Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-5869 State: PUBLISHED Published: 2020-04-24T13:05:03 Last Updated: 2024-08-04T08:47:40.739Z Vendors: n/a Products: BIG-IQ Problem Types: n/a Description: In BIG-IQ 5.2.0-7.0.0, high availability (HA) synchronization is not secure by TLS and may allow on-path attackers to read / modify confidential data in transit. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K28855111
CVE ID: CVE-2020-5870 State: PUBLISHED Published: 2020-04-24T13:17:01 Last Updated: 2024-08-04T08:47:40.689Z Vendors: n/a Products: BIG-IQ Problem Types: n/a Description: In BIG-IQ 5.2.0-7.0.0, high availability (HA) synchronization mechanisms do not use any form of authentication for connecting to the peer. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K69422435
CVE ID: CVE-2020-5871 State: PUBLISHED Published: 2020-04-30T19:49:40 Last Updated: 2024-08-04T08:47:40.045Z Vendors: n/a Products: BIG-IP Problem Types: DoS Description: On BIG-IP 14.1.0-14.1.2.3, undisclosed requests can lead to a denial of service (DoS) when sent to BIG-IP HTTP/2 virtual servers. The problem can occur when ciphers, which have been blacklisted by the HTTP/2 RFC, are used on backend servers. This is a data-plane issue. There is no control-plane exposure. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K43450419
CVE ID: CVE-2020-5872 State: PUBLISHED Published: 2020-04-30T19:53:14 Last Updated: 2024-08-04T08:47:40.234Z Vendors: n/a Products: BIG-IP Problem Types: DoS Description: On BIG-IP 14.1.0-14.1.2.3, 14.0.0-14.0.1, 13.1.0-13.1.3.1, and 12.1.0-12.1.4.1, when processing TLS traffic with hardware cryptographic acceleration enabled on platforms with Intel QAT hardware, the Traffic Management Microkernel (TMM) may stop responding and cause a failover event. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K63558580
CVE ID: CVE-2020-5873 State: PUBLISHED Published: 2020-04-30T20:21:54 Last Updated: 2024-08-04T08:47:40.043Z Vendors: n/a Products: BIG-IP, BIG-IQ Problem Types: Privilege escalation Description: On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.6.1-11.6.5 and BIG-IQ 5.2.0-7.1.0, a user associated with the Resource Administrator role who has access to the secure copy (scp) utility but does not have access to Advanced Shell (bash) can execute arbitrary commands using a maliciously crafted scp request. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K03585731
CVE ID: CVE-2020-5874 State: PUBLISHED Published: 2020-04-30T20:17:27 Last Updated: 2024-08-04T08:47:40.034Z Vendors: n/a Products: BIG-IP APM Problem Types: DoS Description: On BIG-IP APM 15.0.0-15.0.1.2, 14.1.0-14.1.2.3, and 14.0.0-14.0.1, in certain circumstances, an attacker sending specifically crafted requests to a BIG-IP APM virtual server may cause a disruption of service provided by the Traffic Management Microkernel(TMM). Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K46901953
CVE ID: CVE-2020-5875 State: PUBLISHED Published: 2020-04-30T20:27:12 Last Updated: 2024-08-04T08:47:40.046Z Vendors: n/a Products: BIG-IP Problem Types: DoS Description: On BIG-IP 15.0.0-15.0.1 and 14.1.0-14.1.2.3, under certain conditions, the Traffic Management Microkernel (TMM) may generate a core file and restart while processing SSL traffic with an HTTP/2 full proxy. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K65372933
CVE ID: CVE-2020-5876 State: PUBLISHED Published: 2020-04-30T20:30:25 Last Updated: 2024-08-04T08:47:40.974Z Vendors: n/a Products: BIG-IP Problem Types: Session hijacking Description: On BIG-IP 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, a race condition exists where mcpd and other processes may make unencrypted connection attempts to a new configuration sync peer. The race condition can occur when changing the ConfigSync IP address of a peer, adding a new peer, or when the Traffic Management Microkernel (TMM) first starts up. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K32121038
CVE ID: CVE-2020-5877 State: PUBLISHED Published: 2020-04-30T20:33:11 Last Updated: 2024-08-04T08:47:40.733Z Vendors: n/a Products: BIG-IP Problem Types: DoS Description: On BIG-IP 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, malformed input to the DATAGRAM::tcp iRules command within a FLOW_INIT event may lead to a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K54200228
CVE ID: CVE-2020-5878 State: PUBLISHED Published: 2020-04-30T20:24:29 Last Updated: 2024-08-04T08:47:40.715Z Vendors: n/a Products: BIG-IP VE Problem Types: DoS Description: On versions 15.1.0-15.1.0.1, 15.0.0-15.0.1.1, and 14.1.0-14.1.2.3, Traffic Management Microkernel (TMM) may restart on BIG-IP Virtual Edition (VE) while processing unusual IP traffic. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K35750231
CVE ID: CVE-2020-5879 State: PUBLISHED Published: 2020-04-30T20:46:04 Last Updated: 2024-08-04T08:47:40.555Z Vendors: n/a Products: BIG-IP ASM Problem Types: Information Disclosure Description: On BIG-IP ASM 11.6.1-11.6.5.1, under certain configurations, the BIG-IP system sends data plane traffic to back-end servers unencrypted, even when a Server SSL profile is applied. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K88474783
CVE ID: CVE-2020-5880 State: PUBLISHED Published: 2020-04-30T20:54:58 Last Updated: 2024-08-04T08:47:40.768Z Vendors: n/a Products: BIG-IP Problem Types: DoS Description: Om BIG-IP 15.0.0-15.0.1.3 and 14.1.0-14.1.2.3, the restjavad process may expose a way for attackers to upload arbitrary files on the BIG-IP system, bypassing the authorization system. Resulting error messages may also reveal internal paths of the server. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K94325657
CVE ID: CVE-2020-5881 State: PUBLISHED Published: 2020-04-30T20:39:57 Last Updated: 2024-08-04T08:47:40.436Z Vendors: n/a Products: BIG-IP VE Problem Types: DoS Description: On versions 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, and 13.1.0-13.1.3.3, when the BIG-IP Virtual Edition (VE) is configured with VLAN groups and there are devices configured with OSPF connected to it, the Network Device Abstraction Layer (NDAL) Interfaces can lock up and in turn disrupting the communication between the mcpd and tmm processes. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K03386032
CVE ID: CVE-2020-5882 State: PUBLISHED Published: 2020-04-30T20:37:23 Last Updated: 2024-08-04T08:47:40.826Z Vendors: n/a Products: BIG-IP Problem Types: DoS Description: On BIG-IP 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5, and 11.6.1-11.6.5.1, under certain conditions, the Intel QuickAssist Technology (QAT) cryptography driver may produce a Traffic Management Microkernel (TMM) core file. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K43815022
CVE ID: CVE-2020-5883 State: PUBLISHED Published: 2020-04-30T20:48:18 Last Updated: 2024-08-04T08:47:40.520Z Vendors: n/a Products: BIG-IP Problem Types: DoS Description: On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2.3, 14.0.0-14.0.1, and 13.1.0-13.1.3.1, when a virtual server is configured with HTTP explicit proxy and has an attached HTTP_PROXY_REQUEST iRule, POST requests sent to the virtual server cause an xdata memory leak. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K12234501
CVE ID: CVE-2020-5884 State: PUBLISHED Published: 2020-04-30T20:34:57 Last Updated: 2024-08-04T08:47:40.870Z Vendors: n/a Products: BIG-IP Problem Types: Information disclosure Description: On versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.4, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the default deployment mode for BIG-IP high availability (HA) pair mirroring is insecure. This is a control plane issue that is exposed only on the network used for mirroring. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K72540690
CVE ID: CVE-2020-5885 State: PUBLISHED Published: 2020-04-30T20:41:59 Last Updated: 2024-08-04T08:47:40.878Z Vendors: n/a Products: BIG-IP Problem Types: Information disclosure Description: On versions 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, and 12.1.0-12.1.5.1, BIG-IP systems set up for connection mirroring in a high availability (HA) pair transfer sensitive cryptographic objects over an insecure communications channel. This is a control plane issue which is exposed only on the network used for connection mirroring. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K17663061
CVE ID: CVE-2020-5886 State: PUBLISHED Published: 2020-04-30T20:50:43 Last Updated: 2024-08-04T08:47:40.750Z Vendors: n/a Products: BIG-IP Problem Types: Information disclosure Description: On versions 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, and 12.1.0-12.1.5.1, BIG-IP systems setup for connection mirroring in a High Availability (HA) pair transfers sensitive cryptographic objects over an insecure communications channel. This is a control plane issue which is exposed only on the network used for connection mirroring. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K65720640
CVE ID: CVE-2020-5887 State: PUBLISHED Published: 2020-04-30T20:43:51 Last Updated: 2024-08-04T08:47:41.192Z Vendors: n/a Products: BIG-IP VE Problem Types: Unauthorized access Description: On versions 15.1.0-15.1.0.1, 15.0.0-15.0.1.2, and 14.1.0-14.1.2.3, BIG-IP Virtual Edition (VE) may expose a mechanism for remote attackers to access local daemons and bypass port lockdown settings. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K10251014
CVE ID: CVE-2020-5888 State: PUBLISHED Published: 2020-04-30T21:04:52 Last Updated: 2024-08-04T08:47:40.665Z Vendors: n/a Products: BIG-IP VE Problem Types: Unauthorized access Description: On versions 15.1.0-15.1.0.1, 15.0.0-15.0.1.2, and 14.1.0-14.1.2.3, BIG-IP Virtual Edition (VE) may expose a mechanism for adjacent network (layer 2) attackers to access local daemons and bypass port lockdown settings. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K73274382
CVE ID: CVE-2020-5889 State: PUBLISHED Published: 2020-04-30T20:58:48 Last Updated: 2024-08-04T08:47:41.008Z Vendors: n/a Products: BIG-IP APM Problem Types: XSS Description: On versions 15.1.0-15.1.0.1, 15.0.0-15.0.1.2, and 14.1.0-14.1.2.3, in BIG-IP APM portal access, a specially crafted HTTP request can lead to reflected XSS after the BIG-IP APM system rewrites the HTTP response from the untrusted backend server and sends it to the client. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K24415506
CVE ID: CVE-2020-5890 State: PUBLISHED Published: 2020-04-30T21:08:17 Last Updated: 2024-08-04T08:47:40.901Z Vendors: n/a Products: BIG-IP, BIG-IQ Problem Types: Information Disclosure Description: On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, and 12.1.0-12.1.5.1 and BIG-IQ 5.2.0-7.1.0, when creating a QKView, credentials for binding to LDAP servers used for remote authentication of the BIG-IP administrative interface will not fully obfuscate if they contain whitespace. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K03318649
CVE ID: CVE-2020-5891 State: PUBLISHED Published: 2020-04-30T20:57:00 Last Updated: 2024-08-04T08:47:40.862Z Vendors: n/a Products: BIG-IP Problem Types: DoS Description: On BIG-IP 15.1.0-15.1.0.1, 15.0.0-15.0.1.2, and 14.1.0-14.1.2.3, undisclosed HTTP/2 requests can lead to a denial of service when sent to a virtual server configured with the Fallback Host setting and a server-side HTTP/2 profile. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K58494243
CVE ID: CVE-2020-5892 State: PUBLISHED Published: 2020-04-30T21:03:08 Last Updated: 2024-08-04T08:47:40.723Z Vendors: n/a Products: BIG-IP Edge Client Problem Types: Information Disclosure Description: In versions 7.1.5-7.1.8, the BIG-IP Edge Client components in BIG-IP APM, Edge Gateway, and FirePass legacy allow attackers to obtain the full session ID from process memory. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K15838353
CVE ID: CVE-2020-5893 State: PUBLISHED Published: 2020-04-30T21:00:49 Last Updated: 2024-08-04T08:47:40.873Z Vendors: n/a Products: BIG-IP Edge Client Problem Types: Brute Force Description: In versions 7.1.5-7.1.8, when a user connects to a VPN using BIG-IP Edge Client over an unsecure network, BIG-IP Edge Client responds to authentication requests over HTTP while sending probes for captive portal detection. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K97733133
CVE ID: CVE-2020-5894 State: PUBLISHED Published: 2020-05-07T12:25:56 Last Updated: 2024-08-04T08:47:40.605Z Vendors: n/a Products: NGINX Controller Problem Types: Session Hijacking Description: On versions 3.0.0-3.3.0, the NGINX Controller webserver does not invalidate the server-side session token after users log out. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K13028514
CVE ID: CVE-2020-5895 State: PUBLISHED Published: 2020-05-07T12:28:24 Last Updated: 2024-08-04T08:47:40.740Z Vendors: n/a Products: NGINX Controller Problem Types: DoS Description: On NGINX Controller versions 3.1.0-3.3.0, AVRD uses world-readable and world-writable permissions on its socket, which allows processes or users on the local system to write arbitrary data into the socket. A local system attacker can make AVRD segmentation fault (SIGSEGV) by writing malformed messages to the socket. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K95120415 - https://security.netapp.com/advisory/ntap-20200522-0001/
CVE ID: CVE-2020-5896 State: PUBLISHED Published: 2020-05-12T15:24:59 Last Updated: 2024-08-04T08:47:41.070Z Vendors: n/a Products: F5 Edge Client Problem Types: Privilege Escalation Description: On versions 7.1.5-7.1.9, the BIG-IP Edge Client's Windows Installer Service's temporary folder has weak file and folder permissions. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K15478554
CVE ID: CVE-2020-5897 State: PUBLISHED Published: 2020-05-12T15:20:53 Last Updated: 2024-08-04T08:47:40.902Z Vendors: n/a Products: F5 Edge Client Problem Types: RCE Description: In versions 7.1.5-7.1.9, there is use-after-free memory vulnerability in the BIG-IP Edge Client Windows ActiveX component. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K20346072
CVE ID: CVE-2020-5898 State: PUBLISHED Published: 2020-05-12T15:27:44 Last Updated: 2024-08-04T08:47:41.116Z Vendors: n/a Products: F5 Edge Client Problem Types: DOS Description: In versions 7.1.5-7.1.9, BIG-IP Edge Client Windows Stonewall driver does not sanitize the pointer received from the userland. A local user on the Windows client system can send crafted DeviceIoControl requests to \\.\urvpndrv device causing the Windows kernel to crash. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K69154630
CVE ID: CVE-2020-5899 State: PUBLISHED Published: 2020-07-01T14:01:58 Last Updated: 2024-08-04T08:47:40.906Z Vendors: n/a Products: NGINX Controller Problem Types: account hijacking Description: In NGINX Controller 3.0.0-3.4.0, recovery code required to change a user's password is transmitted and stored in the database in plain text, which allows an attacker who can intercept the database connection or have read access to the database, to request a password reset using the email address of another registered user then retrieve the recovery code. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K25434422
CVE ID: CVE-2020-5900 State: PUBLISHED Published: 2020-07-01T13:59:42 Last Updated: 2024-08-04T08:47:40.617Z Vendors: n/a Products: NGINX Controller Problem Types: CSRF Description: In versions 3.0.0-3.4.0, 2.0.0-2.9.0, and 1.0.1, there is insufficient cross-site request forgery (CSRF) protections for the NGINX Controller user interface. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K31044532
CVE ID: CVE-2020-5901 State: PUBLISHED Published: 2020-07-01T14:03:33 Last Updated: 2024-08-04T08:47:41.012Z Vendors: n/a Products: NGINX Controller Problem Types: XSS Description: In NGINX Controller 3.3.0-3.4.0, undisclosed API endpoints may allow for a reflected Cross Site Scripting (XSS) attack. If the victim user is logged in as admin this could result in a complete compromise of the system. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K43520321
CVE ID: CVE-2020-5902 State: PUBLISHED Published: 2020-07-01T00:00:00.000Z Last Updated: 2025-10-21T23:35:41.409Z Vendors: n/a Products: BIG-IP Problem Types: RCE Description: In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.f5.com/csp/article/K52145254 - http://packetstormsecurity.com/files/158333/BIG-IP-TMUI-Remote-Code-Execution.html - http://packetstormsecurity.com/
4 - http://packetstormsecurity.com/files/158333/BIG-IP-TMUI-Remote-Code-Execution.html - http://packetstormsecurity.com/files/158334/BIG-IP-TMUI-Remote-Code-Execution.html - http://packetstormsecurity.com/files/158366/F5-BIG-IP-TMUI-Directory-Traversal-File-Upload-Code-Execution.html - https://www.kb.cert.org/vuls/id/290915 - https://www.criticalstart.com/f5-big-ip-remote-code-execution-exploit/ - https://badpackets.net/over-3000-f5-big-ip-endpoints-vulnerable-to-cve-2020-5902/ - http://packetstormsecurity.com/files/158414/Checker-CVE-2020-5902.html - https://github.com/Critical-Start/Team-Ares/tree/master/CVE-2020-5902 - http://packetstormsecurity.com/files/158581/F5-Big-IP-13.1.3-Build-0.0
tical-Start/Team-Ares/tree/master/CVE-2020-5902 - http://packetstormsecurity.com/files/158581/F5-Big-IP-13.1.3-Build-0.0.6-Local-File-Inclusion.html - https://swarm.ptsecurity.com/rce-in-f5-big-ip/ - http://packetstormsecurity.com/files/175671/F5-BIG-IP-TMUI-Directory-Traversal-File-Upload-Code-Execution.html
CVE ID: CVE-2020-5903 State: PUBLISHED Published: 2020-07-01T14:42:00 Last Updated: 2024-08-04T08:47:40.717Z Vendors: n/a Products: BIG-IP Problem Types: XSS Description: In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, a Cross-Site Scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K43638305 - https://www.kb.cert.org/vuls/id/290915
CVE ID: CVE-2020-5904 State: PUBLISHED Published: 2020-07-01T14:39:30 Last Updated: 2024-08-04T08:47:40.597Z Vendors: n/a Products: BIG-IP Problem Types: CSRF Description: In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, a cross-site request forgery (CSRF) vulnerability in the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, exists in an undisclosed page. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K31301245 - https://www.kb.cert.org/vuls/id/290915
CVE ID: CVE-2020-5905 State: PUBLISHED Published: 2020-07-01T14:40:49 Last Updated: 2024-08-04T08:47:40.706Z Vendors: n/a Products: BIG-IP Problem Types: XSS Description: In version 11.6.1-11.6.5.2 of the BIG-IP system Configuration utility Network > WCCP page, the system does not sanitize all user-provided data before display. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K07051153 - https://www.kb.cert.org/vuls/id/290915
CVE ID: CVE-2020-5906 State: PUBLISHED Published: 2020-07-01T14:33:20 Last Updated: 2024-08-04T08:47:40.900Z Vendors: n/a Products: BIG-IP Problem Types: privilege escalation Description: In versions 13.1.0-13.1.3.3, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, the BIG-IP system does not properly enforce the access controls for the scp.blacklist files. This allows Admin and Resource Admin users with Secure Copy (SCP) protocol access to read and overwrite blacklisted files via SCP. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K82518062 - https://www.kb.cert.org/vuls/id/290915
CVE ID: CVE-2020-5907 State: PUBLISHED Published: 2020-07-01T14:43:10 Last Updated: 2024-08-04T08:47:40.705Z Vendors: n/a Products: BIG-IP Problem Types: privilege escalation Description: In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, an authorized user provided with access only to the TMOS Shell (tmsh) may be able to conduct arbitrary file read/writes via the built-in sftp functionality. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K00091341 - https://www.kb.cert.org/vuls/id/290915
CVE ID: CVE-2020-5908 State: PUBLISHED Published: 2020-07-01T14:34:38 Last Updated: 2024-08-04T08:47:40.930Z Vendors: n/a Products: Edge Client for Linux Problem Types: information leakage Description: In versions bundled with BIG-IP APM 12.1.0-12.1.5 and 11.6.1-11.6.5.2, Edge Client for Linux exposes full session ID in the local log files. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K33023560 - https://www.kb.cert.org/vuls/id/290915
CVE ID: CVE-2020-5909 State: PUBLISHED Published: 2020-07-02T12:26:39 Last Updated: 2024-08-04T08:47:40.733Z Vendors: n/a Products: NGINX Controller Problem Types: MITM Description: In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, when users run the command displayed in NGINX Controller user interface (UI) to fetch the agent installer, the server TLS certificate is not verified. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K31150658
CVE ID: CVE-2020-5910 State: PUBLISHED Published: 2020-07-02T12:25:11 Last Updated: 2024-08-04T08:47:40.655Z Vendors: n/a Products: NGINX Controller Problem Types: data leakage Description: In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the Neural Autonomic Transport System (NATS) messaging services in use by the NGINX Controller do not require any form of authentication, so any successful connection would be authorized. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K59209532
CVE ID: CVE-2020-5911 State: PUBLISHED Published: 2020-07-02T12:23:40 Last Updated: 2024-08-04T08:47:40.918Z Vendors: n/a Products: NGINX Controller Problem Types: MITM Description: In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller installer starts the download of Kubernetes packages from an HTTP URL On Debian/Ubuntu system. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K84084843