Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-6619 State: PUBLISHED Published: 2019-05-03T19:35:37 Last Updated: 2024-08-04T20:23:22.326Z Vendors: F5 Products: BIG-IP (LTM, AAM, AFM, APM, ASM, Link Controller, PEM, WebAccelerator) Problem Types: DoS Description: On BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, the Traffic Management Microkernel (TMM) may restart when a virtual server has an HTTP/2 profile with Application Layer Protocol Negotiation (ALPN) enabled and it processes traffic where the ALPN extension size is zero. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K94563344 - http://www.securityfocus.com/bid/108190
CVE ID: CVE-2019-6620 State: PUBLISHED Published: 2019-07-02T20:14:49 Last Updated: 2024-08-04T20:23:22.238Z Vendors: F5 Products: BIG-IP, BIG-IQ Problem Types: privilege escalation Description: On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.5, 13.0.0-13.1.1.4, 12.1.0-12.1.4.1, and 11.5.1-11.6.4 and BIG-IQ 6.0.0-6.1.0 and 5.1.0-5.4.0, an undisclosed iControl REST worker vulnerable to command injection for an Administrator user. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K20445457
CVE ID: CVE-2019-6621 State: PUBLISHED Published: 2019-07-02T20:19:39 Last Updated: 2024-08-04T20:23:22.143Z Vendors: n/a Products: BIG-IP, BIG-IQ Problem Types: privilege escalation Description: On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4.1, 11.6.1-11.6.3.4, and 11.5.2-11.5.8 and BIG-IQ 7.0.0-7.1.0.2, 6.0.0-6.1.0, and 5.1.0-5.4.0, an undisclosed iControl REST worker is vulnerable to command injection by an admin/resource admin user. This issue impacts both iControl REST and tmsh implementations. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K20541896 - https://support.f5.com/csp/article/K20541896?utm_source
er: References: - https://support.f5.com/csp/article/K20541896 - https://support.f5.com/csp/article/K20541896?utm_source=f5support&amp%3Butm_medium=RSS
CVE ID: CVE-2019-6622 State: PUBLISHED Published: 2019-07-02T20:25:13 Last Updated: 2024-08-04T20:23:22.113Z Vendors: F5 Products: BIG-IP Problem Types: privilege escalation Description: On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.5, 13.0.0-13.1.1.4, 12.1.0-12.1.4.1, and 11.5.1-11.6.4, an undisclosed iControl REST worker is vulnerable to command injection by an administrator or resource administrator user. This attack is only exploitable on multi-bladed systems. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K44885536
CVE ID: CVE-2019-6623 State: PUBLISHED Published: 2019-07-02T21:03:04 Last Updated: 2024-08-04T20:23:22.439Z Vendors: F5 Products: BIG-IP Problem Types: DoS Description: On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, undisclosed traffic sent to BIG-IP iSession virtual server may cause the Traffic Management Microkernel (TMM) to restart, resulting in a Denial-of-Service (DoS). Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K72335002 - http://www.securityfocus.com/bid/109048 - https://support.f5.com/csp/article/K72335002?utm_source=f5support&amp%3Butm_medium=RSS
CVE ID: CVE-2019-6624 State: PUBLISHED Published: 2019-07-02T20:55:29 Last Updated: 2024-08-04T20:23:22.064Z Vendors: F5 Products: BIG-IP Problem Types: DoS Description: On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, an undisclosed traffic pattern sent to a BIG-IP UDP virtual server may lead to a denial-of-service (DoS). Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K07127032
CVE ID: CVE-2019-6625 State: PUBLISHED Published: 2019-07-03T17:38:51 Last Updated: 2024-08-04T20:23:22.163Z Vendors: F5 Products: BIG-IP Problem Types: XSS Description: On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, and 11.5.1-11.6.4, a reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Traffic Management User Interface (TMUI) also known as the BIG-IP Configuration utility. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K79902360
CVE ID: CVE-2019-6626 State: PUBLISHED Published: 2019-07-03T17:34:06 Last Updated: 2024-08-04T20:23:22.156Z Vendors: F5 Products: BIG-IP (AFM, Analytics, ASM) Problem Types: XSS Description: On BIG-IP (AFM, Analytics, ASM) 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, and 11.5.1-11.6.3.4, A reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Traffic Management User Interface (TMUI), also known as the Configuration utility. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K00432398
CVE ID: CVE-2019-6627 State: PUBLISHED Published: 2019-07-03T17:46:11 Last Updated: 2024-08-04T20:23:22.166Z Vendors: F5 Products: F5 SSL Orchestrator Problem Types: DoS Description: On F5 SSL Orchestrator 14.1.0-14.1.0.5, on rare occasions, specific to a certain race condition, TMM may restart when SSL Forward Proxy enforces the bypass action for an SSL Orchestrator transparent virtual server with SNAT enabled. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K36320691
CVE ID: CVE-2019-6628 State: PUBLISHED Published: 2019-07-03T17:42:53 Last Updated: 2024-08-04T20:23:22.324Z Vendors: F5 Products: BIG-IP PEM Problem Types: DoS Description: On BIG-IP PEM 14.1.0-14.1.0.5 and 14.0.0-14.0.0.4, under certain conditions, the TMM process may terminate and restart while processing BIG-IP PEM traffic with the OpenVPN classifier. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K04730051
CVE ID: CVE-2019-6629 State: PUBLISHED Published: 2019-07-03T17:50:02 Last Updated: 2024-08-04T20:23:22.247Z Vendors: F5 Products: BIG-IP Problem Types: DoS Description: On BIG-IP 14.1.0-14.1.0.5, undisclosed SSL traffic to a virtual server configured with a Client SSL profile may cause TMM to fail and restart. The Client SSL profile must have session tickets enabled and use DHE cipher suites to be affected. This only impacts the data plane, there is no impact to the control plane. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K95434410 - https://support.f5.com/csp/article/K95434410?utm_source=f5support&amp%3Butm_medium=RSS
CVE ID: CVE-2019-6630 State: PUBLISHED Published: 2019-07-03T17:57:23 Last Updated: 2024-08-04T20:23:22.040Z Vendors: F5 Products: F5 SSL Orchestrator Problem Types: DoS Description: On F5 SSL Orchestrator 14.1.0-14.1.0.5 and 14.0.0-14.0.0.4, undisclosed traffic flow may cause TMM to restart under certain circumstances. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K33444350 - http://www.securityfocus.com/bid/109097
CVE ID: CVE-2019-6631 State: PUBLISHED Published: 2019-07-03T17:54:00 Last Updated: 2024-08-04T20:23:22.517Z Vendors: F5 Products: BIG-IP Problem Types: DoS Description: On BIG-IP 11.5.1-11.6.4, iRules performing HTTP header manipulation may cause an interruption to service when processing traffic handled by a Virtual Server with an associated HTTP profile, in specific circumstances, when the requests do not strictly conform to RFCs. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K19501795 - http://www.securityfocus.com/bid/109119 - https://support.f5.com/csp/article/K19501795?utm_source=f5support&amp%3Butm_medium=RSS
CVE ID: CVE-2019-6632 State: PUBLISHED Published: 2019-07-03T18:06:01 Last Updated: 2024-08-04T20:23:22.266Z Vendors: F5 Products: BIG-IP Problem Types: Information disclosure Description: On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, under certain circumstances, attackers can decrypt configuration items that are encrypted because the vCMP configuration unit key is generated with insufficient randomness. The attack prerequisite is direct access to encrypted configuration and/or UCS files. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K01413496 - http://www.securityfocus.com/bid/109112
CVE ID: CVE-2019-6633 State: PUBLISHED Published: 2019-07-03T18:00:34 Last Updated: 2024-08-04T20:23:22.284Z Vendors: F5 Products: BIG-IP Problem Types: Privilege escalation Description: On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4.1, and 11.5.1-11.6.4, when the BIG-IP system is licensed with Appliance mode, user accounts with Administrator and Resource Administrator roles can bypass Appliance mode restrictions. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K73522927 - http://www.securityfocus.com/bid/109113
CVE ID: CVE-2019-6634 State: PUBLISHED Published: 2019-07-03T18:12:42 Last Updated: 2024-08-04T20:23:22.285Z Vendors: F5 Products: BIG-IP Problem Types: DoS Description: On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, a high volume of malformed analytics report requests leads to instability in restjavad process. This causes issues with both iControl REST and some portions of TMUI. The attack requires an authenticated user with any role. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K64855220 - http://www.securityfocus.com/bid/109104
CVE ID: CVE-2019-6635 State: PUBLISHED Published: 2019-07-03T18:09:12 Last Updated: 2024-08-04T20:23:22.260Z Vendors: F5 Products: BIG-IP Problem Types: Privilege escalation Description: On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.1-11.5.8, when the BIG-IP system is licensed for Appliance mode, a user with either the Administrator or the Resource Administrator role can bypass Appliance mode restrictions. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K11330536 - http://www.securityfocus.com/bid/109098 - https://support.f5.com/csp/article/K11330536?utm_source=f5support&amp%3Butm_medi
tp://www.securityfocus.com/bid/109098 - https://support.f5.com/csp/article/K11330536?utm_source=f5support&amp%3Butm_medium=RSS
CVE ID: CVE-2019-6636 State: PUBLISHED Published: 2019-07-03T18:17:07 Last Updated: 2024-08-04T20:23:22.353Z Vendors: F5 Products: BIG-IP (AFM, ASM) Problem Types: XSS/CSRF Description: On BIG-IP (AFM, ASM) 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, and 11.5.1-11.6.4, a stored cross-site scripting vulnerability in AFM feed list. In the worst case, an attacker can store a CSRF which results in code execution as the admin user. The level of user role which can perform this attack are resource administrator and administrator. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K68151373 - http://www.securityfocus.com/bid/109
CVE Program Container: References: - https://support.f5.com/csp/article/K68151373 - http://www.securityfocus.com/bid/109108
CVE ID: CVE-2019-6637 State: PUBLISHED Published: 2019-07-03T18:20:18 Last Updated: 2024-08-04T20:23:22.107Z Vendors: F5 Products: BIG-IP (ASM) Problem Types: DoS Description: On BIG-IP (ASM) 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, Application logic abuse of ASM REST endpoints can lead to instability of BIG-IP system. Exploitation of this issue causes excessive memory consumption which results in the Linux kernel triggering OOM killer on arbitrary processes. The attack requires an authenticated user with role of "Guest" or greater privilege. Note: "No Access" cannot login so technically it's a role but a user with this access role cannot perform the attack. Addi
te: "No Access" cannot login so technically it's a role but a user with this access role cannot perform the attack. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K29149494 - http://www.securityfocus.com/bid/109091
CVE ID: CVE-2019-6638 State: PUBLISHED Published: 2019-07-03T18:23:02 Last Updated: 2024-08-04T20:23:22.428Z Vendors: F5 Products: BIG-IP Problem Types: DoS Description: On BIG-IP 14.1.0-14.1.0.5 and 14.0.0-14.0.0.4, Malformed http requests made to an undisclosed iControl REST endpoint can lead to infinite loop of the restjavad process. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K67825238 - http://www.securityfocus.com/bid/109106 - https://support.f5.com/csp/article/K67825238?utm_source=f5support&amp%3Butm_medium=RSS
CVE ID: CVE-2019-6639 State: PUBLISHED Published: 2019-07-03T18:26:41 Last Updated: 2024-08-04T20:23:22.231Z Vendors: F5 Products: BIG-IP (AFM, PEM) Problem Types: XSS Description: On BIG-IP (AFM, PEM) 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.1-11.5.8, an undisclosed TMUI pages for AFM and PEM Subscriber management are vulnerable to a stored cross-site scripting (XSS) issue. This is a control plane issue only and is not accessible from the data plane. The attack requires a malicious resource administrator to store the XSS. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K61002104 - http://w
Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K61002104 - http://www.securityfocus.com/bid/109064
CVE ID: CVE-2019-6640 State: PUBLISHED Published: 2019-07-03T18:29:54 Last Updated: 2024-08-04T20:23:22.255Z Vendors: F5 Products: BIG-IP Problem Types: Information Disclosure Description: On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.1-11.5.8, SNMP exposes sensitive configuration objects over insecure transmission channels. This issue is exposed when a passphrase is inserted into various profile types and accessed using SNMPv2. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K40443301 - http://www.securityfocus.com/bid/109089 - https://support.f5.com/csp/article/K40443301?utm_source=f
/article/K40443301 - http://www.securityfocus.com/bid/109089 - https://support.f5.com/csp/article/K40443301?utm_source=f5support&amp%3Butm_medium=RSS
CVE ID: CVE-2019-6641 State: PUBLISHED Published: 2019-07-03T18:33:11 Last Updated: 2024-08-04T20:23:22.544Z Vendors: F5 Products: BIG-IP Problem Types: DoS Description: On BIG-IP 12.1.0-12.1.4.1, undisclosed requests can cause iControl REST processes to crash. The attack can only come from an authenticated user; all roles are capable of performing the attack. Unauthenticated users cannot perform this attack. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K22384173 - http://www.securityfocus.com/bid/109060 - https://support.f5.com/csp/article/K22384173?utm_source=f5support&amp%3Butm_medium=RSS
CVE ID: CVE-2019-6642 State: PUBLISHED Published: 2019-07-01T20:21:01 Last Updated: 2024-08-04T20:23:22.538Z Vendors: F5 Products: BIG-IP, BIG-IQ, iWorkflow, Enterprise Manager Problem Types: Privilege Escalation Description: In BIG-IP 15.0.0, 14.0.0-14.1.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.2, and 11.5.2-11.6.4, BIG-IQ 6.0.0-6.1.0 and 5.1.0-5.4.0, iWorkflow 2.3.0, and Enterprise Manager 3.1.1, authenticated users with the ability to upload files (via scp, for example) can escalate their privileges to allow root shell access from within the TMOS Shell (tmsh) interface. The tmsh interface allows users to execute a secondary program via tools like sftp or scp. Additional Analyst Notes: - CVE Pr
msh interface allows users to execute a secondary program via tools like sftp or scp. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K40378764 - https://support.f5.com/csp/article/K40378764?utm_source=f5support&amp%3Butm_medium=RSS
CVE ID: CVE-2019-6643 State: PUBLISHED Published: 2019-09-04T17:16:42 Last Updated: 2024-08-04T20:23:22.529Z Vendors: n/a Products: BIG-IP Problem Types: DoS Description: On versions 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.2, 12.1.0-12.1.4.1, and 11.5.2-11.6.4, an attacker sending specifically crafted DHCPv6 requests through a BIG-IP virtual server configured with a DHCPv6 profile may be able to cause the TMM process to produce a core file. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K36228121 - https://support.f5.com/csp/article/K36228121?utm_source=f5support&amp%3Butm_medium=RSS
CVE ID: CVE-2019-6644 State: PUBLISHED Published: 2019-09-04T16:58:45 Last Updated: 2024-08-04T20:23:22.307Z Vendors: n/a Products: BIG-IP Problem Types: Information disclosure Description: Similar to the issue identified in CVE-2018-12120, on versions 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.2, and 12.1.0-12.1.4 BIG-IP will bind a debug nodejs process to all interfaces when invoked. This may expose the process to unauthorized users if the plugin is left in debug mode and the port is accessible. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K75532331
CVE ID: CVE-2019-6645 State: PUBLISHED Published: 2019-09-04T15:40:59 Last Updated: 2024-08-04T20:23:22.516Z Vendors: n/a Products: BIG-IP Problem Types: DoS Description: On BIG-IP 14.0.0-14.1.0.5, 13.0.0-13.1.2, 12.1.0-12.1.4.1, 11.5.2-11.6.4, FTP traffic passing through a Virtual Server with both an active FTP profile associated and connection mirroring configured may lead to a TMM crash causing the configured HA action to be taken. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K15759349 - https://support.f5.com/csp/article/K15759349?utm_source=f5support&amp%3Butm_medium=RSS
CVE ID: CVE-2019-6646 State: PUBLISHED Published: 2019-09-04T17:13:02 Last Updated: 2024-08-04T20:23:22.367Z Vendors: n/a Products: BIG-IP, Enterprise Manager Problem Types: Privilege Escalation Description: On BIG-IP 11.5.2-11.6.4 and Enterprise Manager 3.1.1, REST users with guest privileges may be able to escalate their privileges and run commands with admin privileges. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K53990093
CVE ID: CVE-2019-6647 State: PUBLISHED Published: 2019-09-04T16:17:16 Last Updated: 2024-08-04T20:23:22.386Z Vendors: n/a Products: BIG-IP Problem Types: DoS Description: On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.2, 12.1.0-12.1.4.1, 11.5.2-11.6.4, when processing authentication attempts for control-plane users MCPD leaks a small amount of memory. Under rare conditions attackers with access to the management interface could eventually deplete memory on the system. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K87920510
CVE ID: CVE-2019-6648 State: PUBLISHED Published: 2019-09-04T15:49:06 Last Updated: 2024-08-04T20:23:22.425Z Vendors: n/a Products: F5 Container Ingress Service Problem Types: Information Disclosure Description: On version 1.9.0, If DEBUG logging is enable, F5 Container Ingress Service (CIS) for Kubernetes and Red Hat OpenShift (k8s-bigip-ctlr) log files may contain BIG-IP secrets such as SSL Private Keys and Private key Passphrases as provided as inputs by an AS3 Declaration. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K74327432 - https://support.f5.com/csp/article/K74327432?utm_source=f5support&amp%3Butm_medium=RSS
CVE ID: CVE-2019-6649 State: PUBLISHED Published: 2019-09-20T19:52:39 Last Updated: 2024-08-04T20:23:22.426Z Vendors: F5 Networks Products: BIG-IP, Enterprise Manager Problem Types: Information Disclosure and Unauthorized Access Description: F5 BIG-IP 15.0.0, 14.1.0-14.1.0.6, 14.0.0-14.0.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.1, 11.6.0-11.6.4, and 11.5.1-11.5.9 and Enterprise Manager 3.1.1 may expose sensitive information and allow the system configuration to be modified when using non-default ConfigSync settings. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K05123525
CVE ID: CVE-2019-6650 State: PUBLISHED Published: 2019-09-20T19:47:18 Last Updated: 2024-08-04T20:23:22.517Z Vendors: F5 Networks Products: BIG-IP ASM Problem Types: Information Disclosure and Unauthorized Access Description: F5 BIG-IP ASM 15.0.0, 14.1.0-14.1.0.6, 14.0.0-14.0.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.1, 11.6.0-11.6.4, and 11.5.1-11.5.9 may expose sensitive information and allow the system configuration to be modified when using non-default settings. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K04280042 - https://support.f5.com/csp/article/K04280042?utm_source=f5support&amp%3Butm_medium=RSS
CVE ID: CVE-2019-6651 State: PUBLISHED Published: 2019-09-25T17:39:36 Last Updated: 2024-08-04T20:23:22.243Z Vendors: n/a Products: BIG-IP, BIG-IQ, iWorkflow, Enterprise Manager Problem Types: Oracle Description: In BIG-IP 15.0.0, 14.1.0-14.1.0.6, 14.0.0-14.0.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.1, 11.5.1-11.6.4, BIG-IQ 7.0.0, 6.0.0-6.1.0,5.2.0-5.4.0, iWorkflow 2.3.0, and Enterprise Manager 3.1.1, the Configuration utility login page may not follow best security practices when handling a malicious request. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K89509323 - https://support.f5.com/csp/article/K89509323?utm_source=f5support&amp%3Butm_m
s://support.f5.com/csp/article/K89509323 - https://support.f5.com/csp/article/K89509323?utm_source=f5support&amp%3Butm_medium=RSS
CVE ID: CVE-2019-6652 State: PUBLISHED Published: 2019-09-25T17:55:56 Last Updated: 2024-08-04T20:23:22.371Z Vendors: n/a Products: BIG-IQ Problem Types: Information leakage Description: In BIG-IQ 6.0.0-6.1.0, services for stats do not require authentication nor do they implement any form of Transport Layer Security (TLS). Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K23101430 - https://support.f5.com/csp/article/K23101430?utm_source=f5support&amp%3Butm_medium=RSS
CVE ID: CVE-2019-6653 State: PUBLISHED Published: 2019-09-25T18:00:09 Last Updated: 2024-08-04T20:23:22.424Z Vendors: n/a Products: BIG-IQ Problem Types: XSS Description: There is a Stored Cross Site Scripting vulnerability in the undisclosed page of a BIG-IQ 6.0.0-6.1.0 or 5.2.0-5.4.0 system. The attack can be stored by users granted the Device Manager and Administrator roles. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K71712132 - https://support.f5.com/csp/article/K71712132?utm_source=f5support&amp%3Butm_medium=RSS
CVE ID: CVE-2019-6654 State: PUBLISHED Published: 2019-09-25T18:57:48 Last Updated: 2024-08-04T20:23:22.426Z Vendors: n/a Products: BIG-IP Problem Types: Unauthorized access Description: On versions 14.0.0-14.1.2, 13.0.0-13.1.3, 12.1.0-12.1.5, and 11.5.1-11.6.5, the BIG-IP system fails to perform Martian Address Filtering (As defined in RFC 1812 section 5.3.7) on the control plane (management interface). This may allow attackers on an adjacent system to force BIG-IP into processing packets with spoofed source addresses. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K45644893
CVE ID: CVE-2019-6655 State: PUBLISHED Published: 2019-09-25T19:00:43 Last Updated: 2024-08-04T20:23:22.427Z Vendors: n/a Products: BIG-IP AVR, ASM, APM, PEM, AFM, and/or AAM Problem Types: Information leakage Description: On versions 13.0.0-13.1.0.1, 12.1.0-12.1.4.1, 11.6.1-11.6.4, and 11.5.1-11.5.9, BIG-IP platforms where AVR, ASM, APM, PEM, AFM, and/or AAM is provisioned may leak sensitive data. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K31152411 - https://support.f5.com/csp/article/K31152411?utm_source=f5support&amp%3Butm_medium=RSS