CVE Vulnerability Catalog

When the Allowed IP Addresses feature is configured on the F5OS-C partition control plane, undisclosed traffic can cause multiple containers to terminate.

A validation vulnerability exists in an undisclosed URL in the Configuration utility. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

W systemie iControl REST oraz w poleceniach BIG-IP TMOS Shell (tmsh) istnieje podatność, która może umożliwić uwierzytelnionemu atakującemu z rolą administratora zasobów wykonanie dowolnych poleceń systemowych z wyższymi uprawnieniami. Udany atak może pozwolić na przekroczenie granicy bezpieczeństwa.

When a BIG-IP AFM denial-of-service (DoS) protection profile is configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

A stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user.

On BIG-IP, undisclosed endpoints containing static non-sensitive information are accessible to an unauthenticated remote attacker through the Configuration utility. Software versions that have reached End of Technical Support (EoTS) are not evaluated.

On BIG-IP systems, undisclosed traffic can cause data corruption and unauthorized data modification in protocols that do not have message integrity protection. Note: Software versions that have reached End of Technical Support (EoTS) are not evaluated.

Under undisclosed traffic conditions and circumstances beyond the attacker's control, hardware systems with a High-Speed Bridge (HSB) may experience a lockup of the HSB. Note: Software versions that have reached End of Technical Support (EoTS) are not evaluated.

When the database variable tm.tcpudptxchecksum is configured as non-default value Software-only on a BIG-IP system, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: EoTS versions not evaluated.

When the BIG-IP Advanced WAF and ASM security policy and a server-side HTTP/2 profile are configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

When BIG-IP SSL Orchestrator explicit forward proxy is configured on a virtual server and the proxy connect feature is enabled, undisclosed traffic may cause memory corruption. Note: EoTS versions not evaluated.

When a BIG-IP Advanced WAF or BIG-IP ASM Security Policy is configured with a JSON content profile that has a malformed JSON schema, and the security policy is applied to a virtual server, undisclosed requests can cause the bd process to terminate.

When a BIG-IP APM OAuth access profile (Resource Server or Resource Client) is configured on a virtual server, undisclosed traffic can cause the apmd process to terminate.

A directory traversal vulnerability exists in TMUI that allows a highly privileged authenticated attacker to access files which are not limited to the intended files. Note: Software versions which have reached End of Technical Support are not evaluated.

W trybie Appliance, wysoko uprzywilejowany uwierzytelniony atakujący z dostępem do SCP i SFTP może być w stanie obejść ograniczenia trybu Appliance, wykorzystując nieujawnione polecenia.

When a virtual server, network address translation (NAT) object, or secure network address translation (SNAT) object uses the embedded Packet Velocity Acceleration (ePVA) feature, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.

When an iRule using an ILX::call command is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.

When the BIG-IP system is configured as both a SAML service provider (SP) and Identity Provider (IdP), with single logout (SLO) enabled on an access policy, undisclosed requests can cause an increase in memory resource utilization. Software versions which have reached End of Technical Support (EoTS) are not evaluated.

A flaw was found in Samba's vfs_streams_xattr module where uninitialized heap memory could be written into alternate data streams. This allows an authenticated user to read residual memory content that may include sensitive data, resulting in an information disclosure vulnerability.