CVE Vulnerability Catalog

In F5 BIG-IP software versions 13.0.0, 12.0.0 - 12.1.2, 11.6.0 - 11.6.1, and 11.5.0 - 11.5.4, the Traffic Management Microkernel (TMM) does not properly handle certain malformed TLS1.2 records, allowing remote attackers to cause a denial-of-service (DoS) or possible remote command execution on the BIG-IP system.

In F5 BIG-IP software version 13.0.0, undisclosed requests made to BIG-IP virtual servers using the 'HTTP/2 profile' may lead to disruption of service to TMM.

On BIG-IP 2000s, 2200s, 4000s, 4200v, i5600, i5800, i7600, i7800, i10600, i10800, and VIPRION 4450 devices running versions 11.5.0 to 12.1.2, an undisclosed sequence of packets sent to Virtual Servers with client or server SSL profiles may cause disruption of data plane services.

In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM, and WebSafe software versions 13.0.0 and 12.1.0 - 12.1.2, malicious requests made to virtual servers with an HTTP profile can cause the TMM to restart. The issue is exposed with BIG-IP APM profiles, regardless of settings.

In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM, and WebSafe software version 13.0.0, a slow memory leak due to undisclosed IPv4 or IPv6 packets sent to the BIG-IP management port or self IP addresses may lead to out of memory (OOM) conditions.

In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, and WebSafe software versions 13.0.0 and 12.1.0 - 12.1.2, undisclosed HTTP requests may cause a denial of service.

In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and Websafe software versions 13.0.0, 12.0.0 to 12.1.2, 11.6.0 to 11.6.1 and 11.5.0 to 11.5.4, an undisclosed sequence of packets sent to BIG-IP High Availability state mirror listeners (primary and/or secondary IP) may cause TMM to restart.

In F5 BIG-IP APM software versions 13.0.0 and 12.1.2, under certain circumstances, tunneled VPN flows can lead to a VPN/PPP connflow being prematurely freed or cause TMM to stop responding with a 'flow not in use' assertion.

In F5 BIG-IP APM software versions 11.5.0 to 12.1.2, there is an issue where BIG-IP APM portal access requests do not return the intended resources in some cases. This may allow access to internal BIG-IP APM resources.

CVE-2017-17410 allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender Internet Security 2018. User interaction is required to exploit this vulnerability, meaning the target must visit a malicious page or open a malicious file.

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender Internet Security 2018. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

CVE-2017-17408 allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender Internet Security 2018. User interaction is required to exploit this vulnerability, meaning the target must visit a malicious page or open a malicious file.

GitHub Git LFS before 2.1.1 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, located on a 'url =' line in a .lfsconfig file within a repository.

Bus Booking Script has a SQL Injection vulnerability via the sp_id parameter in admin/view_seatseller.php and the memid parameter in admin/view_member.php.

Piwigo version 2.9.2 is vulnerable to Cross-Site Request Forgery (CSRF) via specific URL parameters. An attacker can coerce an admin user into performing unintended actions.

In Netwide Assembler (NASM) version 2.14rc0, there is a heap-based buffer over-read that can lead to a remote denial of service attack. This issue is related to a while loop in the paste_tokens function in asm/preproc.c.

In Golden Frog VyprVPN before version 2.15.0.5828 for macOS, there is a vulnerability related to an unprotected XPC service in the vyprvpnservice launch daemon. This allows attackers to update the OpenVPN configuration and the arguments passed to the OpenVPN binary.

The HMAC implementation in the Linux kernel before version 4.14.8 does not validate that the underlying cryptographic hash algorithm is unkeyed, potentially leading to a kernel stack buffer overflow.

The Salsa20 encryption algorithm in the Linux kernel before version 4.14.8 does not correctly handle zero-length inputs, allowing a local attacker to use the AF_ALG-based skcipher interface to cause denial of service or unspecified other impacts.

A memory overflow vulnerability in SMBv1 exists in EMC Data Domain DD OS affecting versions prior to 5.7.5.6 for the DD OS 5.7 family, prior to 6.0.2.9 for the DD OS 6.0 family, prior to 6.1.0.21 for the DD OS 6.1 family, all versions for the Virtual Edition 2.0 family, prior to 3.0 SP2 Update 1 for the Virtual Edition 3.0 family, and prior to 3.1 Update 2 for the Virtual Edition 3.1 family. An attacker may remotely shut down the SMB service and Active Directory authentication.