Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-22997 State: PUBLISHED Published: 2021-03-31T17:35:54 Last Updated: 2024-08-03T18:58:26.127Z Vendors: n/a Products: BIG-IQ Problem Types: information disclosure Description: On all 7.x and 6.x versions (fixed in 8.0.0), BIG-IQ HA ElasticSearch service does not implement any form of authentication for the clustering transport services, and all data used by ElasticSearch for transport is unencrypted. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K34074377
CVE ID: CVE-2021-22998 State: PUBLISHED Published: 2021-03-31T17:37:25 Last Updated: 2024-08-03T18:58:25.985Z Vendors: n/a Products: BIG-IP Problem Types: DoS Description: On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, SYN flood protection thresholds are not enforced in secure network address translation (SNAT) listeners. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K31934524
CVE ID: CVE-2021-22999 State: PUBLISHED Published: 2021-03-31T17:29:56 Last Updated: 2024-08-03T18:58:26.073Z Vendors: n/a Products: BIG-IP Problem Types: DoS Description: On versions 15.0.x before 15.1.0 and 14.1.x before 14.1.4, the BIG-IP system provides an option to connect HTTP/2 clients to HTTP/1.x servers. When a client is slow to accept responses and it closes a connection prematurely, the BIG-IP system may indefinitely retain some streams unclosed. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K02333782
CVE ID: CVE-2021-23000 State: PUBLISHED Published: 2021-03-31T17:26:29 Last Updated: 2024-08-03T18:58:26.021Z Vendors: n/a Products: BIG-IP Problem Types: DoS Description: On BIG-IP versions 13.1.3.4-13.1.3.6 and 12.1.5.2, if the tmm.http.rfc.enforcement BigDB key is enabled in a BIG-IP system, or the Bad host header value is checked in the AFM HTTP security profile associated with a virtual server, in rare instances, a specific sequence of malicious requests may cause TMM to restart. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K34441555
CVE ID: CVE-2021-23001 State: PUBLISHED Published: 2021-03-31T17:38:53 Last Updated: 2024-08-03T18:58:26.203Z Vendors: n/a Products: BIG-IP Advanced WAF and BIG-IP ASM Problem Types: DoS Description: On versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, the upload functionality in BIG-IP Advanced WAF and BIG-IP ASM allows an authenticated user to upload files to the BIG-IP system using a call to an undisclosed iControl REST endpoint. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. Additional Analyst Notes: - CVE Program Container: References
ched End of Software Development (EoSD) are not evaluated. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K06440657
CVE ID: CVE-2021-23002 State: PUBLISHED Published: 2021-03-31T17:32:20 Last Updated: 2024-08-03T18:58:26.211Z Vendors: n/a Products: BIG-IP APM and Edge Client Problem Types: Information leakage Description: When using BIG-IP APM 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, or all 12.1.x and 11.6.x versions or Edge Client versions 7.2.1.x before 7.2.1.1, 7.1.9.x before 7.1.9.8, or 7.1.8.x before 7.1.8.5, the session ID is visible in the arguments of the f5vpn.exe command when VPN is launched from the browser on a Windows system. Addressing this issue requires both the client and server fixes. Note: Software versions which have reached End of S
em. Addressing this issue requires both the client and server fixes. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K71891773
CVE ID: CVE-2021-23003 State: PUBLISHED Published: 2021-03-31T17:28:13 Last Updated: 2024-08-03T18:58:26.173Z Vendors: n/a Products: BIG-IP Problem Types: DoS Description: On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, the Traffic Management Microkernel (TMM) process may produce a core file when undisclosed MPTCP traffic passes through a standard virtual server. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K43470422
CVE ID: CVE-2021-23004 State: PUBLISHED Published: 2021-03-31T17:40:28 Last Updated: 2024-08-03T18:58:26.267Z Vendors: n/a Products: BIG-IP Problem Types: DoS Description: On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, Multipath TCP (MPTCP) forwarding flows may be created on standard virtual servers without MPTCP enabled in the applied TCP profile. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K31025212
CVE ID: CVE-2021-23005 State: PUBLISHED Published: 2021-03-31T17:41:35 Last Updated: 2024-08-03T18:58:26.261Z Vendors: n/a Products: BIG-IQ Problem Types: DoS Description: On all 7.x and 6.x versions (fixed in 8.0.0), when using a Quorum device for BIG-IQ high availability (HA) for automatic failover, BIG-IQ does not make use of Transport Layer Security (TLS) with the Corosync protocol. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K01243064
CVE ID: CVE-2021-23006 State: PUBLISHED Published: 2021-03-31T17:44:38 Last Updated: 2024-08-03T18:58:26.280Z Vendors: n/a Products: BIG-IQ Problem Types: XSS Description: On all 7.x and 6.x versions (fixed in 8.0.0), undisclosed BIG-IQ pages have a reflected cross-site scripting vulnerability. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K30585021
CVE ID: CVE-2021-23007 State: PUBLISHED Published: 2021-03-31T17:43:02 Last Updated: 2024-08-03T18:58:26.256Z Vendors: n/a Products: BIG-IP Problem Types: DoS Description: On BIG-IP versions 14.1.4 and 16.0.1.1, when the Traffic Management Microkernel (TMM) process handles certain undisclosed traffic, it may start dropping all fragmented IP traffic. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K37451543
CVE ID: CVE-2021-23008 State: PUBLISHED Published: 2021-05-10T13:13:35 Last Updated: 2024-08-03T18:58:26.220Z Vendors: n/a Products: BIG-IP APM Problem Types: Unauthorized access Description: On version 15.1.x before 15.1.3, 14.1.x before 14.1.4, 13.1.x before 13.1.4, 12.1.x before 12.1.6, and all versions of 16.0.x and 11.6.x., BIG-IP APM AD (Active Directory) authentication can be bypassed via a spoofed AS-REP (Kerberos Authentication Service Response) response sent over a hijacked KDC (Kerberos Key Distribution Center) connection or from an AD server compromised by an attacker. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst
tacker. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K51213246
CVE ID: CVE-2021-23009 State: PUBLISHED Published: 2021-05-10T14:18:47 Last Updated: 2024-08-03T18:58:26.318Z Vendors: n/a Products: BIG-IP Problem Types: DoS Description: On BIG-IP version 16.0.x before 16.0.1.1 and 15.1.x before 15.1.3, malformed HTTP/2 requests may cause an infinite loop which causes a Denial of Service for Data Plane traffic. TMM takes the configured HA action when the TMM process is aborted. There is no control plane exposure, this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K90603426
CVE ID: CVE-2021-23010 State: PUBLISHED Published: 2021-05-10T14:24:37 Last Updated: 2024-08-03T18:58:26.361Z Vendors: n/a Products: BIG-IP ASM/Advanced WAF Problem Types: DoS Description: On versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.5, and 12.1.x before 12.1.5.3, when the BIG-IP ASM/Advanced WAF system processes WebSocket requests with JSON payloads using the default JSON Content Profile in the ASM Security Policy, the BIG-IP ASM bd process may produce a core file. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CVE Program Container: References: - https://supp
echnical Support (EoTS) are not evaluated. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K18570111
CVE ID: CVE-2021-23011 State: PUBLISHED Published: 2021-05-10T13:19:38 Last Updated: 2024-08-03T18:58:26.361Z Vendors: n/a Products: BIG-IP Problem Types: DoS Description: On versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.3, 14.1.x before 14.1.4, 13.1.x before 13.1.4, 12.1.x before 12.1.6, and 11.6.x before 11.6.5.3, when the BIG-IP system is buffering packet fragments for reassembly, the Traffic Management Microkernel (TMM) may consume an excessive amount of resources, eventually leading to a restart and failover event. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CVE Program Container: References: - https://s
f Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K10751325
CVE ID: CVE-2021-23012 State: PUBLISHED Published: 2021-05-10T14:08:13 Last Updated: 2024-08-03T18:58:26.265Z Vendors: n/a Products: BIG-IP Problem Types: Privilege escalation Description: On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.3, 14.1.x before 14.1.4, and 13.1.x before 13.1.4, lack of input validation for items used in the system support functionality may allow users granted either "Resource Administrator" or "Administrator" roles to execute arbitrary bash commands on BIG-IP. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K
are not evaluated. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K04234247
CVE ID: CVE-2021-23013 State: PUBLISHED Published: 2021-05-10T13:28:10 Last Updated: 2024-08-03T18:58:26.244Z Vendors: n/a Products: BIG-IP Problem Types: DoS Description: On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.3, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, the Traffic Management Microkernel (TMM) may stop responding when processing Stream Control Transmission Protocol (SCTP) traffic under certain conditions. This vulnerability affects TMM by way of a virtual server configured with an SCTP profile. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CVE Program Container
which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K04234247
CVE ID: CVE-2021-23014 State: PUBLISHED Published: 2021-05-10T14:35:28 Last Updated: 2024-08-03T18:58:26.361Z Vendors: n/a Products: BIG-IP ASM/Advanced WAF Problem Types: data integrity Description: On versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.3, and 14.1.x before 14.1.4, BIG-IP Advanced WAF and ASM are missing authorization checks for file uploads to a specific directory within the REST API which might allow Authenticated users with guest privileges to upload files. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K23203045
CVE ID: CVE-2021-23015 State: PUBLISHED Published: 2021-05-10T14:40:14 Last Updated: 2024-08-03T18:58:26.359Z Vendors: n/a Products: BIG-IP Problem Types: Privilege escalation Description: On BIG-IP 15.1.x before 15.1.3, 14.1.x before 14.1.4.2, 13.1.0.8 through 13.1.3.6, and all versions of 16.0.x, when running in Appliance Mode, an authenticated user assigned the 'Administrator' role may be able to bypass Appliance Mode restrictions utilizing undisclosed iControl REST endpoints. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K74151369
CVE ID: CVE-2021-23016 State: PUBLISHED Published: 2021-05-10T14:44:38 Last Updated: 2024-08-03T18:58:26.272Z Vendors: n/a Products: BIG-IP APM Problem Types: data leakage Description: On BIG-IP APM versions 15.1.x before 15.1.3, 14.1.x before 14.1.4.1, 13.1.x before 13.1.4, and all versions of 16.0.x, 12.1.x, and 11.6.x, an attacker may be able to bypass APM's internal restrictions and retrieve static content that is hosted within APM by sending specifically crafted requests to an APM Virtual Server. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article
) are not evaluated. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K75540265
CVE ID: CVE-2021-23017 State: PUBLISHED Published: 2021-06-01T12:28:09 Last Updated: 2024-08-03T18:58:26.413Z Vendors: n/a Products: Nginx Web Server, Nginx Plus Problem Types: CWE-193 Description: A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process crash or potential other impact. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K12331123%2C - http://mailman.nginx.org/pipermail/nginx-announce/2021/000300.html - https://lists.apache.org/thread.html/r6fc5c57b38e93e36213e9a18c8a4e5dbd5ced1c7e57f08a1735
nx-announce/2021/000300.html - https://lists.apache.org/thread.html/r6fc5c57b38e93e36213e9a18c8a4e5dbd5ced1c7e57f08a1735975ba%40%3Cnotifications.apisix.apache.org%3E - https://lists.apache.org/thread.html/r37e6b2165f7c910d8e15fd54f4697857619ad2625f56583802004009%40%3Cnotifications.apisix.apache.org%3E - https://lists.apache.org/thread.html/rf318aeeb4d7a3a312734780b47de83cefb7e6995da0b2cae5c28675c%40%3Cnotifications.apisix.apache.org%3E - https://lists.apache.org/thread.html/r4d4966221ca399ce948ef34884652265729d7d9ef8179c78d7f17e7f%40%3Cnotifications.apisix.apache.org%3E - https://lists.apache.org/thread.html/rf232eecd47fdc44520192810560303073cefd684b321f85e311bad31%40%3Cnotifications.apisix.
ttps://lists.apache.org/thread.html/rf232eecd47fdc44520192810560303073cefd684b321f85e311bad31%40%3Cnotifications.apisix.apache.org%3E - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GNKOP2JR5L7KCIZTJRZDCUPJTUONMC5I/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7SFVYHC7OXTEO4SMBWXDVK6E5IMEYMEE/ - https://www.oracle.com/security-alerts/cpuoct2021.html - https://security.netapp.com/advisory/ntap-20210708-0006/ - https://www.oracle.com/security-alerts/cpujan2022.html - https://www.oracle.com/security-alerts/cpuapr2022.html - http://packetstormsecurity.com/files/167720/Nginx-1.20.0-Denial-Of-S
://www.oracle.com/security-alerts/cpuapr2022.html - http://packetstormsecurity.com/files/167720/Nginx-1.20.0-Denial-Of-Service.html
CVE ID: CVE-2021-23018 State: PUBLISHED Published: 2021-06-01T11:51:20 Last Updated: 2024-08-03T18:58:26.256Z Vendors: n/a Products: Nginx Controller Problem Types: CWE-319 Description: Intra-cluster communication does not use TLS. The services within the NGINX Controller 3.x before 3.4.0 namespace are using cleartext protocols inside the cluster. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K97002210
CVE ID: CVE-2021-23019 State: PUBLISHED Published: 2021-06-01T12:03:42 Last Updated: 2024-08-03T18:58:26.261Z Vendors: n/a Products: Nginx Controller Problem Types: CWE-201 Description: The NGINX Controller 2.0.0 thru 2.9.0 and 3.x before 3.15.0 Administrator password may be exposed in the systemd.txt file that is included in the NGINX support package. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K04884013
CVE ID: CVE-2021-23020 State: PUBLISHED Published: 2021-06-01T12:14:39 Last Updated: 2024-08-03T18:58:26.279Z Vendors: n/a Products: Nginx Controller Problem Types: CWE-330 Description: The NAAS 3.x before 3.10.0 API keys were generated using an insecure pseudo-random string and hashing algorithm which could lead to predictable keys. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K45263486
CVE ID: CVE-2021-23021 State: PUBLISHED Published: 2021-06-01T12:23:35 Last Updated: 2024-08-03T18:58:26.217Z Vendors: n/a Products: Nginx Controller Problem Types: CWE-732 Description: The Nginx Controller 3.x before 3.7.0 agent configuration file /etc/controller-agent/agent.conf is world readable with current permission bits set to 644. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K36926027
CVE ID: CVE-2021-23022 State: PUBLISHED Published: 2021-06-10T15:06:40 Last Updated: 2024-08-03T18:58:26.264Z Vendors: n/a Products: Edge Client for Windows Problem Types: privilege escalation Description: On version 7.2.1.x before 7.2.1.3 and 7.1.x before 7.1.9.9 Update 1, the BIG-IP Edge Client Windows Installer Service's temporary folder has weak file and folder permissions. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K08503505
CVE ID: CVE-2021-23023 State: PUBLISHED Published: 2021-06-10T14:43:41 Last Updated: 2024-08-03T18:58:26.263Z Vendors: n/a Products: Edge Client for Windows Problem Types: privilege escalation Description: On version 7.2.1.x before 7.2.1.3 and 7.1.x before 7.1.9.9 Update 1, a DLL hijacking issue exists in cachecleaner.dll included in the BIG-IP Edge Client Windows Installer. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K33757590
CVE ID: CVE-2021-23024 State: PUBLISHED Published: 2021-06-10T14:35:08 Last Updated: 2024-08-03T18:58:26.279Z Vendors: n/a Products: BIG-IQ Problem Types: remote command execution Description: On version 8.0.x before 8.0.0.1, and all 6.x and 7.x versions, the BIG-IQ Configuration utility has an authenticated remote command execution vulnerability in undisclosed pages. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K06024431 - http://packetstormsecurity.com/files/163264/F5-BIG-IQ-VE-8.0.0-2923215-Remote-Root.html
CVE ID: CVE-2021-23025 State: PUBLISHED Published: 2021-09-14T20:57:40 Last Updated: 2024-08-03T18:58:26.365Z Vendors: n/a Products: BIG-IP Problem Types: CWE-78 Description: On version 15.1.x before 15.1.0.5, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.5, and all versions of 12.1.x and 11.6.x, an authenticated remote command execution vulnerability exists in the BIG-IP Configuration utility. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K55543151
CVE ID: CVE-2021-23026 State: PUBLISHED Published: 2021-09-14T21:57:17 Last Updated: 2024-08-03T18:58:26.191Z Vendors: n/a Products: BIG-IP & BIG-IQ Problem Types: CWE-352 Description: BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4.2, 13.1.x before 13.1.4.1, and all versions of 12.1.x and 11.6.x and all versions of BIG-IQ 8.x, 7.x, and 6.x are vulnerable to cross-site request forgery (CSRF) attacks through iControl SOAP. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K53854428
CVE ID: CVE-2021-23027 State: PUBLISHED Published: 2021-09-14T21:48:01 Last Updated: 2024-08-03T18:58:26.269Z Vendors: n/a Products: BIG-IP Problem Types: CWE-79 Description: On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, and 14.1.x before 14.1.4.3, a DOM based cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to execute JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K24301698
CVE ID: CVE-2021-23028 State: PUBLISHED Published: 2021-09-14T20:53:54 Last Updated: 2024-08-03T18:58:26.283Z Vendors: n/a Products: BIG-IP Advanced WAF and BIG-IP ASM Problem Types: CWE-20 Description: On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.2, and 13.1.x before 13.1.4, when JSON content profiles are configured for URLs as part of an F5 Advanced Web Application Firewall (WAF)/BIG-IP ASM security policy and applied to a virtual server, undisclosed requests may cause the BIG-IP ASM bd process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CVE Program Container: Refe
have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K00602225
CVE ID: CVE-2021-23029 State: PUBLISHED Published: 2021-09-14T22:01:56 Last Updated: 2024-08-03T18:58:26.227Z Vendors: n/a Products: BIG-IP Advanced WAF and BIG-IP ASM Problem Types: CWE-918 Description: On version 16.0.x before 16.0.1.2, insufficient permission checks may allow authenticated users with guest privileges to perform Server-Side Request Forgery (SSRF) attacks through F5 Advanced Web Application Firewall (WAF) and the BIG-IP ASM Configuration utility. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K52420610