CVSS: 6.5EPSS: 1%CPEs: 4EXPL: 3CVE-2012-2997 – F5 Networks BIG-IP - XML External Entity Injection
https://notcve.org/view.php?id=CVE-2012-2997
21 Jan 2014 — XML External Entity (XXE) vulnerability in sam/admin/vpe2/public/php/server.php in F5 BIG-IP 10.0.0 through 10.2.4 and 11.0.0 through 11.2.1 allows remote authenticated users to read arbitrary files via a crafted XML file. Vulnerabilidad de entidad XML externa en sam/admin/vpe2/public/php/server.php en F5 BIG-IP 10.0.0 hasta la versión 10.2.4 y 11.0.0 hasta la versión 11.2.1 permite a usuarios remotos autenticados leer archivos arbitrarios a través de un archivo XML manipulado. • https://www.exploit-db.com/exploits/38233 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.1EPSS: 75%CPEs: 9EXPL: 2CVE-2013-4547 – Nginx 1.1.17 - URI Processing SecURIty Bypass
https://notcve.org/view.php?id=CVE-2013-4547
22 Nov 2013 — nginx 0.8.41 through 1.4.3 and 1.5.x before 1.5.7 allows remote attackers to bypass intended restrictions via an unescaped space character in a URI. nginx 0.8.41 hasta la versión 1.4.3 y 1.5.x anterior a la versión 1.5.7 permite a atacantes remotos evadir restricciones intencionadas a través de un carácter de espacio sin escape en una URI. Ivan Fratric of the Google Security Team discovered a bug in nginx, which might allow an attacker to bypass security restrictions in certain configurations by using a spe... • https://www.exploit-db.com/exploits/38846 • CWE-116: Improper Encoding or Escaping of Output •
CVSS: 7.8EPSS: 0%CPEs: 86EXPL: 0CVE-2013-6016
https://notcve.org/view.php?id=CVE-2013-6016
26 Oct 2013 — The Traffic Management Microkernel (TMM) in F5 BIG-IP LTM, APM, ASM, Edge Gateway, GTM, Link Controller, and WOM 10.0.0 through 10.2.2 and 11.0.0; Analytics 11.0.0; PSM 9.4.0 through 9.4.8, 10.0.0 through 10.2.4, and 11.0.0 through 11.4.1; and WebAccelerator 9.4.0 through 9.4.8, 10.0.0 through 10.2.4, and 11.0.0 through 11.3.0 might change a TCP connection to the ESTABLISHED state before receiving the ACK packet, which allows remote attackers to cause a denial of service (SIGFPE or assertion failure and TMM... • http://secunia.com/advisories/55378 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 51EXPL: 0CVE-2013-0337 – Gentoo Linux Security Advisory 201310-04
https://notcve.org/view.php?id=CVE-2013-0337
07 Oct 2013 — The default configuration of nginx, possibly 1.3.13 and earlier, uses world-readable permissions for the (1) access.log and (2) error.log files, which allows local users to obtain sensitive information by reading the files. La configuración predeterminada de nginx, posiblemente versión 1.3.13 y anteriores, utiliza permisos de lectura global para los archivos (1) access.log y (2) error.log, que permite a usuarios locales obtener información sensible mediante la lectura de los archivos. Multiple vulnerabiliti... • http://secunia.com/advisories/55181 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 0CVE-2013-5975
https://notcve.org/view.php?id=CVE-2013-5975
01 Oct 2013 — The access policy logon page (logon.inc) in F5 BIG-IP APM 11.1.0 through 11.2.1 allows remote attackers to conduct clickjacking attacks via unspecified vectors. La política de acceso en la página de inicio de sesión (logon.inc) en F5 BIG-IP APM v11.1.0 hasta v11.2.1 permite a atacantes remotos llevar a cabo ataques de clickjacking a través de vectores no especificados. • http://secunia.com/advisories/54844 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.1EPSS: 0%CPEs: 10EXPL: 0CVE-2013-5976
https://notcve.org/view.php?id=CVE-2013-5976
01 Oct 2013 — Cross-site scripting (XSS) vulnerability in the access policy logout page (logout.inc) in F5 BIG-IP APM 10.1.0 through 10.2.4 and 11.1.0 through 11.3.0 allows remote attackers to inject arbitrary web script or HTML via the LastMRH_Session cookie. Vulnerabilidad XSS en la política de accesos de la página de logout (logout.inc) en F5 BIG-IP APM v10.1.0 hasta v10.2.4 y v11.1.0 hasta v11.3.0 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarias a través de la cookie LastMRH_Session. • http://secunia.com/advisories/54941 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 23EXPL: 0CVE-2013-0150
https://notcve.org/view.php?id=CVE-2013-0150
09 Aug 2013 — Directory traversal vulnerability in an unspecified signed Java applet in the client-side components in F5 BIG-IP APM 10.1.0 through 10.2.4 and 11.0.0 through 11.3.0, FirePass 6.0.0 through 6.1.0 and 7.0.0, and other products "when APM is provisioned," allows remote attackers to upload and execute arbitrary files via a .. (dot dot) in the filename parameter. Vulnerabilidad de salto de directorio en una firma no especificada de un Applet Java en un componente client-side en F5 BIG-IP APM v10.1.0 hasta v10.2.... • http://secunia.com/advisories/53477 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2013-2070 – Gentoo Linux Security Advisory 201310-04
https://notcve.org/view.php?id=CVE-2013-2070
08 Jul 2013 — http/modules/ngx_http_proxy_module.c in nginx 1.1.4 through 1.2.8 and 1.3.0 through 1.4.0, when proxy_pass is used with untrusted HTTP servers, allows remote attackers to cause a denial of service (crash) and obtain sensitive information from worker process memory via a crafted proxy response, a similar vulnerability to CVE-2013-2028. http/modules/ngx_http_proxy_module.c en nginx v1.1.4 hasta v1.2.8 y v1.3.0 hasta v1.4.0, cuando proxy_pass es utilizado con servidores HTTP de no confianza, permite a atacante... • http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105950.html •
CVSS: 9.8EPSS: 57%CPEs: 2EXPL: 15CVE-2013-2028 – Nginx 1.3.9 < 1.4.0 - Denial of Service (PoC)
https://notcve.org/view.php?id=CVE-2013-2028
23 May 2013 — The ngx_http_parse_chunked function in http/ngx_http_parse.c in nginx 1.3.9 through 1.4.0 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a chunked Transfer-Encoding request with a large chunk size, which triggers an integer signedness error and a stack-based buffer overflow. La función ngx_http_parse_chunked en http/ngx_http_parse.c en nginx v1.3.9 hasta v1.4.0 permite a atacantes remotos causar una denegación de servicio (caída) y ejecutar código arbitrario medi... • https://packetstorm.news/files/id/125758 • CWE-787: Out-of-bounds Write •
CVSS: 9.8EPSS: 0%CPEs: 37EXPL: 0CVE-2012-3163 – mysql: unspecified vulnerability related to Information Schema (CPU Oct 2012)
https://notcve.org/view.php?id=CVE-2012-3163
17 Oct 2012 — Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.64 and earlier, and 5.5.26 and earlier, allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to Information Schema. Vulnerabilidad no especificada en el componente MySQL Server en Oracle MySQL v5.1.64 y anteriores, y v5.5.26 y anteriores, permite a usuarios remotos autenticados a afectar la confidencialidad, integridad y disponibilidad a través de vectores desconocidos ... • http://rhn.redhat.com/errata/RHSA-2012-1462.html •