159
https://notcve.org/view.php?id=CVE-2017-6159
27 Oct 2017 — F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM, Websafe software version 12.0.0 to 12.1.2, 11.6.0 to 11.6.1 are vulnerable to a denial of service attack when the MPTCP option is enabled on a virtual server. Data plane is vulnerable when using the MPTCP option of a TCP profile. There is no control plane exposure. An attacker may be able to disrupt services by causing TMM to restart hence temporarily failing to process traffic. F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, G... • http://www.securityfocus.com/bid/101633 •
CVSS: 5.9EPSS: 1%CPEs: 50EXPL: 0CVE-2017-6162
https://notcve.org/view.php?id=CVE-2017-6162
27 Oct 2017 — In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, Websafe software version 12.0.0 to 12.1.2, 11.6.0 to 11.6.1, 11.4.0 to 11.5.4, 11.2.1, in some cases TMM may crash when processing TCP traffic. This vulnerability affects TMM via a virtual server configured with TCP profile. Traffic processing is disrupted while Traffic Management Microkernel (TMM) restarts. If the affected BIG-IP system is configured to be part of a device group, it will trigger a failover to the... • http://www.securityfocus.com/bid/101635 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.9EPSS: 0%CPEs: 24EXPL: 0CVE-2017-6141
https://notcve.org/view.php?id=CVE-2017-6141
20 Oct 2017 — In F5 BIG-IP LTM, AAM, AFM, APM, ASM, Link Controller, PEM, and WebSafe 12.1.0 through 12.1.2, certain values in a TLS abbreviated handshake when using a client SSL profile with the Session Ticket option enabled may cause disruption of service to the Traffic Management Microkernel (TMM). The Session Ticket option is disabled by default. En F5 BIG-IP LTM, AAM, AFM, APM, ASM, Link Controller, PEM y WebSafe 12.1.0 hasta la 12.1.2, ciertos valores en una negociación abreviada TLS al emplear un perfil de cliente... • https://support.f5.com/csp/article/K21154730 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 40EXPL: 0CVE-2017-6145
https://notcve.org/view.php?id=CVE-2017-6145
20 Oct 2017 — iControl REST in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, and WebSafe 12.0.0 through 12.1.2 and 13.0.0 includes a service to convert authorization BIGIPAuthCookie cookies to X-F5-Auth-Token tokens. This service does not properly re-validate cookies when making that conversion, allowing once-valid but now expired cookies to be converted to valid tokens. iControl REST en F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM y WebSafe 12.0.0 hasta la versión 12... • https://support.f5.com/csp/article/K22317030 • CWE-613: Insufficient Session Expiration •
CVSS: 9.8EPSS: 2%CPEs: 111EXPL: 0CVE-2017-6165
https://notcve.org/view.php?id=CVE-2017-6165
20 Oct 2017 — In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM, and WebSafe 11.5.1 HF6 through 11.5.4 HF4, 11.6.0 through 11.6.1 HF1, and 12.0.0 through 12.1.2 on VIPRION platforms only, the script which synchronizes SafeNet External Network HSM configuration elements between blades in a clustered deployment will log the HSM partition password in cleartext to the "/var/log/ltm" log file. En F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM y WebSafe 11.5.1 HF6 has... • http://www.securityfocus.com/bid/101543 • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 5.9EPSS: 0%CPEs: 20EXPL: 0CVE-2017-6147
https://notcve.org/view.php?id=CVE-2017-6147
18 Sep 2017 — In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, and WebSafe 12.1.2-HF1 and 13.0.0, an undisclosed type of responses may cause TMM to restart, causing an interruption of service when "SSL Forward Proxy" setting is enabled in both the Client and Server SSL profiles assigned to a BIG-IP Virtual Server. En F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM y WebSafe 12.1.2-HF1 y 13.0.0, una serie de peticiones no reveladas puede provocar el reinicio del TMM y la ... • http://www.securityfocus.com/bid/100981 •
CVSS: 5.4EPSS: 0%CPEs: 136EXPL: 0CVE-2016-7469
https://notcve.org/view.php?id=CVE-2016-7469
09 Jun 2017 — A stored cross-site scripting (XSS) vulnerability in the Configuration utility device name change page in BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, PSM, WebAccelerator, WOM and WebSafe version 12.0.0 - 12.1.2, 11.4.0 - 11.6.1, and 11.2.1 allows an authenticated user to inject arbitrary web script or HTML. Exploitation requires Resource Administrator or Administrator privileges, and it could cause the Configuration utility client to become unstable. Una vulnerab... • http://www.securityfocus.com/bid/95320 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 45EXPL: 0CVE-2017-6131
https://notcve.org/view.php?id=CVE-2017-6131
23 May 2017 — In some circumstances, an F5 BIG-IP version 12.0.0 to 12.1.2 and 13.0.0 Azure cloud instance may contain a default administrative password which could be used to remotely log into the BIG-IP system. The impacted administrative account is the Azure instance administrative user that was created at deployment. The root and admin accounts are not vulnerable. An attacker may be able to remotely access the BIG-IP host via SSH. En algunas circunstancias, una instancia de nube de Azure de F5 BIG-IP versiones 12.0.0... • http://www.securitytracker.com/id/1038569 • CWE-798: Use of Hard-coded Credentials •
CVSS: 7.5EPSS: 1%CPEs: 68EXPL: 0CVE-2016-7476
https://notcve.org/view.php?id=CVE-2016-7476
11 May 2017 — The Traffic Management Microkernel (TMM) in F5 BIG-IP LTM, AAM, AFM, APM, ASM, GTM, Link Controller, PEM, PSM, and WebSafe 11.6.0 before 11.6.0 HF6, 11.5.0 before 11.5.3 HF2, and 11.3.0 before 11.4.1 HF10 may suffer from a memory leak while handling certain types of TCP traffic. Remote attackers may cause a denial of service (DoS) by way of a crafted TCP packet. El Traffic Management Microkernel (TMM) en F5 BIG-IP LTM, AAM, AFM, APM, ASM, GTM, Link Controller, PEM, PSM y WebSafe versión 11.6.0 y anteriores ... • http://www.securityfocus.com/bid/94353 • CWE-20: Improper Input Validation •