Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
e CMS Security team CVSS scoring: 7.1 AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:HCredit for discovery: "Adrian Tiron from FORTBRIDGE ( https://www.fortbridge.co.uk/ )"This fix is also in Concrete version 9.0.0 Additional Analyst Notes: - CVE Program Container: References: - https://documentation.concretecms.org/developers/introduction/version-history/857-release-notes - https://hackerone.com/reports/1362747
CVE ID: CVE-2021-22967 State: PUBLISHED Published: 2021-11-19T18:11:07 Last Updated: 2024-08-03T18:58:26.112Z Vendors: n/a Products: https://github.com/concrete5/concrete5 Problem Types: CWE-639 Description: In Concrete CMS (formerly concrete 5) below 8.5.7, IDOR Allows Unauthenticated User to Access Restricted Files If Allowed to Add Message to a Conversation.To remediate this, a check was added to verify a user has permissions to view files before attaching the files to a message in "add / edit message”.Concrete CMS security team gave this a CVSS v3.1 score of 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NCredit for discovery Adrian H Additional Analyst Notes: - CVE Program Container: References:
:L/PR:L/UI:N/S:U/C:L/I:N/A:NCredit for discovery Adrian H Additional Analyst Notes: - CVE Program Container: References: - https://documentation.concretecms.org/developers/introduction/version-history/857-release-notes - https://hackerone.com/reports/869612
CVE ID: CVE-2021-22968 State: PUBLISHED Published: 2021-11-19T18:11:35 Last Updated: 2024-08-03T18:58:25.951Z Vendors: n/a Products: https://github.com/concrete5/concrete5 Problem Types: CWE-98 Description: A bypass of adding remote files in Concrete CMS (previously concrete5) File Manager leads to remote code execution in Concrete CMS (concrete5) versions 8.5.6 and below.The external file upload feature stages files in the public directory even if they have disallowed file extensions. They are stored in a directory with a random name, but it's possible to stall the uploads and brute force the directory name. You have to be an admin with the ability to upload files, but this bug gives you th
and brute force the directory name. You have to be an admin with the ability to upload files, but this bug gives you the ability to upload restricted file types and execute them depending on server configuration.To fix this, a check for allowed file extensions was added before downloading files to a tmp directory.Concrete CMS Security Team gave this a CVSS v3.1 score of 5.4 AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:H/A:NThis fix is also in Concrete version 9.0.0 Additional Analyst Notes: - CVE Program Container: References: - https://documentation.concretecms.org/developers/introduction/version-history/857-release-notes - https://hackerone.com/reports/1350444
CVE ID: CVE-2021-22969 State: PUBLISHED Published: 2021-11-19T18:08:30 Last Updated: 2024-08-03T18:58:26.146Z Vendors: n/a Products: https://github.com/concrete5/concrete5 Problem Types: CWE-918 Description: Concrete CMS (formerly concrete5) versions below 8.5.7 has a SSRF mitigation bypass using DNS Rebind attack giving an attacker the ability to fetch cloud IAAS (ex AWS) IAM keys.To fix this Concrete CMS no longer allows downloads from the local network and specifies the validated IP when downloading rather than relying on DNS.Discoverer: Adrian Tiron from FORTBRIDGE ( https://www.fortbridge.co.uk/ )The Concrete CMS team gave this a CVSS 3.1 score of 3.5 AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
tps://www.fortbridge.co.uk/ )The Concrete CMS team gave this a CVSS 3.1 score of 3.5 AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N . Please note that Cloud IAAS provider mis-configurations are not Concrete CMS vulnerabilities. A mitigation for this vulnerability is to make sure that the IMDS configurations are according to a cloud provider's best practices.This fix is also in Concrete version 9.0.0 Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1369312 - https://documentation.concretecms.org/developers/introduction/version-history/857-release-notes
CVE ID: CVE-2021-22970 State: PUBLISHED Published: 2021-11-19T18:08:53 Last Updated: 2024-08-03T18:58:25.986Z Vendors: n/a Products: https://github.com/concrete5/concrete5 Problem Types: CWE-918 Description: Concrete CMS (formerly concrete5) versions 8.5.6 and below and version 9.0.0 allow local IP importing causing the system to be vulnerable toa. SSRF attacks on the private LAN servers by reading files from the local LAN. An attacker can pivot in the private LAN and exploit local network appsandb. SSRF Mitigation Bypass through DNS RebindingConcrete CMS security team gave this a CVSS score of 3.5 AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:NConcrete CMS is maintaining Concrete version 8.5.x until 1
this a CVSS score of 3.5 AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:NConcrete CMS is maintaining Concrete version 8.5.x until 1 May 2022 for security fixes.This CVE is shared with HackerOne Reports https://hackerone.com/reports/1364797 and https://hackerone.com/reports/1360016Reporters: Adrian Tiron from FORTBRIDGE (https://www.fortbridge.co.uk/ ) and Bipul Jaiswal Additional Analyst Notes: - CVE Program Container: References: - https://documentation.concretecms.org/developers/introduction/version-history/857-release-notes - https://hackerone.com/reports/1364797 - https://documentation.concretecms.org/developers/introduction/version-history/901-release-notes
CVE ID: CVE-2021-22973 State: PUBLISHED Published: 2021-02-12T16:05:46 Last Updated: 2024-08-03T18:58:26.165Z Vendors: n/a Products: BIG-IP Problem Types: DoS Description: On BIG-IP version 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.5, and all 12.1.x versions, JSON parser function does not protect against out-of-bounds memory accesses or writes. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K13323323
CVE ID: CVE-2021-22974 State: PUBLISHED Published: 2021-02-12T16:23:27 Last Updated: 2024-08-03T18:58:25.916Z Vendors: n/a Products: BIG-IP, BIG-IQ Problem Types: Privilege escalation Description: On BIG-IP version 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, and 13.1.x before 13.1.3.6 and all versions of BIG-IQ 7.x and 6.x, an authenticated attacker with access to iControl REST over the control plane may be able to take advantage of a race condition to execute commands with an elevated privilege level. This vulnerability is due to an incomplete fix for CVE-2017-6167. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. Add
for CVE-2017-6167. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K68652018
CVE ID: CVE-2021-22975 State: PUBLISHED Published: 2021-02-12T16:02:21 Last Updated: 2024-08-03T18:58:26.116Z Vendors: n/a Products: BIG-IP Problem Types: DoS Description: On BIG-IP version 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, and 14.1.x before 14.1.3.1, under some circumstances, Traffic Management Microkernel (TMM) may restart on the BIG-IP system while passing large bursts of traffic. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K21971977
CVE ID: CVE-2021-22976 State: PUBLISHED Published: 2021-02-12T17:43:49 Last Updated: 2024-08-03T18:58:26.167Z Vendors: n/a Products: BIG-IP Advanced WAF & BIG-IP ASM Problem Types: DoS Description: On BIG-IP Advanced WAF and ASM version 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.6, and all 12.1.x versions, when the BIG-IP ASM system processes WebSocket requests with JSON payloads, an unusually large number of parameters can cause excessive CPU usage in the BIG-IP ASM bd process. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. Additional Analyst Notes: - CVE Program Container: References: - https:
f Software Development (EoSD) are not evaluated. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K88230177
CVE ID: CVE-2021-22977 State: PUBLISHED Published: 2021-02-12T19:23:48 Last Updated: 2024-08-03T18:58:26.196Z Vendors: n/a Products: BIG-IP Problem Types: DoS Description: On BIG-IP version 16.0.0-16.0.1 and 14.1.2.4-14.1.3, cooperation between malicious HTTP client code and a malicious server may cause TMM to restart and generate a core file. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K14693346
CVE ID: CVE-2021-22978 State: PUBLISHED Published: 2021-02-12T19:18:12 Last Updated: 2024-08-03T18:58:26.256Z Vendors: n/a Products: BIG-IP Problem Types: XSS Description: On BIG-IP version 16.0.x before 16.0.1, 15.1.x before 15.1.1, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.5, and all 12.1.x and 11.6.x versions, undisclosed endpoints in iControl REST allow for a reflected XSS attack, which could lead to a complete compromise of BIG-IP if the victim user is granted the admin role. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K87502622
CVE ID: CVE-2021-22979 State: PUBLISHED Published: 2021-02-12T17:55:15 Last Updated: 2024-08-03T18:58:26.161Z Vendors: n/a Products: BIG-IP Problem Types: XSS Description: On BIG-IP version 16.0.x before 16.0.1, 15.1.x before 15.1.1, 14.1.x before 14.1.2.8, 13.1.x before 13.1.3.5, and all 12.1.x versions, a reflected Cross-Site Scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility when Fraud Protection Service is provisioned and allows an attacker to execute JavaScript in the context of the current logged-in user. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. Additional Analyst Notes: - CVE Program C
sions which have reached End of Software Development (EoSD) are not evaluated. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K63497634
CVE ID: CVE-2021-22980 State: PUBLISHED Published: 2021-02-12T17:52:28 Last Updated: 2024-08-03T18:58:26.052Z Vendors: n/a Products: Edge Client Problem Types: Code injection Description: In Edge Client version 7.2.x before 7.2.1.1, 7.1.9.x before 7.1.9.8, and 7.1.x-7.1.8.x before 7.1.8.5, an untrusted search path vulnerability in the BIG-IP APM Client Troubleshooting Utility (CTU) for Windows could allow an attacker to load a malicious DLL library from its current directory. User interaction is required to exploit this vulnerability in that the victim must run this utility on the Windows system. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
on the Windows system. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K29282483
CVE ID: CVE-2021-22981 State: PUBLISHED Published: 2021-02-12T17:50:21 Last Updated: 2024-08-03T18:58:26.095Z Vendors: n/a Products: BIG-IP Problem Types: MitM Description: On all versions of BIG-IP 12.1.x and 11.6.x, the original TLS protocol includes a weakness in the master secret negotiation that is mitigated by the Extended Master Secret (EMS) extension defined in RFC 7627. TLS connections that do not use EMS are vulnerable to man-in-the-middle attacks during renegotiation. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K09121542
CVE ID: CVE-2021-22982 State: PUBLISHED Published: 2021-02-12T17:46:11 Last Updated: 2024-08-03T18:58:26.048Z Vendors: n/a Products: BIG-IP DNS and GTM Problem Types: DoS Description: On BIG-IP DNS and GTM version 13.1.x before 13.1.0.4, and all versions of 12.1.x and 11.6.x, big3d does not securely handle and parse certain payloads resulting in a buffer overflow. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K72708443
CVE ID: CVE-2021-22983 State: PUBLISHED Published: 2021-02-12T17:57:08 Last Updated: 2024-08-03T18:58:26.357Z Vendors: n/a Products: BIG-IP AFM Problem Types: XSS Description: On BIG-IP AFM version 15.1.x before 15.1.1, 14.1.x before 14.1.3.1, and 13.1.x before 13.1.3.5, authenticated users accessing the Configuration utility for AFM are vulnerable to a cross-site scripting attack if they attempt to access a maliciously-crafted URL. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K76518456
CVE ID: CVE-2021-22984 State: PUBLISHED Published: 2021-02-12T19:21:56 Last Updated: 2024-08-03T18:58:26.040Z Vendors: n/a Products: BIG-IP Advanced WAF & BIG-IP ASM Problem Types: open redirection Description: On BIG-IP Advanced WAF and ASM version 15.1.x before 15.1.0.2, 15.0.x before 15.0.1.4, 14.1.x before 14.1.2.5, 13.1.x before 13.1.3.4, 12.1.x before 12.1.5.2, and 11.6.x before 11.6.5.2, when receiving a unauthenticated client request with a maliciously crafted URI, a BIG-IP Advanced WAF or ASM virtual server configured with a DoS profile with Proactive Bot Defense (versions prior to 14.1.0), or a Bot Defense profile (versions 14.1.0 and later), may subject clients and web servers to
versions prior to 14.1.0), or a Bot Defense profile (versions 14.1.0 and later), may subject clients and web servers to Open Redirection attacks. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K33440533
CVE ID: CVE-2021-22985 State: PUBLISHED Published: 2021-02-12T17:48:22 Last Updated: 2024-08-03T18:58:26.303Z Vendors: n/a Products: BIG-IP APM Problem Types: DoS Description: On BIG-IP APM version 16.0.x before 16.0.1.1, under certain conditions, when processing VPN traffic with APM, TMM consumes excessive memory. A malicious, authenticated VPN user may abuse this to perform a DoS attack against the APM. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K88162221
CVE ID: CVE-2021-22986 State: PUBLISHED Published: 2021-03-31T14:04:47.000Z Last Updated: 2025-10-21T23:25:50.810Z Vendors: n/a Products: BIG-IP; BIG-IQ Problem Types: Remote Command Execution Description: On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3 amd BIG-IQ 7.1.0.x before 7.1.0.3 and 7.0.0.x before 7.0.0.2, the iControl REST interface has an unauthenticated remote command execution vulnerability. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://suppor
not evaluated. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.f5.com/csp/article/K03009991 - http://packetstormsecurity.com/files/162059/F5-iControl-Server-Side-Request-Forgery-Remote-Command-Execution.html - http://packetstormsecurity.com/files/162066/F5-BIG-IP-16.0.x-Remote-Code-Execution.html
CVE ID: CVE-2021-22987 State: PUBLISHED Published: 2021-03-31T16:43:17 Last Updated: 2024-08-03T18:58:26.167Z Vendors: n/a Products: BIG-IP Appliance Mode Problem Types: Remote Command Execution Description: On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3 when running in Appliance mode, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has an authenticated remote command execution vulnerability in undisclosed pages. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. Additional Analyst Notes
ote: Software versions which have reached End of Software Development (EoSD) are not evaluated. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K18132488
CVE ID: CVE-2021-22988 State: PUBLISHED Published: 2021-03-31T14:03:11 Last Updated: 2024-08-03T18:58:26.037Z Vendors: n/a Products: BIG-IP Problem Types: RCE Description: On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, TMUI, also referred to as the Configuration utility, has an authenticated remote command execution vulnerability in undisclosed pages. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K70031188
CVE ID: CVE-2021-22989 State: PUBLISHED Published: 2021-03-31T16:48:26 Last Updated: 2024-08-03T18:58:26.045Z Vendors: n/a Products: BIG-IP Advanced WAF or BIG-IP ASM in Appliance Mode Problem Types: RCE Description: On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, when running in Appliance mode with Advanced WAF or BIG-IP ASM provisioned, the TMUI, also referred to as the Configuration utility, has an authenticated remote command execution vulnerability in undisclosed pages. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. Additi
disclosed pages. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K56142644
CVE ID: CVE-2021-22990 State: PUBLISHED Published: 2021-03-31T16:44:38 Last Updated: 2024-08-03T18:58:26.239Z Vendors: n/a Products: BIG-IP Advanced WAF or BIG-IP ASM Problem Types: RCE Description: On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, on systems with Advanced WAF or BIG-IP ASM provisioned, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has an authenticated remote command execution vulnerability in undisclosed pages. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. Addition
sclosed pages. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K45056101
CVE ID: CVE-2021-22991 State: PUBLISHED Published: 2021-03-31T17:23:14.000Z Last Updated: 2025-10-21T23:25:50.646Z Vendors: n/a Products: BIG-IP Problem Types: RCE Description: On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, undisclosed requests to a virtual server may be incorrectly handled by the Traffic Management Microkernel (TMM) URI normalization, which may trigger a buffer overflow, resulting in a DoS attack. In certain situations, it may theoretically allow bypass of URL based access control or remote code execution (RCE). Note: Software versions which have reached End of Software Development
ed access control or remote code execution (RCE). Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.f5.com/csp/article/K56715231
CVE ID: CVE-2021-22992 State: PUBLISHED Published: 2021-03-31T16:47:05 Last Updated: 2024-08-03T18:58:26.166Z Vendors: n/a Products: BIG-IP Advanced WAF and BIG-IP ASM Problem Types: RCE Description: On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, a malicious HTTP response to an Advanced WAF/BIG-IP ASM virtual server with Login Page configured in its policy may trigger a buffer overflow, resulting in a DoS attack. In certain situations, it may allow remote code execution (RCE), leading to complete system compromise. Note: Software versions which have reached End of Software De
de execution (RCE), leading to complete system compromise. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K52510511
CVE ID: CVE-2021-22993 State: PUBLISHED Published: 2021-03-31T17:45:51 Last Updated: 2024-08-03T18:58:26.022Z Vendors: n/a Products: BIG-IP Advanced WAF and BIG-IP ASM Problem Types: XSS Description: On BIG-IP Advanced WAF and BIG-IP ASM versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, DOM-based XSS on DoS Profile properties page. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K55237223
CVE ID: CVE-2021-22994 State: PUBLISHED Published: 2021-03-31T17:25:07 Last Updated: 2024-08-03T18:58:26.111Z Vendors: n/a Products: BIG-IP Problem Types: XSS Description: On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, undisclosed endpoints in iControl REST allow for a reflected XSS attack, which could lead to a complete compromise of the BIG-IP system if the victim user is granted the admin role. This vulnerability is due to an incomplete fix for CVE-2020-5948. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. Additional Analyst
948. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K66851119
CVE ID: CVE-2021-22995 State: PUBLISHED Published: 2021-03-31T16:45:54 Last Updated: 2024-08-03T18:58:26.170Z Vendors: n/a Products: BIG-IQ Problem Types: DoS Description: On all 7.x and 6.x versions (fixed in 8.0.0), BIG-IQ high availability (HA) when using a Quorum device for automatic failover does not implement any form of authentication with the Corosync daemon. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K13155201
CVE ID: CVE-2021-22996 State: PUBLISHED Published: 2021-03-31T17:34:21 Last Updated: 2024-08-03T18:58:26.169Z Vendors: n/a Products: BIG-IQ Problem Types: DoS Description: On all 7.x versions (fixed in 8.0.0), when set up for auto failover, a BIG-IQ Data Collection Device (DCD) cluster member that receives an undisclosed message may cause the corosync process to abort. This behavior may lead to a denial-of-service (DoS) and impact the stability of a BIG-IQ high availability (HA) cluster. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K16352404