Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-6585 State: PUBLISHED Published: 2020-03-10T19:16:17 Last Updated: 2024-08-04T20:23:22.461Z Vendors: Siemens Products: SCALANCE S602, SCALANCE S612, SCALANCE S623, SCALANCE S627-2M Problem Types: CWE-80 Description: A vulnerability has been identified in SCALANCE S602 (All versions >= V3.0 and < V4.1), SCALANCE S612 (All versions >= V3.0 and < V4.1), SCALANCE S623 (All versions >= V3.0 and < V4.1), SCALANCE S627-2M (All versions >= V3.0 and < V4.1). The integrated configuration web server of the affected devices could allow Cross-Site Scripting (XSS) attacks if unsuspecting users are tricked into accessing a malicious link. User interaction is required for a successful explo
s if unsuspecting users are tricked into accessing a malicious link. User interaction is required for a successful exploitation. The user must be logged into the web interface in order for the exploitation to succeed. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-591405.pdf - https://www.us-cert.gov/ics/advisories/icsa-20-042-10
CVE ID: CVE-2019-6588 State: PUBLISHED Published: 2019-06-03T19:43:42 Last Updated: 2024-08-04T20:23:22.090Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Liferay Portal before 7.1 CE GA4, an XSS vulnerability exists in the SimpleCaptcha API when custom code passes unsanitized input into the "url" parameter of the JSP taglib call <liferay-ui:captcha url="<%= url %>" /> or <liferay-captcha:captcha url="<%= url %>" />. Liferay Portal out-of-the-box behavior with no customizations is not vulnerable. Additional Analyst Notes: - CVE Program Container: References: - https://dev.liferay.com/web/community-security-team/known-vulnerabilities/liferay-portal-71/-/asset_publisher/7v4O7y8
- https://dev.liferay.com/web/community-security-team/known-vulnerabilities/liferay-portal-71/-/asset_publisher/7v4O7y85hZMo/content/cst-7130-multiple-xss-vulnerabilities-in-7-1-ce-ga3 - http://packetstormsecurity.com/files/153252/Liferay-Portal-7.1-CE-GA4-Cross-Site-Scripting.html
CVE ID: CVE-2019-6589 State: PUBLISHED Published: 2019-02-14T00:00:00Z Last Updated: 2024-09-16T17:03:49.000Z Vendors: F5 Networks, Inc. Products: BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator) Problem Types: XSS Description: On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.3, 12.1.0-12.1.3.7, and 11.6.0-11.6.3.2, a reflected Cross Site Scripting (XSS) vulnerability is present in an undisclosed page of the BIG-IP TMUI (Traffic Management User Interface) also known as the BIG-IP configuration utility. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K23566124
CVE ID: CVE-2019-6590 State: PUBLISHED Published: 2019-02-05T19:00:00Z Last Updated: 2024-09-16T20:17:12.562Z Vendors: F5 Networks, Inc. Products: BIG-IP (LTM) Problem Types: DoS Description: On BIG-IP LTM 13.0.0 to 13.0.1 and 12.1.0 to 12.1.3.6, under certain conditions, the TMM may consume excessive resources when processing SSL Session ID Persistence traffic. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K55101404 - http://www.securityfocus.com/bid/106942
CVE ID: CVE-2019-6591 State: PUBLISHED Published: 2019-02-05T18:00:00Z Last Updated: 2024-09-17T04:08:56.646Z Vendors: F5 Networks, Inc. Products: BIG-IP (APM) Problem Types: XSS Description: On BIG-IP APM 14.0.0 to 14.0.0.4, 13.0.0 to 13.1.1.3 and 12.1.0 to 12.1.3.7, a reflected cross-site scripting (XSS) vulnerability exists in the resource information page for authenticated users when a full webtop is configured on the BIG-IP APM system. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K32840424
CVE ID: CVE-2019-6592 State: PUBLISHED Published: 2019-02-26T15:00:00Z Last Updated: 2024-09-16T21:57:46.580Z Vendors: F5 Networks, Inc. Products: BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator) Problem Types: DoS Description: On BIG-IP 14.1.0-14.1.0.1, TMM may restart and produce a core file when validating SSL certificates in client SSL or server SSL profiles. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107176 - https://support.f5.com/csp/article/K54167061
CVE ID: CVE-2019-6593 State: PUBLISHED Published: 2019-02-26T15:00:00Z Last Updated: 2024-09-16T19:01:08.562Z Vendors: F5 Networks, Inc. Products: BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator) Problem Types: Information leakage Description: On BIG-IP 11.5.1-11.5.4, 11.6.1, and 12.1.0, a virtual server configured with a Client SSL profile may be vulnerable to a chosen ciphertext attack against CBC ciphers. When exploited, this may result in plaintext recovery of encrypted messages through a man-in-the-middle (MITM) attack, despite the attacker not having gained access to the server's private key itself. (CVE-2019-6593 also known
ITM) attack, despite the attacker not having gained access to the server's private key itself. (CVE-2019-6593 also known as Zombie POODLE and GOLDENDOODLE.) Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K10065173
CVE ID: CVE-2019-6594 State: PUBLISHED Published: 2019-02-26T15:00:00Z Last Updated: 2024-09-17T01:31:29.003Z Vendors: F5 Networks, Inc. Products: BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator) Problem Types: DoS Description: On BIG-IP 11.5.1-11.6.3.2, 12.1.3.4-12.1.3.7, 13.0.0 HF1-13.1.1.1, and 14.0.0-14.0.0.2, Multi-Path TCP (MPTCP) does not protect against multiple zero length DATA_FINs in the reassembly queue, which can lead to an infinite loop in some circumstances. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K91026261
CVE ID: CVE-2019-6595 State: PUBLISHED Published: 2019-02-26T15:00:00Z Last Updated: 2024-09-17T02:52:11.402Z Vendors: F5 Networks, Inc. Products: BIG-IP (APM) Problem Types: XSS Description: Cross-site scripting (XSS) vulnerability in F5 BIG-IP Access Policy Manager (APM) 11.5.x and 11.6.x Admin Web UI. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K31424926 - http://www.securityfocus.com/bid/107173
CVE ID: CVE-2019-6596 State: PUBLISHED Published: 2019-03-13T22:00:00Z Last Updated: 2024-09-16T17:42:59.727Z Vendors: F5 Networks, Inc. Products: BIG-IP (APM) Problem Types: DoS Description: In BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.1, 12.1.0-12.1.3.6, 11.6.1-11.6.3.2, or 11.5.1-11.5.8, when processing fragmented ClientHello messages in a DTLS session TMM may corrupt memory eventually leading to a crash. Only systems offering DTLS connections via APM are impacted. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K97241515 - http://www.securityfocus.com/bid/107403
CVE ID: CVE-2019-6597 State: PUBLISHED Published: 2019-03-13T22:00:00Z Last Updated: 2024-09-16T19:51:40.952Z Vendors: F5 Networks, Inc. Products: BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator); Enterprise Manager Problem Types: privilege escalation Description: In BIG-IP 13.0.0-13.1.1.1, 12.1.0-12.1.3.7, 11.6.1-11.6.3.2, or 11.5.1-11.5.8 or Enterprise Manager 3.1.1, when authenticated administrative users run commands in the Traffic Management User Interface (TMUI), also referred to as the BIG-IP Configuration utility, restrictions on allowed commands may not be enforced. Additional Analyst Notes: - CVE Program Container: Refer
utility, restrictions on allowed commands may not be enforced. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K29280193
CVE ID: CVE-2019-6598 State: PUBLISHED Published: 2019-03-13T22:00:00Z Last Updated: 2024-09-17T01:15:50.045Z Vendors: F5 Networks, Inc. Products: BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, WebAccelerator, WebSafe); Enterprise Manager Problem Types: DoS Description: In BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.0.7, 12.1.0-12.1.3.5, 11.6.1-11.6.3.2, or 11.5.1-11.5.8 or Enterprise Manager 3.1.1, malformed requests to the Traffic Management User Interface (TMUI), also referred to as the BIG-IP Configuration utility, may lead to disruption of TMUI services. This attack requires an authenticated user with any role (other than the No Access role). The No Ac
on of TMUI services. This attack requires an authenticated user with any role (other than the No Access role). The No Access user role cannot login and does not have the access level to perform the attack. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K44603900
CVE ID: CVE-2019-6599 State: PUBLISHED Published: 2019-03-13T22:00:00Z Last Updated: 2024-09-16T20:27:53.623Z Vendors: F5 Networks, Inc. Products: BIG-IP APM; Enterprise Manager Problem Types: XSS Description: In BIG-IP 11.6.1-11.6.3.2 or 11.5.1-11.5.8, or Enterprise Manager 3.1.1, improper escaping of values in an undisclosed page of the configuration utility may result with an improper handling on the JSON response when it is injected by a malicious script via a remote cross-site scripting (XSS) attack. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K46401178 - http://www.securityfocus.com/bid/107420
CVE ID: CVE-2019-6600 State: PUBLISHED Published: 2019-03-13T22:00:00Z Last Updated: 2024-09-16T16:53:39.325Z Vendors: F5 Networks, Inc. Products: BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator) Problem Types: XSS Description: In BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.3, 12.1.0-12.1.3.7, 11.6.1-11.6.3.2, or 11.5.1-11.5.8, when remote authentication is enabled for administrative users and all external users are granted the "guest" role, unsanitized values can be reflected to the client via the login page. This can lead to a cross-site scripting attack against unauthenticated clients. Additional Analyst Notes: - CVE Program Containe
lead to a cross-site scripting attack against unauthenticated clients. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K23734425 - http://www.securityfocus.com/bid/107470
CVE ID: CVE-2019-6601 State: PUBLISHED Published: 2019-03-13T22:00:00Z Last Updated: 2024-09-17T01:31:00.136Z Vendors: F5 Networks, Inc. Products: BIG-IP (AAM) Problem Types: privilege escalation Description: In BIG-IP 13.0.0, 12.1.0-12.1.3.7, 11.6.1-11.6.3.2, or 11.5.1-11.5.8, the Application Acceleration Manager (AAM) wamd process used in processing of images and PDFs fails to drop group permissions when executing helper scripts. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K25359902 - http://www.securityfocus.com/bid/107444
CVE ID: CVE-2019-6602 State: PUBLISHED Published: 2019-03-28T20:02:59 Last Updated: 2024-08-04T20:23:22.112Z Vendors: BIG-IP Products: BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator) Problem Types: Information disclosure Description: In BIG-IP 11.5.1-11.5.8 and 11.6.1-11.6.3, the Configuration Utility login page may not follow best security practices when handling a malicious request. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K11818407 - http://www.securityfocus.com/bid/107626
CVE ID: CVE-2019-6603 State: PUBLISHED Published: 2019-03-28T20:13:08 Last Updated: 2024-08-04T20:23:22.270Z Vendors: BIG-IP Products: BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator) Problem Types: DoS Description: In BIG-IP 11.5.1-11.5.8, 11.6.1-11.6.3, 12.1.0-12.1.3, and 13.0.0-13.0.1, malformed TCP packets sent to a self IP address or a FastL4 virtual server may cause an interruption of service. The control plane is not exposed to this issue. This issue impacts the data plane virtual servers and self IPs. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K14632915 - http://www.
itional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K14632915 - http://www.securityfocus.com/bid/107625
CVE ID: CVE-2019-6604 State: PUBLISHED Published: 2019-03-28T20:28:52 Last Updated: 2024-08-04T20:23:22.056Z Vendors: BIG-IP Products: BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator) Problem Types: DoS Description: On BIG-IP 11.5.1-11.5.8, 11.6.1-11.6.3, 12.1.0-12.1.3.6, 13.0.0-13.1.1.1, and 14.0.0-14.0.0.2, under certain conditions, hardware systems with a High-Speed Bridge and using non-default Layer 2 forwarding configurations may experience a lockup of the High-Speed Bridge. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K26455071
CVE ID: CVE-2019-6605 State: PUBLISHED Published: 2019-03-28T20:23:18 Last Updated: 2024-08-04T20:23:22.106Z Vendors: BIG-IP Products: BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator) Problem Types: DoS Description: On BIG-IP 11.5.1-11.5.8, 11.6.1-11.6.3, and 12.0.x, an undisclosed sequence of packets received by an SSL virtual server and processed by an associated Client SSL or Server SSL profile may cause a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K45353544 - http://www.securityfocus.com/bid/107629
CVE ID: CVE-2019-6606 State: PUBLISHED Published: 2019-03-28T20:34:26 Last Updated: 2024-08-04T20:23:22.214Z Vendors: BIG-IP Products: BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator) Problem Types: DoS Description: On BIG-IP 11.5.1-11.6.3.4, 12.1.0-12.1.3.7, 13.0.0-13.1.1.3, and 14.0.0-14.0.0.2, when processing certain SNMP requests with a request-id of 0, the snmpd process may leak a small amount of memory. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K35209601 - http://www.securityfocus.com/bid/107636
CVE ID: CVE-2019-6607 State: PUBLISHED Published: 2019-03-28T20:39:39 Last Updated: 2024-08-04T20:23:22.232Z Vendors: BIG-IP Products: BIG-IP (ASM) Problem Types: XSS/CSRF Description: On BIG-IP ASM 11.5.1-11.5.8, 11.6.1-11.6.3, 12.1.0-12.1.3, 13.0.0-13.1.1.3, and 14.0.0-14.0.0.2, there is a stored cross-site scripting vulnerability in an ASM violation viewed in the Configuration utility. In the worst case, an attacker can store a CSRF which results in code execution as the admin user. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K14812883 - http://www.securityfocus.com/bid/107630
CVE ID: CVE-2019-6608 State: PUBLISHED Published: 2019-03-28T20:46:53 Last Updated: 2024-08-04T20:23:22.054Z Vendors: BIG-IP Products: BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator) Problem Types: DoS Description: On BIG-IP 11.5.1-11.6.3, 12.1.0-12.1.3, 13.0.0-13.1.1.1, and 14.0.0-14.0.0.2, under certain conditions, the snmpd daemon may leak memory on a multi-blade BIG-IP vCMP guest when processing authorized SNMP requests. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K12139752
CVE ID: CVE-2019-6609 State: PUBLISHED Published: 2019-04-15T14:43:15 Last Updated: 2024-08-04T20:23:22.059Z Vendors: F5 Products: BIG-IP APM Problem Types: DoS Description: Platform dependent weakness. This issue only impacts iSeries platforms. On these platforms, in BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator) versions 14.0.0-14.1.0.1, 13.0.0-13.1.1.3, and 12.1.1 HF2-12.1.4, the secureKeyCapable attribute was not set which causes secure vault to not use the F5 hardware support to store the unit key. Instead the unit key is stored in plaintext on disk as would be the case for Z100 systems. Additionally this causes the unit ke
the unit key is stored in plaintext on disk as would be the case for Z100 systems. Additionally this causes the unit key to be stored in UCS files taken on these platforms. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K18535734
CVE ID: CVE-2019-6610 State: PUBLISHED Published: 2019-04-11T17:09:12 Last Updated: 2024-08-04T20:23:22.487Z Vendors: F5 Products: BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator) Problem Types: Information Leakage Description: On BIG-IP versions 14.0.0-14.0.0.4, 13.0.0-13.1.1.1, 12.1.0-12.1.4, 11.6.0-11.6.3.4, and 11.5.1-11.5.8, the system is vulnerable to a denial of service attack when performing URL classification. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K42465020
CVE ID: CVE-2019-6611 State: PUBLISHED Published: 2019-05-03T17:47:56 Last Updated: 2024-08-04T20:23:22.226Z Vendors: F5 Products: BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator) Problem Types: DoS Description: When BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8 are processing certain rare data sequences occurring in PPTP VPN traffic, the BIG-IP system may execute incorrect logic. The TMM may restart and produce a core file as a result of this condition. The BIG-IP system provisioned with the CGNAT module and configured with a virtual server using a PPTP profile is exposed to this vulne
tem provisioned with the CGNAT module and configured with a virtual server using a PPTP profile is exposed to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K47527163 - http://www.securityfocus.com/bid/108187
CVE ID: CVE-2019-6612 State: PUBLISHED Published: 2019-05-03T17:56:16 Last Updated: 2024-08-04T20:23:22.063Z Vendors: F5 Products: BIG-IP (LTM, AAM, AFM, APM, ASM, DNS, GTM, Link Controller, PEM) Problem Types: DoS Description: On BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8, DNS query TCP connections that are aborted before receiving a response from a DNS cache may cause TMM to restart. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K24401914 - http://www.securityfocus.com/bid/108295
CVE ID: CVE-2019-6613 State: PUBLISHED Published: 2019-05-03T18:00:17 Last Updated: 2024-08-04T20:23:22.227Z Vendors: F5 Products: BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator) Problem Types: information leakage Description: On BIG-IP 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8, SNMP may expose sensitive configuration objects over insecure transmission channels. This issue is exposed when a passphrase is used with various profile types and is accessed using SNMPv2. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K27400151 - http://www.securityfocus.com/b
es: - CVE Program Container: References: - https://support.f5.com/csp/article/K27400151 - http://www.securityfocus.com/bid/108183
CVE ID: CVE-2019-6614 State: PUBLISHED Published: 2019-05-03T19:09:12 Last Updated: 2024-08-04T20:23:22.086Z Vendors: F5 Products: BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator) Problem Types: Privilege Escalation Description: On BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, internal methods used to prevent arbitrary file overwrites in Appliance Mode were not fully effective. An authenticated attacker with a high privilege level may be able to bypass protections implemented in appliance mode to overwrite arbitrary system files. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/
erwrite arbitrary system files. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K46524395 - http://www.securityfocus.com/bid/108297
CVE ID: CVE-2019-6615 State: PUBLISHED Published: 2019-05-03T19:05:20 Last Updated: 2024-08-04T20:23:22.090Z Vendors: F5 Products: BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, WebAccelerator, WebSafe) Problem Types: Privilege Escalation Description: On BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8, Administrator and Resource Administrator roles might exploit TMSH access to bypass Appliance Mode restrictions on BIG-IP systems. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K87659521 - http://www.securityfocus.com/bid/108189
CVE ID: CVE-2019-6616 State: PUBLISHED Published: 2019-05-03T19:12:57 Last Updated: 2024-08-04T20:23:22.293Z Vendors: F5 Products: BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator) Problem Types: Privilege Escalation Description: On BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8, administrative users with TMSH access can overwrite critical system files on BIG-IP which can result in bypass of whitelist / blacklist restrictions enforced by appliance mode. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K82814400 - http://www.securityfocus.
t Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K82814400 - http://www.securityfocus.com/bid/108298
CVE ID: CVE-2019-6617 State: PUBLISHED Published: 2019-05-03T19:16:02 Last Updated: 2024-08-04T20:23:22.265Z Vendors: F5 Products: BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator) Problem Types: Privilege Escalation Description: On BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8, a user with the Resource Administrator role is able to overwrite sensitive low-level files (such as /etc/passwd) using SFTP to modify user permissions, without Advanced Shell access. This is contrary to our definition for the Resource Administrator (RA) role restrictions. Additional Analyst Notes: - CVE Program C
trary to our definition for the Resource Administrator (RA) role restrictions. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K38941195 - http://www.securityfocus.com/bid/108186 - https://github.com/mirchr/security-research/blob/master/vulnerabilities/F5/CVE-2019-6617.txt
CVE ID: CVE-2019-6618 State: PUBLISHED Published: 2019-05-03T19:28:54 Last Updated: 2024-08-04T20:23:22.269Z Vendors: F5 Products: BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator) Problem Types: Privilege Escalation Description: On BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8, users with the Resource Administrator role can modify sensitive portions of the filesystem if provided Advanced Shell Access, such as editing /etc/passwd. This allows modifications to user objects and is contrary to our definition for the Resource Administrator (RA) role restrictions. Additional Analyst Notes: -
ts and is contrary to our definition for the Resource Administrator (RA) role restrictions. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K07702240