deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-31464
Published: 2021-05-07
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Reader 10.1.3.37598. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of U3D objects embedded in PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-13574.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-21-553/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2021-31465
Published: 2021-05-07
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.3.37598. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of U3D objects in PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-13582.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-21-554/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2021-31466
Published: 2021-05-07
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.3.37598. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of U3D objects in PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-13583.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-21-555/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2021-31467
Published: 2021-05-07
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Reader 10.1.3.37598. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of U3D files embedded in PDF documents. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-13621.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-21-556/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2021-31468
Published: 2021-05-07
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.3.37598. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of U3D files embedded in PDF documents. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-13620.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-21-557/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2021-31469
Published: 2021-05-07
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Reader 10.1.1.37576. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of U3D objects embedded in PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-12936.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-21-526/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2021-31470
Published: 2021-05-07
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of U3D objects in PDF files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-12947.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-21-527/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2021-31471
Published: 2021-05-07
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Reader 10.1.1.37576. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of U3D objects embedded in PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-12955.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-21-528/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2021-31472
Published: 2021-05-07
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of U3D objects in PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-13011.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-119
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-21-529/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2021-31755
Published: 2021-05-07
Description: An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /goform/setmac allows attackers to execute arbitrary code on the system via a crafted post request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://github.com/Yu3H0/IoT_CVE/tree/main/Tenda/CVE_3; https://github.com/Yu3H0/IoT_CVE/tree/main/Tenda/CVE_3; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-31755
CVE: CVE-2021-31756
Published: 2021-05-07
Description: An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /gofrom/setwanType allows attackers to execute arbitrary code on the system via a crafted post request. This occurs when input vector controlled by malicious attack get copied to the stack variable.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/Yu3H0/IoT_CVE/tree/main/Tenda/CVE_1; https://github.com/Yu3H0/IoT_CVE/tree/main/Tenda/CVE_1
CVE: CVE-2021-31757
Published: 2021-05-07
Description: An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /goform/setVLAN allows attackers to execute arbitrary code on the system via a crafted post request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/Yu3H0/IoT_CVE/tree/main/Tenda/CVE_4; https://github.com/Yu3H0/IoT_CVE/tree/main/Tenda/CVE_4
CVE: CVE-2021-31758
Published: 2021-05-07
Description: An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /goform/setportList allows attackers to execute arbitrary code on the system via a crafted post request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/Yu3H0/IoT_CVE/tree/main/Tenda/CVE_2; https://github.com/Yu3H0/IoT_CVE/tree/main/Tenda/CVE_2
CVE: CVE-2021-26077
Published: 2021-05-10
Description: Broken Authentication in Atlassian Connect Spring Boot (ACSB) in version 1.1.0 before 2.1.3 and from version 2.1.4 before 2.1.5: Atlassian Connect Spring Boot is a Java Spring Boot package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Spring Boot app occurs with a server-to-server JWT or a context JWT. Atlassian Connect Spring Boot versions 1.1.0 before 2.1.3 and versions 2.1.4 before 2.1.5 erroneously accept context JWTs in lifecycle endpoints (such as installation) where only server-to-server JWTs should be accepted, permitting an attacker to send authenticated re-installation events to an app.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287, CWE-287
References: https://community.developer.atlassian.com/t/action-required-atlassian-connect-vulnerability-allows-bypass-of-app-qsh-verification-via-context-jwts/47072; https://confluence.atlassian.com/pages/viewpage.action?pageId=[PII_REDACTED]; https://community.developer.atlassian.com/t/action-required-atlassian-connect-vulnerability-allows-bypass-of-app-qsh-verification-via-context-jwts/47072
CVE: CVE-2021-32471
Published: 2021-05-10
Description: Insufficient input validation in the Marvin Minsky 1967 implementation of the Universal Turing Machine allows program users to execute arbitrary code via crafted data. For example, a tape head may have an unexpected location after the processing of input composed of As and Bs (instead of 0s and 1s). NOTE: the discoverer states "this vulnerability has no real-world implications."
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://arxiv.org/abs/2105.02124; https://github.com/intrinsic-propensity/turing-machine; https://arxiv.org/abs/2105.02124
CVE: CVE-2021-3003
Published: 2021-05-10
Description: Agenzia delle Entrate Desktop Telematico 1.0.0 contacts the jws.agenziaentrate.it server over cleartext HTTP, which allows man-in-the-middle attackers to spoof product updates.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-319
References: https://fibonhack.github.io/2021/desktop-telematico-mitm-to-rce; https://telematici.agenziaentrate.gov.it/Main/Desktop.jsp; https://fibonhack.github.io/2021/desktop-telematico-mitm-to-rce
CVE: CVE-2021-20717
Published: 2021-05-10
Description: Cross-site scripting vulnerability in EC-CUBE 4.0.0 to 4.0.5 allows a remote attacker to inject a specially crafted script in the specific input field of the EC web site which is created using EC-CUBE. As a result, it may lead to an arbitrary script execution on the administrator's web browser.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN97554111/index.html; https://www.ec-cube.net/news/detail.php?news_id=383; https://www.ec-cube.net/news/detail.php?news_id=384
CVE: CVE-2021-25845
Published: 2021-05-10
Description: Improper validation of the ChassisID TLV in userdisk/vport_lldpd in Moxa Camera VPort 06EC-2V Series, version 1.1, allows attackers to cause a denial of service due to a NULL pointer dereference via a crafted lldp packet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://www.moxa.com/en/; https://www.moxa.com/en/support/product-support/security-advisory/vport-06ec-2v-series-ip-cameras-vulnerabilities; https://www.moxa.com/en/
CVE: CVE-2021-25846
Published: 2021-05-10
Description: Improper validation of the ChassisID TLV in userdisk/vport_lldpd in Moxa Camera VPort 06EC-2V Series, version 1.1, allows attackers to cause a denial of service due to a negative number passed to the memcpy function via a crafted lldp packet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-191
References: https://www.moxa.com/en/; https://www.moxa.com/en/support/product-support/security-advisory/vport-06ec-2v-series-ip-cameras-vulnerabilities; https://www.moxa.com/en/
CVE: CVE-2021-25847
Published: 2021-05-10
Description: Improper validation of the length field of LLDP-MED TLV in userdisk/vport_lldpd in Moxa Camera VPort 06EC-2V Series, version 1.1, allows information disclosure to attackers due to controllable loop counter variable via a crafted lldp packet.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: https://www.moxa.com/en/; https://www.moxa.com/en/support/product-support/security-advisory/vport-06ec-2v-series-ip-cameras-vulnerabilities; https://www.moxa.com/en/
CVE: CVE-2021-25848
Published: 2021-05-10
Description: Improper validation of the length field of LLDP-MED TLV in userdisk/vport_lldpd in Moxa Camera VPort 06EC-2V Series, version 1.1, allows information disclosure to attackers due to using fixed loop counter variable without checking the actual available length via a crafted lldp packet.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: https://www.moxa.com/en/; https://www.moxa.com/en/support/product-support/security-advisory/vport-06ec-2v-series-ip-cameras-vulnerabilities; https://www.moxa.com/en/
CVE: CVE-2021-25849
Published: 2021-05-10
Description: An integer underflow was discovered in userdisk/vport_lldpd in Moxa Camera VPort 06EC-2V Series, version 1.1, improper validation of the PortID TLV leads to Denial of Service via a crafted lldp packet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-191
References: https://www.moxa.com/en/; https://www.moxa.com/en/support/product-support/security-advisory/vport-06ec-2v-series-ip-cameras-vulnerabilities; https://www.moxa.com/en/
CVE: CVE-2021-31520
Published: 2021-05-10
Description: A weak session token authentication bypass vulnerability in Trend Micro IM Security 1.6 and 1.6.5 could allow an remote attacker to guess currently logged-in administrators' session session token in order to gain access to the product's web management interface.
CVSS Score: 8.1 (HIGH)
CWE: CWE-287
References: https://success.trendmicro.com/solution/000286439; https://www.zerodayinitiative.com/advisories/ZDI-21-525/; https://success.trendmicro.com/solution/000286439
CVE: CVE-2021-24011
Published: 2021-05-10
Description: A privilege escalation vulnerability in FortiNAC version below 8.8.2 may allow an admin user to escalate the privileges to root by abusing the sudo privileges.
CVSS Score: 6.3 (MEDIUM)
References: https://fortiguard.com/advisory/FG-IR-20-038; https://fortiguard.com/advisory/FG-IR-20-038
CVE: CVE-2020-22809
Published: 2021-05-10
Description: In Windscribe v1.83 Build 20, 'WindscribeService' has an Unquoted Service Path that facilitates privilege escalation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-428
References: https://www.exploit-db.com/exploits/48306; https://www.exploit-db.com/exploits/48306
CVE: CVE-2021-22672
Published: 2021-05-10
Description: Delta Electronics' CNCSoft ScreenEditor in versions prior to v1.01.30 could allow the corruption of data, a denial-of-service condition, or code execution. The vulnerability may allow an attacker to remotely execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-124-02; https://www.zerodayinitiative.com/advisories/ZDI-21-524/; https://us-cert.cisa.gov/ics/advisories/icsa-21-124-02
CVE: CVE-2021-25645
Published: 2021-05-10
Description: An issue was discovered in Couchbase Server before 6.0.5, 6.1.x through 6.5.x before 6.5.2, and 6.6.x before 6.6.1. An internal user with administrator privileges, @ns_server, leaks credentials in cleartext in the cbcollect_info.log, debug.log, ns_couchdb.log, indexer.log, and stats.log files. NOTE: updating the product does not automatically address leaks that occurred in the past.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-312
References: https://www.couchbase.com/downloads; https://www.couchbase.com/resources/security#SecurityAlerts; https://www.couchbase.com/downloads
CVE: CVE-2021-26583
Published: 2021-05-10
Description: A potential security vulnerability was identified in HPE iLO Amplifier Pack. The vulnerabilities could be remotely exploited to allow remote code execution.
CVSS Score: 9.8 (CRITICAL)
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn04129en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn04129en_us
CVE: CVE-2021-23008
Published: 2021-05-10
Description: On version 15.1.x before 15.1.3, 14.1.x before 14.1.4, 13.1.x before 13.1.4, 12.1.x before 12.1.6, and all versions of 16.0.x and 11.6.x., BIG-IP APM AD (Active Directory) authentication can be bypassed via a spoofed AS-REP (Kerberos Authentication Service Response) response sent over a hijacked KDC (Kerberos Key Distribution Center) connection or from an AD server compromised by an attacker. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://support.f5.com/csp/article/K51213246; https://support.f5.com/csp/article/K51213246
CVE: CVE-2021-23011
Published: 2021-05-10
Description: On versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.3, 14.1.x before 14.1.4, 13.1.x before 13.1.4, 12.1.x before 12.1.6, and 11.6.x before 11.6.5.3, when the BIG-IP system is buffering packet fragments for reassembly, the Traffic Management Microkernel (TMM) may consume an excessive amount of resources, eventually leading to a restart and failover event. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://support.f5.com/csp/article/K10751325; https://support.f5.com/csp/article/K10751325
CVE: CVE-2021-23013
Published: 2021-05-10
Description: On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.3, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, the Traffic Management Microkernel (TMM) may stop responding when processing Stream Control Transmission Protocol (SCTP) traffic under certain conditions. This vulnerability affects TMM by way of a virtual server configured with an SCTP profile. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
References: https://support.f5.com/csp/article/K04234247; https://support.f5.com/csp/article/K05300051; https://support.f5.com/csp/article/K04234247
CVE: CVE-2021-32056
Published: 2021-05-10
Description: Cyrus IMAP before 3.2.7, and 3.3.x and 3.4.x before 3.4.1, allows remote authenticated users to bypass intended access restrictions on server annotations and consequently cause replication to stall.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-732
References: https://cyrus.topicbox.com/groups/announce/T056901c106ecfce3/cyrus-imap-3-4-1-released; https://cyrus.topicbox.com/groups/announce/T126392718bc29d6b/cyrus-imap-3-2-7-released; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6HEO3RURJW6NLIXS7NK5PVU6MGHC4SCM/
CVE: CVE-2021-23009
Published: 2021-05-10
Description: On BIG-IP version 16.0.x before 16.0.1.1 and 15.1.x before 15.1.3, malformed HTTP/2 requests may cause an infinite loop which causes a Denial of Service for Data Plane traffic. TMM takes the configured HA action when the TMM process is aborted. There is no control plane exposure, this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: https://support.f5.com/csp/article/K90603426; https://support.f5.com/csp/article/K90603426
CVE: CVE-2021-23010
Published: 2021-05-10
Description: On versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.5, and 12.1.x before 12.1.5.3, when the BIG-IP ASM/Advanced WAF system processes WebSocket requests with JSON payloads using the default JSON Content Profile in the ASM Security Policy, the BIG-IP ASM bd process may produce a core file. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
References: https://support.f5.com/csp/article/K18570111; https://support.f5.com/csp/article/K18570111
CVE: CVE-2021-23012
Published: 2021-05-10
Description: On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.3, 14.1.x before 14.1.4, and 13.1.x before 13.1.4, lack of input validation for items used in the system support functionality may allow users granted either "Resource Administrator" or "Administrator" roles to execute arbitrary bash commands on BIG-IP. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 8.2 (HIGH)
CWE: CWE-78
References: https://support.f5.com/csp/article/K04234247; https://support.f5.com/csp/article/K04234247
CVE: CVE-2021-23014
Published: 2021-05-10
Description: On versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.3, and 14.1.x before 14.1.4, BIG-IP Advanced WAF and ASM are missing authorization checks for file uploads to a specific directory within the REST API which might allow Authenticated users with guest privileges to upload files. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://support.f5.com/csp/article/K23203045; https://support.f5.com/csp/article/K23203045
CVE: CVE-2021-23015
Published: 2021-05-10
Description: On BIG-IP 15.1.x before 15.1.3, 14.1.x before 14.1.4.2, 13.1.0.8 through 13.1.3.6, and all versions of 16.0.x, when running in Appliance Mode, an authenticated user assigned the 'Administrator' role may be able to bypass Appliance Mode restrictions utilizing undisclosed iControl REST endpoints. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.2 (HIGH)
CWE: CWE-863
References: https://support.f5.com/csp/article/K74151369; https://support.f5.com/csp/article/K74151369
CVE: CVE-2021-23016
Published: 2021-05-10
Description: On BIG-IP APM versions 15.1.x before 15.1.3, 14.1.x before 14.1.4.1, 13.1.x before 13.1.4, and all versions of 16.0.x, 12.1.x, and 11.6.x, an attacker may be able to bypass APM's internal restrictions and retrieve static content that is hosted within APM by sending specifically crafted requests to an APM Virtual Server. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 5.3 (MEDIUM)
References: https://support.f5.com/csp/article/K75540265; https://support.f5.com/csp/article/K75540265