CVSS: 5.3EPSS: 0%CPEs: 77EXPL: 0CVE-2014-5209
https://notcve.org/view.php?id=CVE-2014-5209
08 Jan 2020 — An Information Disclosure vulnerability exists in NTP 4.2.7p25 private (mode 6/7) messages via a GET_RESTRICT control message, which could let a malicious user obtain sensitive information. Existe una vulnerabilidad de Divulgación de Información en los mensajes privados (modo 6/7) de NTP versión 4.2.7p25 por medio de un mensaje de control GET_RESTRICT, que podría permitir a un usuario malicioso obtener información confidencial. • https://exchange.xforce.ibmcloud.com/vulnerabilities/95841 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.7EPSS: 0%CPEs: 44EXPL: 0CVE-2018-5516
https://notcve.org/view.php?id=CVE-2018-5516
02 May 2018 — On F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.2, or 11.2.1-11.6.3.1, Enterprise Manager 3.1.1, BIG-IQ Centralized Management 5.0.0-5.4.0 or 4.6.0, BIG-IQ Cloud and Orchestration 1.0.0, or F5 iWorkflow 2.0.2-2.3.0, authenticated users granted TMOS Shell (tmsh) access can access objects on the file system which would normally be disallowed by tmsh restrictions. This allows for authenticated, low privileged attackers to exfiltrate objects on the file system which should not be allowed. En F5 BIG-IP 13.0.0-13.1.0.5... • http://www.securitytracker.com/id/1040799 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 7.5EPSS: 0%CPEs: 13EXPL: 0CVE-2018-5502
https://notcve.org/view.php?id=CVE-2018-5502
22 Mar 2018 — On F5 BIG-IP versions 13.0.0 - 13.1.0.3, attackers may be able to disrupt services on the BIG-IP system with maliciously crafted client certificate. This vulnerability affects virtual servers associated with Client SSL profile which enables the use of client certificate authentication. Client certificate authentication is not enabled by default in Client SSL profile. There is no control plane exposure. Desde la versión 13.0.0 hasta la 13.1.0.3 de F5 BIG-IP, los atacantes podrían ser capaces de interrumpir s... • http://www.securitytracker.com/id/1040561 • CWE-295: Improper Certificate Validation •
CVSS: 9.3EPSS: 3%CPEs: 25EXPL: 0CVE-2018-5504
https://notcve.org/view.php?id=CVE-2018-5504
22 Mar 2018 — In some circumstances, the Traffic Management Microkernel (TMM) does not properly handle certain malformed Websockets requests/responses, which allows remote attackers to cause a denial-of-service (DoS) or possible remote code execution on the F5 BIG-IP system running versions 13.0.0 - 13.1.0.3 or 12.1.0 - 12.1.3.1. En algunas circunstancias, el TMM (Traffic Management Microkernel) no gestiona correctamente algunas peticiones/respuestas Websockets mal formadas. Esto permite que atacantes remotos provoquen u... • http://www.securitytracker.com/id/1040558 •
CVSS: 7.8EPSS: 1%CPEs: 15EXPL: 0CVE-2018-5509
https://notcve.org/view.php?id=CVE-2018-5509
22 Mar 2018 — On F5 BIG-IP versions 13.0.0 or 12.1.0 - 12.1.3.1, when a specifically configured virtual server receives traffic of an undisclosed nature, TMM will crash and take the configured failover action, potentially causing a denial of service. The configuration which exposes this issue is not common and in general does not work when enabled in previous versions of BIG-IP. Starting in 12.1.0, BIG-IP will crash if the configuration which exposes this issue is enabled and the virtual server receives non TCP traffic. ... • http://www.securityfocus.com/bid/103504 • CWE-20: Improper Input Validation •
CVSS: 5.9EPSS: 0%CPEs: 43EXPL: 0CVE-2017-6159
https://notcve.org/view.php?id=CVE-2017-6159
27 Oct 2017 — F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM, Websafe software version 12.0.0 to 12.1.2, 11.6.0 to 11.6.1 are vulnerable to a denial of service attack when the MPTCP option is enabled on a virtual server. Data plane is vulnerable when using the MPTCP option of a TCP profile. There is no control plane exposure. An attacker may be able to disrupt services by causing TMM to restart hence temporarily failing to process traffic. F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, G... • http://www.securityfocus.com/bid/101633 •
CVSS: 5.9EPSS: 1%CPEs: 50EXPL: 0CVE-2017-6162
https://notcve.org/view.php?id=CVE-2017-6162
27 Oct 2017 — In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, Websafe software version 12.0.0 to 12.1.2, 11.6.0 to 11.6.1, 11.4.0 to 11.5.4, 11.2.1, in some cases TMM may crash when processing TCP traffic. This vulnerability affects TMM via a virtual server configured with TCP profile. Traffic processing is disrupted while Traffic Management Microkernel (TMM) restarts. If the affected BIG-IP system is configured to be part of a device group, it will trigger a failover to the... • http://www.securityfocus.com/bid/101635 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 2%CPEs: 92EXPL: 0CVE-2017-0303
https://notcve.org/view.php?id=CVE-2017-0303
27 Oct 2017 — In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and Websafe software version 13.0.0, 12.0.0 to 12.1.2 and 11.5.1 to 11.6.1, under limited circumstances connections handled by a Virtual Server with an associated SOCKS profile may not be properly cleaned up, potentially leading to resource starvation. Connections may be left in the connection table which then can only be removed by restarting TMM. Over time this may lead to the BIG-IP being unable to process further connections... • http://www.securityfocus.com/bid/101612 • CWE-459: Incomplete Cleanup •
CVSS: 7.5EPSS: 0%CPEs: 103EXPL: 0CVE-2017-6128
https://notcve.org/view.php?id=CVE-2017-6128
01 May 2017 — An attacker may be able to cause a denial-of-service (DoS) attack against the sshd component in F5 BIG-IP, Enterprise Manager, BIG-IQ, and iWorkflow. Un atacante puede ser capaz de causar un ataque de denegación de servicio (DoS) contra el componente sshd en F5 BIG-IP, Enterprise Manager, BIG-IQ e iWorkflow • http://www.securitytracker.com/id/1038362 •