CVSS: 7.5EPSS: 0%CPEs: 66EXPL: 0CVE-2022-23010
https://notcve.org/view.php?id=CVE-2022-23010
25 Jan 2022 — On BIG-IP versions 16.x before 16.1.0, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.4, and all versions of 13.1.x, 12.1.x, and 11.6.x, when a FastL4 profile and an HTTP profile are configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En BIG-IP versiones 16.x anteriores a 16.1.0, 15.1.x anteriores a 15.1.4.1, 14.1.x anteriores a 14.1.4.4 y todas las versiones de ... • https://support.f5.com/csp/article/K34360320 • CWE-404: Improper Resource Shutdown or Release •
CVSS: 9.6EPSS: 1%CPEs: 66EXPL: 0CVE-2021-23037
https://notcve.org/view.php?id=CVE-2021-23037
14 Sep 2021 — On all versions of 16.1.x, 16.0.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x, a reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to execute JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En todas las versiones de 16.1.x, 16.0.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x y 11.6.x, se presenta una vulnerabilidad de tipo cros... • https://support.f5.com/csp/article/K21435974 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 66EXPL: 0CVE-2021-23044
https://notcve.org/view.php?id=CVE-2021-23044
14 Sep 2021 — On BIG-IP version 16.x before 16.1.0, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.2, 13.1.x before 13.1.4.1, and all versions of 12.1.x and 11.6.x, when the Intel QuickAssist Technology (QAT) compression driver is used on affected BIG-IP hardware and BIG-IP Virtual Edition (VE) platforms, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En BIG-IP versiones 16.x de anteriores a 1... • https://support.f5.com/csp/article/K35408374 • CWE-20: Improper Input Validation •
CVSS: 6.5EPSS: 0%CPEs: 66EXPL: 0CVE-2021-23043
https://notcve.org/view.php?id=CVE-2021-23043
14 Sep 2021 — On BIG-IP, on all versions of 16.1.x, 16.0.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x, a directory traversal vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to access arbitrary files. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En BIG-IP, en todas las versiones 16.1.x, 16.0.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x y 11.6.x, se presenta una vulnerabilidad de salto de directorio en una página no divulgada de ... • https://support.f5.com/csp/article/K63163637 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 0%CPEs: 55EXPL: 0CVE-2020-5931
https://notcve.org/view.php?id=CVE-2020-5931
29 Oct 2020 — On BIG-IP 15.1.0-15.1.0.5, 14.1.0-14.1.2.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, Virtual servers with a OneConnect profile may incorrectly handle WebSockets related HTTP response headers, causing TMM to restart. En BIG-IP versiones 15.1.0-15.1.0.5, 14.1.0-14.1.2.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2 y 11.6.1-11.6.5.2, servidores virtuales con OneConnect puede manejar incorrectamente los encabezados de respuesta HTTP relacionados con WebSockets, causando que TMM se reinicie • https://support.f5.com/csp/article/K25400442 •
CVSS: 7.8EPSS: 0%CPEs: 55EXPL: 0CVE-2020-5933
https://notcve.org/view.php?id=CVE-2020-5933
29 Oct 2020 — On versions 15.1.0-15.1.0.5, 14.1.0-14.1.2.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, when a BIG-IP system that has a virtual server configured with an HTTP compression profile processes compressed HTTP message payloads that require deflation, a Slowloris-style attack can trigger an out-of-memory condition on the BIG-IP system. En las versiones 15.1.0-15.1.0.5, 14.1.0-14.1.2.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.1 y 11.6.1-11.6.5.1, cuando un sistema BIG-IP que contiene un servidor virtual config... • https://support.f5.com/csp/article/K26244025 •
CVSS: 7.2EPSS: 0%CPEs: 55EXPL: 0CVE-2020-5907
https://notcve.org/view.php?id=CVE-2020-5907
01 Jul 2020 — In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, an authorized user provided with access only to the TMOS Shell (tmsh) may be able to conduct arbitrary file read/writes via the built-in sftp functionality. En BIG-IP versiones 15.0.0 hasta 15.1.0.3, 14.1.0 hasta 14.1.2.3, 13.1.0 hasta 13.1.3.3, 12.1.0 hasta 12.1.5.1 y 11.6.1 hasta 11.6.5.1, un usuario autorizado proporcionado con acceso solo a TMOS Shell (tmsh) puede ser capaz de conducir lecturas y ... • https://support.f5.com/csp/article/K00091341 •
CVSS: 7.8EPSS: 0%CPEs: 68EXPL: 0CVE-2020-5858
https://notcve.org/view.php?id=CVE-2020-5858
27 Mar 2020 — On BIG-IP 15.0.0-15.0.1.2, 14.1.0-14.1.2.2, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5.1 and BIG-IQ 7.0.0, 6.0.0-6.1.0, and 5.2.0-5.4.0, users with non-administrator roles (for example, Guest or Resource Administrator) with tmsh shell access can execute arbitrary commands with elevated privilege via a crafted tmsh command. En BIG-IP versiones 15.0.0-15.0.1.2, 14.1.0-14.1.2.2, 13.1.0-13.1.3.2, 12.1.0-12.1.5 y 11.5.2-11.6.5.1 y BIG-IQ versiones 7.0. 0, 6.0.0-6.1.0 y 5.2.0-5.4.0, los usuarios con roles ... • https://support.f5.com/csp/article/K36814487 •
CVSS: 8.1EPSS: 0%CPEs: 58EXPL: 0CVE-2020-5860
https://notcve.org/view.php?id=CVE-2020-5860
27 Mar 2020 — On BIG-IP 15.0.0-15.1.0.2, 14.1.0-14.1.2.3, 13.1.0-13.1.3.2, 12.1.0-12.1.5.1, and 11.5.2-11.6.5.1 and BIG-IQ 7.0.0, 6.0.0-6.1.0, and 5.2.0-5.4.0, in a High Availability (HA) network failover in Device Service Cluster (DSC), the failover service does not require a strong form of authentication and HA network failover traffic is not encrypted by Transport Layer Security (TLS). En BIG-IP versiones 15.0.0-15.1.0.2, 14.1.0-14.1.2.3, 13.1.0-13.1.3.2, 12.1.0-12.1.5.1 y 11.5.2-11.6.5.1 y BIG-IQ versiones 7.0. 0, 6.... • https://support.f5.com/csp/article/K67472032 • CWE-287: Improper Authentication CWE-319: Cleartext Transmission of Sensitive Information •
CVSS: 7.5EPSS: 0%CPEs: 65EXPL: 0CVE-2020-5857
https://notcve.org/view.php?id=CVE-2020-5857
27 Mar 2020 — On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2.2, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, undisclosed HTTP behavior may lead to a denial of service. En BIG-IP versiones 15.0.0-15.0.1, 14.1.0-14.1.2.2, 13.1.0-13.1.3.1, 12.1.0-12.1.5 y 11.5.2-11.6.5.1, un comportamiento HTTP no revelado puede conllevar a una denegación de servicio. • https://support.f5.com/csp/article/K70275209 •