Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
rafted POST request to <vimbadmin directory>/application/controllers/AliasController.php, or (8) remove an alias address via a crafted GET request to <vimbadmin directory>/application/controllers/AliasController.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/41967/ - http://www.openwall.com/lists/oss-security/2017/05/03/7
CVE ID: CVE-2017-6087 State: PUBLISHED Published: 2017-03-24T14:00:00 Last Updated: 2024-08-05T15:18:49.892Z Vendors: n/a Products: n/a Problem Types: n/a Description: EyesOfNetwork ("EON") 5.0 and earlier allows remote authenticated users to execute arbitrary code via shell metacharacters in the selected_events[] parameter in the (1) acknowledge, (2) delete, or (3) ownDisown function in module/monitoring_ged/ged_functions.php or the (4) module parameter to module/index.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2017/03/23/5 - https://github.com/EyesOfNetworkCommunity/eonweb/commit/196729cc045ef93ceeddd1de505a1de8f9cdf74d
ecurity/2017/03/23/5 - https://github.com/EyesOfNetworkCommunity/eonweb/commit/196729cc045ef93ceeddd1de505a1de8f9cdf74d - https://www.exploit-db.com/exploits/41746/ - https://sysdream.com/news/lab/2017-03-14-cve-2017-6087-eon-5-0-remote-code-execution/ - http://www.securityfocus.com/bid/97109
CVE ID: CVE-2017-6088 State: PUBLISHED Published: 2017-04-11T18:00:00 Last Updated: 2024-08-05T15:18:49.763Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in EyesOfNetwork (aka EON) 5.0 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) bp_name, (2) display, (3) search, or (4) equipment parameter to module/monitoring_ged/ged_functions.php or the (5) type parameter to monitoring_ged/ajax.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/41747/ - http://www.openwall.com/lists/oss-security/2017/03/23/4 - https://sysdream.com/news/lab/2017-03-14-cve-
xploits/41747/ - http://www.openwall.com/lists/oss-security/2017/03/23/4 - https://sysdream.com/news/lab/2017-03-14-cve-2017-6088-eon-5-0-multiple-sql-injection/ - http://www.securityfocus.com/bid/97084
CVE ID: CVE-2017-6089 State: PUBLISHED Published: 2017-10-02T17:00:00 Last Updated: 2024-08-05T15:18:49.879Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in PhpCollab 2.5.1 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) project or id parameters to topics/deletetopics.php; the (2) id parameter to bookmarks/deletebookmarks.php; or the (3) id parameter to calendar/deletecalendar.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/42935/ - https://sysdream.com/news/lab/2017-09-29-cve-2017-6089-phpcollab-2-5-1-multiple-sql-injections-unauthenticated/
CVE ID: CVE-2017-6090 State: PUBLISHED Published: 2017-10-02T17:00:00 Last Updated: 2024-08-05T15:18:49.757Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unrestricted file upload vulnerability in clients/editclient.php in PhpCollab 2.5.1 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in logos_clients/. Additional Analyst Notes: - CVE Program Container: References: - https://sysdream.com/news/lab/2017-09-29-cve-2017-6090-phpcollab-2-5-1-arbitrary-file-upload-unauthenticated/ - https://www.exploit-db.com/exploits/42934/ - https://www.exploit-db.com/exploit
arbitrary-file-upload-unauthenticated/ - https://www.exploit-db.com/exploits/42934/ - https://www.exploit-db.com/exploits/43519/
CVE ID: CVE-2017-6094 State: PUBLISHED Published: 2017-12-20T20:00:00 Last Updated: 2024-08-05T15:18:49.781Z Vendors: n/a Products: n/a Problem Types: n/a Description: CPEs used by subscribers on the access network receive their individual configuration settings from a central GAPS instance. A CPE identifies itself by the MAC address of its WAN interface and a certain "chk" value (48bit) derived from the MAC. The algorithm used to compute the "chk" was disclosed by reverse engineering the CPE's firmware. As a result, it is possible to forge valid "chk" values for any given MAC address and therefore receive the configuration settings of other subscribers' CPEs. The configuration settings ofte
MAC address and therefore receive the configuration settings of other subscribers' CPEs. The configuration settings often contain sensitive values, for example credentials (username/password) for VoIP services. This issue affects Genexis B.V. GAPS up to 7.2. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2017/Dec/62
CVE ID: CVE-2017-6095 State: PUBLISHED Published: 2017-02-21T07:46:00 Last Updated: 2024-08-05T15:18:49.676Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection issue was discovered in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects /inc/lists/csvexport.php (Unauthenticated) with the GET Parameter: list_id. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/8740 - https://github.com/hamkovic/Mail-Masta-Wordpress-Plugin - https://www.exploit-db.com/exploits/41438/
CVE ID: CVE-2017-6096 State: PUBLISHED Published: 2017-02-21T07:46:00 Last Updated: 2024-08-05T15:18:49.673Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection issue was discovered in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects /inc/lists/view-list.php (Requires authentication to Wordpress admin) with the GET Parameter: filter_list. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/8740 - https://github.com/hamkovic/Mail-Masta-Wordpress-Plugin - https://www.exploit-db.com/exploits/41438/
CVE ID: CVE-2017-6097 State: PUBLISHED Published: 2017-02-21T07:46:00 Last Updated: 2024-08-05T15:18:49.876Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection issue was discovered in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects /inc/campaign/count_of_send.php (Requires authentication to Wordpress admin) with the POST Parameter: camp_id. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/8740 - https://github.com/hamkovic/Mail-Masta-Wordpress-Plugin - https://www.exploit-db.com/exploits/41438/
CVE ID: CVE-2017-6098 State: PUBLISHED Published: 2017-02-21T07:46:00 Last Updated: 2024-08-05T15:18:49.814Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection issue was discovered in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects /inc/campaign_save.php (Requires authentication to Wordpress admin) with the POST Parameter: list_id. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/8740 - https://github.com/hamkovic/Mail-Masta-Wordpress-Plugin - https://www.exploit-db.com/exploits/41438/
CVE ID: CVE-2017-6099 State: PUBLISHED Published: 2017-02-23T21:00:00 Last Updated: 2024-08-05T15:18:49.780Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in GetAuthDetails.html.php in PayPal PHP Merchant SDK (aka merchant-sdk-php) 3.9.1 allows remote attackers to inject arbitrary web script or HTML via the token parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/96432 - https://github.com/paypal/merchant-sdk-php/issues/129
CVE ID: CVE-2017-6100 State: PUBLISHED Published: 2017-02-23T19:00:00 Last Updated: 2024-08-05T15:18:49.671Z Vendors: n/a Products: n/a Problem Types: n/a Description: tcpdf before 6.2.0 uploads files from the server generating PDF-files to an external FTP. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2017/02/19/1 - https://sourceforge.net/p/tcpdf/bugs/1005/ - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=814030
CVE ID: CVE-2017-6102 State: PUBLISHED Published: 2017-03-02T22:00:00 Last Updated: 2024-08-05T15:18:49.655Z Vendors: blairjordan Products: wordpress plugin rockhoist-badges Problem Types: XSS Description: Persistent XSS in wordpress plugin rockhoist-badges v1.2.2. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/8763 - http://www.securityfocus.com/bid/96533 - http://www.vapidlabs.com/advisory.php?v=176
CVE ID: CVE-2017-6103 State: PUBLISHED Published: 2017-03-02T22:00:00 Last Updated: 2024-08-05T15:18:49.841Z Vendors: matt_dev Products: Wordpress plugin AnyVar Problem Types: XSS Description: Persistent XSS Vulnerability in Wordpress plugin AnyVar v0.1.1. Additional Analyst Notes: - CVE Program Container: References: - http://www.vapidlabs.com/advisory.php?v=177 - http://www.securityfocus.com/bid/96532
CVE ID: CVE-2017-6104 State: PUBLISHED Published: 2017-03-02T22:00:00 Last Updated: 2024-08-05T15:18:49.765Z Vendors: zendkmobileapp Products: Wordpress Plugin Mobile App Native 3.0 Problem Types: file upload Description: Remote file upload vulnerability in Wordpress Plugin Mobile App Native 3.0. Additional Analyst Notes: - CVE Program Container: References: - http://www.vapidlabs.com/advisory.php?v=178 - https://wpvulndb.com/vulnerabilities/8743 - http://www.securityfocus.com/bid/96547 - https://www.exploit-db.com/exploits/41540/
CVE ID: CVE-2017-6127 State: PUBLISHED Published: 2017-02-21T20:00:00 Last Updated: 2024-08-05T15:18:49.820Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the access portal on the DIGISOL DG-HR1400 Wireless Router with firmware 1.00.02 allow remote attackers to hijack the authentication of administrators for requests that (1) change the SSID, (2) change the Wi-Fi password, or (3) possibly have unspecified other impact via crafted requests to form2WlanBasicSetup.cgi. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2017/Feb/66 - http://www.securityfocus.com/bid/96369 -
ogram Container: References: - http://seclists.org/fulldisclosure/2017/Feb/66 - http://www.securityfocus.com/bid/96369 - https://drive.google.com/file/d/0B6715xUqH18MeV9GOVE0ZmFrQUU/view
CVE ID: CVE-2017-6128 State: PUBLISHED Published: 2017-05-01T15:00:00 Last Updated: 2024-08-05T15:18:49.772Z Vendors: F5 Networks, Inc. Products: BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, Edge Gateway, GTM, Link Controller, PEM, PSM, WebAccelerator, WebSafe, Enterprise Manager, BIG-IQ Cloud, Device, Security, ADC, Centralized Management, Cloud and Orchestration, iWorkflow Problem Types: sshd is vulnerable to DoS Description: An attacker may be able to cause a denial-of-service (DoS) attack against the sshd component in F5 BIG-IP, Enterprise Manager, BIG-IQ, and iWorkflow. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1038363 - https://sup
Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1038363 - https://support.f5.com/csp/article/K92140924 - http://www.securitytracker.com/id/1038362
CVE ID: CVE-2017-6129 State: PUBLISHED Published: 2017-12-21T17:00:00Z Last Updated: 2024-09-16T19:34:56.279Z Vendors: F5 Networks, Inc. Products: BIG-IP APM Problem Types: Denial of Service Description: In F5 BIG-IP APM software version 13.0.0 and 12.1.2, in some circumstances, APM tunneled VPN flows can cause a VPN/PPP connflow to be prematurely freed or cause TMM to stop responding with a "flow not in use" assertion. An attacker may be able to disrupt traffic or cause the BIG-IP system to fail over to another device in the device group. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K20087443 - http://www.securitytracker.com/id/1040047
CVE ID: CVE-2017-6130 State: PUBLISHED Published: 2017-04-06T14:00:00 Last Updated: 2024-08-05T15:18:49.806Z Vendors: F5 Networks Products: SSL Intercept iApp 1.5.0 - 1.5.7 and SSL Orchestrator 2.0 Problem Types: Server-Side Request Forgery Description: F5 SSL Intercept iApp 1.5.0 - 1.5.7 and SSL Orchestrator 2.0 is vulnerable to a Server-Side Request Forgery (SSRF) attack when deployed using the Dynamic Domain Bypass (DDB) feature feature plus SNAT Auto Map option for egress traffic. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K23001529
CVE ID: CVE-2017-6131 State: PUBLISHED Published: 2017-05-23T15:00:00 Last Updated: 2024-08-05T15:18:49.911Z Vendors: F5 Networks, Inc. Products: BIG-IP Azure cloud instance Problem Types: default administrative password Description: In some circumstances, an F5 BIG-IP version 12.0.0 to 12.1.2 and 13.0.0 Azure cloud instance may contain a default administrative password which could be used to remotely log into the BIG-IP system. The impacted administrative account is the Azure instance administrative user that was created at deployment. The root and admin accounts are not vulnerable. An attacker may be able to remotely access the BIG-IP host via SSH. Additional Analyst Notes: - CVE Program C
ulnerable. An attacker may be able to remotely access the BIG-IP host via SSH. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K61757346 - http://www.securitytracker.com/id/1038569
CVE ID: CVE-2017-6132 State: PUBLISHED Published: 2017-12-21T17:00:00Z Last Updated: 2024-09-16T19:05:17.011Z Vendors: F5 Networks, Inc. Products: BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM, Websafe Problem Types: Denial of Service Description: In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and Websafe software version 13.0.0, 12.0.0 to 12.1.2, 11.6.0 to 11.6.1 and 11.5.0 - 11.5.4, an undisclosed sequence of packets sent to BIG-IP High Availability state mirror listeners (primary and/or secondary IP) may cause TMM to restart. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/102333
TMM to restart. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/102333 - https://support.f5.com/csp/article/K12044607 - http://www.securitytracker.com/id/1040049
CVE ID: CVE-2017-6133 State: PUBLISHED Published: 2017-12-21T17:00:00Z Last Updated: 2024-09-16T19:24:56.438Z Vendors: F5 Networks, Inc. Products: BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, WebSafe Problem Types: Denial of Service Description: In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM and WebSafe software version 13.0.0 and 12.1.0 - 12.1.2, undisclosed HTTP requests may cause a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K25033460 - http://www.securityfocus.com/bid/102467 - http://www.securitytracker.com/id/1040048
CVE ID: CVE-2017-6134 State: PUBLISHED Published: 2017-12-21T17:00:00Z Last Updated: 2024-09-16T23:31:05.900Z Vendors: F5 Networks, Inc. Products: BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM, WebSafe Problem Types: Denial of Service Description: In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and WebSafe software version 13.0.0, 12.1.0 - 12.1.2 and 11.5.1 - 11.6.1, an undisclosed sequence of packets, sourced from an adjacent network may cause TMM to crash. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1040045 - http://www.securityfocus.com/bid/102466 - http://www.securitytracker
nces: - http://www.securitytracker.com/id/1040045 - http://www.securityfocus.com/bid/102466 - http://www.securitytracker.com/id/1040044 - https://support.f5.com/csp/article/K37404773
CVE ID: CVE-2017-6135 State: PUBLISHED Published: 2017-12-21T17:00:00Z Last Updated: 2024-09-16T18:08:05.215Z Vendors: F5 Networks, Inc. Products: BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM, WebSafe Problem Types: Denial of Service Description: In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and WebSafe software version 13.0.0, a slow memory leak as a result of undisclosed IPv4 or IPv6 packets sent to BIG-IP management port or self IP addresses may lead to out of memory (OOM) conditions. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K43322910 - http://www.securitytracker.com/i
: - CVE Program Container: References: - https://support.f5.com/csp/article/K43322910 - http://www.securitytracker.com/id/1040050
CVE ID: CVE-2017-6136 State: PUBLISHED Published: 2017-12-21T17:00:00Z Last Updated: 2024-09-16T16:28:20.202Z Vendors: F5 Networks, Inc. Products: BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM, WebSafe Problem Types: Denial of Service Description: In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and WebSafe software version 13.0.0 and 12.0.0 - 12.1.2, undisclosed traffic patterns sent to BIG-IP virtual servers, with the TCP Fast Open and Tail Loss Probe options enabled in the associated TCP profile, may cause a disruption of service to the Traffic Management Microkernel (TMM). Additional Analyst Notes: - CVE Program Container: Refere
uption of service to the Traffic Management Microkernel (TMM). Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1040046 - https://support.f5.com/csp/article/K81137982
CVE ID: CVE-2017-6137 State: PUBLISHED Published: 2017-05-09T15:00:00 Last Updated: 2024-08-05T15:18:49.793Z Vendors: F5 Networks, Inc. Products: BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, PSM, WebAccelerator, WebSafe Problem Types: Denial of Service Description: In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, PSM, WebAccelerator, and WebSafe 11.6.1 HF1, 12.0.0 HF3, 12.0.0 HF4, and 12.1.0 through 12.1.2, undisclosed traffic patterns received while software SYN cookie protection is engaged may cause a disruption of service to the Traffic Management Microkernel (TMM) on specific platforms and configura
ngaged may cause a disruption of service to the Traffic Management Microkernel (TMM) on specific platforms and configurations. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K82851041 - http://www.securitytracker.com/id/1038409
CVE ID: CVE-2017-6138 State: PUBLISHED Published: 2017-12-21T17:00:00Z Last Updated: 2024-09-17T02:21:41.401Z Vendors: F5 Networks, Inc. Products: BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM, WebSafe Problem Types: Denial of Service Description: In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and WebSafe software version 13.0.0 and 12.1.0 - 12.1.2, malicious requests made to virtual servers with an HTTP profile can cause the TMM to restart. The issue is exposed with BIG-IP APM profiles, regardless of settings. The issue is also exposed with the non-default "normalize URI" configuration options used in iRules and/or BIG-IP LTM poli
e issue is also exposed with the non-default "normalize URI" configuration options used in iRules and/or BIG-IP LTM policies. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1040051 - https://support.f5.com/csp/article/K34514540
CVE ID: CVE-2017-6139 State: PUBLISHED Published: 2017-12-21T17:00:00Z Last Updated: 2024-09-16T18:23:45.116Z Vendors: F5 Networks, Inc. Products: BIG-IP APM Problem Types: Information Leakage Description: In F5 BIG-IP APM software version 13.0.0 and 12.1.2, under rare conditions, the BIG-IP APM system appends log details when responding to client requests. Details in the log file can vary; customers running debug mode logging with BIG-IP APM are at highest risk. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K45432295 - http://www.securitytracker.com/id/1040055 - http://www.securityfocus.com/bid/106186
CVE ID: CVE-2017-6140 State: PUBLISHED Published: 2017-12-21T17:00:00Z Last Updated: 2024-09-17T04:04:09.104Z Vendors: F5 Networks, Inc. Products: BIG-IP LTM, AAM, AFM, Analytics, ASM, DNS, GTM, PEM Problem Types: Denial of Service Description: On the BIG-IP 2000s, 2200s, 4000s, 4200v, i5600, i5800, i7600, i7800, i10600,i10800, and VIPRION 4450 blades, running version 11.5.0, 11.5.1, 11.5.2, 11.5.3, 11.5.4, 11.6.0, 11.6.1, 12.0.0, 12.1.0, 12.1.1 or 12.1.2 of BIG-IP LTM, AAM, AFM, Analytics, ASM, DNS, GTM or PEM, an undisclosed sequence of packets sent to Virtual Servers with client or server SSL profiles may cause disruption of data plane services. Additional Analyst Notes: - CVE Program Con
h client or server SSL profiles may cause disruption of data plane services. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1040042 - https://support.f5.com/csp/article/K55102452
CVE ID: CVE-2017-6141 State: PUBLISHED Published: 2017-10-20T15:00:00Z Last Updated: 2024-09-16T22:09:37.413Z Vendors: F5 Networks, Inc. Products: F5 BIG-IP LTM, AAM, AFM, APM, ASM, Link Controller, PEM, WebSafe Problem Types: TLS abbreviated handshake vulnerability Description: In F5 BIG-IP LTM, AAM, AFM, APM, ASM, Link Controller, PEM, and WebSafe 12.1.0 through 12.1.2, certain values in a TLS abbreviated handshake when using a client SSL profile with the Session Ticket option enabled may cause disruption of service to the Traffic Management Microkernel (TMM). The Session Ticket option is disabled by default. Additional Analyst Notes: - CVE Program Container: References: - https://support.
Ticket option is disabled by default. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K21154730
CVE ID: CVE-2017-6142 State: PUBLISHED Published: 2018-01-19T14:00:00Z Last Updated: 2024-09-16T22:01:51.680Z Vendors: F5 Networks, Inc. Products: BIG-IP AFM Problem Types: Failed certificate validation Description: X509 certificate verification was not correctly implemented in the early access "user id" feature in the F5 BIG-IP Advanced Firewall Manager versions 13.0.0, 12.1.0-12.1.2, and 11.6.0-11.6.2, and thus did not properly validate the remote server's identity on certain versions of BIG-IP. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K20682450 - http://www.securitytracker.com/id/1040255
CVE ID: CVE-2017-6143 State: PUBLISHED Published: 2018-04-13T13:00:00Z Last Updated: 2024-09-16T16:18:23.499Z Vendors: F5 Networks, Inc. Products: BIG-IP (AFM, ASM) Problem Types: MITM Description: X509 certificate verification was not correctly implemented in the IP Intelligence Subscription and IP Intelligence feed-list features, and thus the remote server's identity is not properly validated in F5 BIG-IP 12.0.0-12.1.2, 11.6.0-11.6.2, or 11.5.0-11.5.5. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K11464209
CVE ID: CVE-2017-6144 State: PUBLISHED Published: 2017-10-20T15:00:00Z Last Updated: 2024-09-17T00:40:56.361Z Vendors: F5 Networks, Inc. Products: F5 BIG-IP PEM Problem Types: Certificate verification vulnerability Description: In F5 BIG-IP PEM 12.1.0 through 12.1.2 when downloading the Type Allocation Code (TAC) database file via HTTPS, the server's certificate is not verified. Attackers in a privileged network position may be able to launch a man-in-the-middle attack against these connections. TAC databases are used in BIG-IP PEM for Device Type and OS (DTOS) and Tethering detection. Customers not using BIG-IP PEM, not configuring downloads of TAC database files, or not using HTTP for that
g detection. Customers not using BIG-IP PEM, not configuring downloads of TAC database files, or not using HTTP for that download are not affected. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K81601350