CVSS: 7.4EPSS: 0%CPEs: 4EXPL: 0CVE-2024-28883 – BIG-IP APM browser network access VPN client vulnerability
https://notcve.org/view.php?id=CVE-2024-28883
An origin validation vulnerability exists in BIG-IP APM browser network access VPN client for Windows, macOS and Linux which may allow an attacker to bypass F5 endpoint inspection. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Existe una vulnerabilidad de validación de origen en el cliente VPN de acceso a la red del navegador BIG-IP APM para Windows, macOS y Linux que puede permitir a un atacante eludir la inspección del endpoint F5. Nota: Las versiones de software que han llegado al final del soporte técnico (EoTS) no se evalúan. • https://my.f5.com/manage/s/article/K000138744 • CWE-346: Origin Validation Error •
CVSS: 4.4EPSS: 0%CPEs: 76EXPL: 0CVE-2023-45219 – BIG-IP tmsh vulnerability
https://notcve.org/view.php?id=CVE-2023-45219
Exposure of Sensitive Information vulnerability exist in an undisclosed BIG-IP TMOS shell (tmsh) command which may allow an authenticated attacker with resource administrator role privileges to view sensitive information. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. La vulnerabilidad de exposición a información confidencial existe en un comando de BIG-IP TMOS shell (tmsh) no divulgado que puede permitir que un atacante autenticado con privilegios de administrador de recursos vea información confidencial. Nota: Las versiones de software que han llegado al End of Technical Support (EoTS) no se evalúan. • https://my.f5.com/manage/s/article/K20307245 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.8EPSS: 0%CPEs: 78EXPL: 0CVE-2023-43611 – BIG-IP Edge Client for macOS vulnerability
https://notcve.org/view.php?id=CVE-2023-43611
The BIG-IP Edge Client Installer on macOS does not follow best practices for elevating privileges during the installation process. This vulnerability is due to an incomplete fix for CVE-2023-38418. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated El instalador del cliente BIG-IP Edge en macOS no sigue las mejores prácticas para elevar los privilegios durante el proceso de instalación. Esta vulnerabilidad se debe a una solución incompleta para CVE-2023-38418. Nota: Las versiones de software que han llegado al End of Technical Support (EoTS) no se evalúan • https://my.f5.com/manage/s/article/K000136185 • CWE-347: Improper Verification of Cryptographic Signature •
CVSS: 7.2EPSS: 0%CPEs: 76EXPL: 0CVE-2023-42768 – BIG-IP iControl REST vulnerability
https://notcve.org/view.php?id=CVE-2023-42768
When a non-admin user has been assigned an administrator role via an iControl REST PUT request and later the user's role is reverted back to a non-admin role via the Configuration utility, tmsh, or iControl REST. BIG-IP non-admin user can still have access to iControl REST admin resource. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Cuando a un usuario no administrador se le ha asignado una función de administrador a través de una solicitud iControl REST PUT y posteriormente la función del usuario se revierte a una función de no administrador a través de la utilidad de configuración, tmsh o iControl REST. El usuario no administrador de BIG-IP aún puede tener acceso al recurso de administración iControl REST PUT. • https://my.f5.com/manage/s/article/K26910459 • CWE-613: Insufficient Session Expiration •
CVSS: 6.5EPSS: 0%CPEs: 77EXPL: 0CVE-2023-41964 – BIG-IP and BIG-IQ Database Variable vulnerability
https://notcve.org/view.php?id=CVE-2023-41964
The BIG-IP and BIG-IQ systems do not encrypt some sensitive information written to Database (DB) variables. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Los sistemas BIG-IP y BIG-IQ no cifran cierta información confidencial escrita en las variables de la Base de Datos (DB). Nota: Las versiones de software que han llegado al End of Technical Support (EoTS) no se evalúan. • https://my.f5.com/manage/s/article/K20850144 • CWE-312: Cleartext Storage of Sensitive Information •