CVSS: 4.9EPSS: 0%CPEs: 9EXPL: 0CVE-2022-23031
https://notcve.org/view.php?id=CVE-2022-23031
25 Jan 2022 — On BIG-IP FPS, ASM, and Advanced WAF versions 16.1.x before 16.1.1, 15.1.x before 15.1.4, and 14.1.x before 14.1.4.4, an XML External Entity (XXE) vulnerability exists in an undisclosed page of the F5 Advanced Web Application Firewall (Advanced WAF) and BIG-IP ASM Traffic Management User Interface (TMUI), also referred to as the Configuration utility, that allows an authenticated high-privileged attacker to read local files and force BIG-IP to send HTTP requests. Note: Software versions which have reached E... • https://support.f5.com/csp/article/K61112120 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 7.5EPSS: 0%CPEs: 55EXPL: 0CVE-2022-23019
https://notcve.org/view.php?id=CVE-2022-23019
25 Jan 2022 — On BIG-IP version 16.1.x before 16.1.2, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.4, and all versions of 13.1.x and 12.1.x, when a message routing type virtual server is configured with both Diameter Session and Router Profiles, undisclosed traffic can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En BIG-IP versiones 16.1.x anteriores a 16.1.2, 15.1.x anteriores a 15.1.4.1, 14.1.x anteriores a 14.1.4.4, y to... • https://support.f5.com/csp/article/K82793463 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 56EXPL: 0CVE-2022-23025
https://notcve.org/view.php?id=CVE-2022-23025
25 Jan 2022 — On BIG-IP version 16.1.x before 16.1.1, 15.1.x before 15.1.4, 14.1.x before 14.1.4.4, and all versions of 13.1.x, when a SIP ALG profile is configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En BIG-IP versiones 16.1.x anteriores a 16.1.1, 15.1.x anteriores a 15.1.4, 14.1.x anteriores a 14.1.4.4 y todas las versiones de la 13.1.x, cuando es configura... • https://support.f5.com/csp/article/K44110411 • CWE-476: NULL Pointer Dereference •
CVSS: 6.5EPSS: 0%CPEs: 72EXPL: 0CVE-2022-23023
https://notcve.org/view.php?id=CVE-2022-23023
25 Jan 2022 — On BIG-IP version 16.1.x before 16.1.2.1, 15.1.x before 15.1.5, 14.1.x before 14.1.4.5, and all versions of 13.1.x and 12.1.x, and BIG-IQ all versions of 8.x and 7.x, undisclosed requests by an authenticated iControl REST user can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En BIG-IP versiones 16.1.x anteriores a 16.1.2.1, 15.1.x anteriores a 15.1.5, 14.1.x anteriores a 14.1.4.5, y todas las versiones de 13.1... • https://support.f5.com/csp/article/K11742742 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.5EPSS: 0%CPEs: 44EXPL: 0CVE-2022-23017
https://notcve.org/view.php?id=CVE-2022-23017
25 Jan 2022 — On BIG-IP version 16.x before 16.1.0, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.5, and all versions of 13.1.x, when a virtual server is configured with a DNS profile with the Rapid Response Mode setting enabled and is configured on a BIG-IP system, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En BIG-IP versiones 16.x anteriores a 16.1.0, 15.1.x anteriores a 15.1.4.1, 14.1... • https://support.f5.com/csp/article/K28042514 • CWE-476: NULL Pointer Dereference •
CVSS: 7.5EPSS: 0%CPEs: 33EXPL: 0CVE-2022-23015
https://notcve.org/view.php?id=CVE-2022-23015
25 Jan 2022 — On BIG-IP versions 16.x before 16.1.0, 15.1.x before 15.1.4.1, and 14.1.2.6-14.1.4.4, when a Client SSL profile is configured on a virtual server with Client Certificate Authentication set to request/require and Session Ticket enabled and configured, processing SSL traffic can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En BIG-IP versiones 16.x anteriores a 16.1.0, 15.1.x anteriores a 15.1.4.1 y 14.1.2.6-14.1... • https://support.f5.com/csp/article/K08476614 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.5EPSS: 0%CPEs: 22EXPL: 0CVE-2022-23016
https://notcve.org/view.php?id=CVE-2022-23016
25 Jan 2022 — On versions 16.1.x before 16.1.2 and 15.1.x before 15.1.4.1, when BIG-IP SSL Forward Proxy with TLS 1.3 is configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En las versiones 16.1.x antes de 16.1.2 y 15.1.x antes de 15.1.4.1, cuando BIG-IP SSL Forward Proxy con TLS versión 1.3 está configurado en un servidor virtual, las peticiones no reveladas pued... • https://support.f5.com/csp/article/K91013510 • CWE-476: NULL Pointer Dereference •
CVSS: 7.5EPSS: 0%CPEs: 66EXPL: 0CVE-2022-23010
https://notcve.org/view.php?id=CVE-2022-23010
25 Jan 2022 — On BIG-IP versions 16.x before 16.1.0, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.4, and all versions of 13.1.x, 12.1.x, and 11.6.x, when a FastL4 profile and an HTTP profile are configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En BIG-IP versiones 16.x anteriores a 16.1.0, 15.1.x anteriores a 15.1.4.1, 14.1.x anteriores a 14.1.4.4 y todas las versiones de ... • https://support.f5.com/csp/article/K34360320 • CWE-404: Improper Resource Shutdown or Release •
CVSS: 7.5EPSS: 2%CPEs: 60EXPL: 2CVE-2002-20001
https://notcve.org/view.php?id=CVE-2002-20001
11 Nov 2021 — The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side) to send arbitrary numbers that are actually not public keys, and trigger expensive server-side DHE modular-exponentiation calculations, aka a D(HE)at or D(HE)ater attack. The client needs very little CPU resources and network bandwidth. The attack may be more disruptive in cases where a client can require a server to select its largest supported key size. The basic attack scenario is that the client must claim that it c... • https://github.com/c0r0n3r/dheater • CWE-400: Uncontrolled Resource Consumption •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2021-23029
https://notcve.org/view.php?id=CVE-2021-23029
14 Sep 2021 — On version 16.0.x before 16.0.1.2, insufficient permission checks may allow authenticated users with guest privileges to perform Server-Side Request Forgery (SSRF) attacks through F5 Advanced Web Application Firewall (WAF) and the BIG-IP ASM Configuration utility. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En versiones 16.0.x anteriores a 16.0.1.2, unas comprobaciones de permisos insuficientes pueden permitir a usuarios autenticados con privilegios de invit... • https://support.f5.com/csp/article/K52420610 • CWE-918: Server-Side Request Forgery (SSRF) •