CVSS: 6.9EPSS: 0%CPEs: 1EXPL: 0CVE-2024-7634 – NGINX Agent Vulnerability
https://notcve.org/view.php?id=CVE-2024-7634
NGINX Agent's "config_dirs" restriction feature allows a highly privileged attacker to gain the ability to write/overwrite files outside of the designated secure directory. • https://my.f5.com/manage/s/article/K000140630 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 5.7EPSS: 0%CPEs: 1EXPL: 0CVE-2024-7347 – NGINX MP4 module vulnerability
https://notcve.org/view.php?id=CVE-2024-7347
NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module, which might allow an attacker to over-read NGINX worker memory resulting in its termination, using a specially crafted mp4 file. The issue only affects NGINX if it is built with the ngx_http_mp4_module and the mp4 directive is used in the configuration file. Additionally, the attack is possible only if an attacker can trigger the processing of a specially crafted mp4 file with the ngx_http_mp4_module. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. • https://my.f5.com/manage/s/article/K000140529 • CWE-126: Buffer Over-read •
CVSS: 6.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-37028 – BIG-IP Next Central Manager vulnerability
https://notcve.org/view.php?id=CVE-2024-37028
BIG-IP Next Central Manager may allow an attacker to lock out an account that has never been logged in. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. • https://my.f5.com/manage/s/article/K000139938 • CWE-645: Overly Restrictive Account Lockout Mechanism •
CVSS: 8.9EPSS: 0%CPEs: 1EXPL: 0CVE-2024-39809 – BIG-IP Next Central Manager vulnerability
https://notcve.org/view.php?id=CVE-2024-39809
The Central Manager user session refresh token does not expire when a user logs out. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated • https://my.f5.com/manage/s/article/K000140111 • CWE-613: Insufficient Session Expiration •
CVSS: 5.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-41719 – BIG-IP Next Central Manager vulnerability
https://notcve.org/view.php?id=CVE-2024-41719
When generating QKView of BIG-IP Next instance from the BIG-IP Next Central Manager (CM), F5 iHealth credentials will be logged in the BIG-IP Central Manager logs. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. • https://my.f5.com/manage/s/article/K000140006 • CWE-532: Insertion of Sensitive Information into Log File •