deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-27866
Published: 2021-02-12
Description: This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6020, R6080, R6120, R6220, R6260, R6700v2, R6800, R6900v2, R7450, JNR3210, WNR2020, Nighthawk AC2100, and Nighthawk AC2400 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the mini_httpd service, which listens on TCP port 80 by default. The issue results from incorrect string matching logic when accessing protected pages. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-11355.
CVSS Score: 8.8 (HIGH)
CWE: CWE-288, CWE-287
References: https://kb.netgear.com/000062641/Security-Advisory-for-Password-Recovery-Vulnerabilities-on-Some-Routers; https://www.zerodayinitiative.com/advisories/ZDI-20-1451/; https://kb.netgear.com/000062641/Security-Advisory-for-Password-Recovery-Vulnerabilities-on-Some-Routers
CVE: CVE-2020-27867
Published: 2021-02-12
Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6020, R6080, R6120, R6220, R6260, R6700v2, R6800, R6900v2, R7450, JNR3210, WNR2020, Nighthawk AC2100, and Nighthawk AC2400 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the mini_httpd service, which listens on TCP port 80 by default. When parsing the funjsq_access_token parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-11653.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-77, CWE-77
References: https://kb.netgear.com/000062641/Security-Advisory-for-Password-Recovery-Vulnerabilities-on-Some-Routers; https://www.zerodayinitiative.com/advisories/ZDI-20-1423/; https://kb.netgear.com/000062641/Security-Advisory-for-Password-Recovery-Vulnerabilities-on-Some-Routers
CVE: CVE-2020-27868
Published: 2021-02-12
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Qognify Ocularis 5.9.0.395. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of serialized objects provided to the EventCoordinator endpoint. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-11257.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://www.qognify.com/support-training/software-downloads/; https://www.zerodayinitiative.com/advisories/ZDI-20-1453/; https://www.qognify.com/support-training/software-downloads/
CVE: CVE-2020-27869
Published: 2021-02-12
Description: This vulnerability allows remote attackers to escalate privileges on affected installations of SolarWinds Network Performance Monitor 2020 HF1, NPM: 2020.2. Authentication is required to exploit this vulnerability. The specific flaw exists within the WriteToFile method. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to escalate privileges and reset the password for the Admin user. Was ZDI-CAN-11804.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.zerodayinitiative.com/advisories/ZDI-21-064/; https://www.zerodayinitiative.com/advisories/ZDI-21-064/
CVE: CVE-2021-27190
Published: 2021-02-12
Description: A Stored Cross Site Scripting(XSS) Vulnerability was discovered in PEEL SHOPPING 9.3.0 and 9.4.0, which are publicly available. The user supplied input containing polyglot payload is echoed back in javascript code in HTML response. This allows an attacker to input malicious JavaScript which can steal cookie, redirect them to other malicious website, etc.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/advisto/peel-shopping/issues/4#issuecomment-953461611; https://github.com/anmolksachan/CVE-2021-27190-PEEL-Shopping-cart-9.3.0-Stored-XSS; https://github.com/vulf/Peel-Shopping-cart-9.4.0-Stored-XSS
CVE: CVE-2021-20635
Published: 2021-02-12
Description: Improper restriction of excessive authentication attempts in LOGITEC LAN-WH450N/GR allows an attacker in the wireless range of the device to recover PIN and access the network.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-307
References: https://jvn.jp/en/jp/JVN96783542/index.html; https://www.elecom.co.jp/news/security/20210126-01/; https://jvn.jp/en/jp/JVN96783542/index.html
CVE: CVE-2021-20636
Published: 2021-02-12
Description: Cross-site request forgery (CSRF) vulnerability in LOGITEC LAN-W300N/PR5B allows remote attackers to hijack the authentication of administrators via a specially crafted URL. As a result, unintended operations to the device such as changes of the device settings may be conducted.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://jvn.jp/en/jp/JVN96783542/index.html; https://www.elecom.co.jp/news/security/20210126-01/; https://jvn.jp/en/jp/JVN96783542/index.html
CVE: CVE-2021-20637
Published: 2021-02-12
Description: Improper check or handling of exceptional conditions in LOGITEC LAN-W300N/PR5B allows a remote attacker to cause a denial-of-service (DoS) condition by sending a specially crafted URL.
CVSS Score: 6.5 (MEDIUM)
References: https://jvn.jp/en/jp/JVN96783542/index.html; https://www.elecom.co.jp/news/security/20210126-01/; https://jvn.jp/en/jp/JVN96783542/index.html
CVE: CVE-2021-20638
Published: 2021-02-12
Description: LOGITEC LAN-W300N/PGRB allows an attacker with administrative privilege to execute arbitrary OS commands via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-78
References: https://jvn.jp/en/jp/JVN96783542/index.html; https://www.elecom.co.jp/news/security/20210126-01/; https://jvn.jp/en/jp/JVN96783542/index.html
CVE: CVE-2021-20639
Published: 2021-02-12
Description: LOGITEC LAN-W300N/PGRB allows an attacker with administrative privilege to execute arbitrary OS commands via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-78
References: https://jvn.jp/en/jp/JVN96783542/index.html; https://www.elecom.co.jp/news/security/20210126-01/; https://jvn.jp/en/jp/JVN96783542/index.html
CVE: CVE-2021-20640
Published: 2021-02-12
Description: Buffer overflow vulnerability in LOGITEC LAN-W300N/PGRB allows an attacker with administrative privilege to execute an arbitrary OS command via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-120
References: https://jvn.jp/en/jp/JVN96783542/index.html; https://lists.apache.org/thread.html/rc1778b38e74b5b6142414d57623bd55b023a72361f422836782fca3c%40%3Cdev.tomcat.apache.org%3E; https://www.elecom.co.jp/news/security/20210126-01/
CVE: CVE-2021-20641
Published: 2021-02-12
Description: Cross-site request forgery (CSRF) vulnerability in LOGITEC LAN-W300N/RS allows remote attackers to hijack the authentication of administrators via a specially crafted URL. As a result, unintended operations to the device such as changes of the device settings may be conducted.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://jvn.jp/en/jp/JVN96783542/index.html; https://www.elecom.co.jp/news/security/20210126-01/; https://jvn.jp/en/jp/JVN96783542/index.html
CVE: CVE-2021-20642
Published: 2021-02-12
Description: Improper check or handling of exceptional conditions in LOGITEC LAN-W300N/RS allows a remote attacker to cause a denial-of-service (DoS) condition by sending a specially crafted URL.
CVSS Score: 6.5 (MEDIUM)
References: https://jvn.jp/en/jp/JVN96783542/index.html; https://www.elecom.co.jp/news/security/20210126-01/; https://jvn.jp/en/jp/JVN96783542/index.html
CVE: CVE-2021-20643
Published: 2021-02-12
Description: Improper access control vulnerability in ELECOM LD-PS/U1 allows remote attackers to change the administrative password of the affected device by processing a specially crafted request.
CVSS Score: 7.5 (HIGH)
References: https://jvn.jp/en/jp/JVN47580234/index.html; https://www.elecom.co.jp/news/security/20210126-01/; https://jvn.jp/en/jp/JVN47580234/index.html
CVE: CVE-2021-20644
Published: 2021-02-12
Description: ELECOM WRC-1467GHBK-A allows arbitrary scripts to be executed on the user's web browser by displaying a specially crafted SSID on the web setup page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-74
References: https://jvn.jp/en/jp/JVN47580234/index.html; https://www.elecom.co.jp/news/security/20210126-01/; https://jvn.jp/en/jp/JVN47580234/index.html
CVE: CVE-2021-20645
Published: 2021-02-12
Description: Cross-site scripting vulnerability in ELECOM WRC-300FEBK-A allows remote authenticated attackers to inject arbitrary script via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN47580234/index.html; https://www.elecom.co.jp/news/security/20210126-01/; https://jvn.jp/en/jp/JVN47580234/index.html
CVE: CVE-2021-20646
Published: 2021-02-12
Description: Cross-site request forgery (CSRF) vulnerability in ELECOM WRC-300FEBK-A allows remote attackers to hijack the authentication of administrators and execute an arbitrary request via unspecified vector. As a result, the device settings may be altered and/or telnet daemon may be started.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://jvn.jp/en/jp/JVN47580234/index.html; https://www.elecom.co.jp/news/security/20210126-01/; https://jvn.jp/en/jp/JVN47580234/index.html
CVE: CVE-2021-20647
Published: 2021-02-12
Description: Cross-site request forgery (CSRF) vulnerability in ELECOM WRC-300FEBK-S allows remote attackers to hijack the authentication of administrators and execute an arbitrary request via unspecified vector. As a result, the device settings may be altered and/or telnet daemon may be started.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://jvn.jp/en/jp/JVN47580234/index.html; https://www.elecom.co.jp/news/security/20210126-01/; https://jvn.jp/en/jp/JVN47580234/index.html
CVE: CVE-2021-20648
Published: 2021-02-12
Description: ELECOM WRC-300FEBK-S allows an attacker with administrator rights to execute arbitrary OS commands via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-78
References: https://jvn.jp/en/jp/JVN47580234/index.html; https://www.elecom.co.jp/news/security/20210126-01/; https://jvn.jp/en/jp/JVN47580234/index.html
CVE: CVE-2021-20649
Published: 2021-02-12
Description: ELECOM WRC-300FEBK-S contains an improper certificate validation vulnerability. Via a man-in-the-middle attack, an attacker may alter the communication response. As a result, an arbitrary OS command may be executed on the affected device.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-295
References: https://jvn.jp/en/jp/JVN47580234/index.html; https://www.elecom.co.jp/news/security/20210126-01/; https://jvn.jp/en/jp/JVN47580234/index.html
CVE: CVE-2021-20650
Published: 2021-02-12
Description: Cross-site request forgery (CSRF) vulnerability in ELECOM NCC-EWF100RMWH2 allows remote attackers to hijack the authentication of administrators and execute an arbitrary request via unspecified vector. As a result, the device settings may be altered and/or telnet daemon may be started.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://jvn.jp/en/jp/JVN47580234/index.html; https://www.elecom.co.jp/news/security/20210126-01/; https://jvn.jp/en/jp/JVN47580234/index.html
CVE: CVE-2021-20651
Published: 2021-02-12
Description: Directory traversal vulnerability in ELECOM File Manager all versions allows remote attackers to create an arbitrary file or overwrite an existing file in a directory which can be accessed with the application privileges via unspecified vectors.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: https://jvn.jp/en/jp/JVN98115035/index.html; https://www.elecom.co.jp/news/security/20210126-01/; https://jvn.jp/en/jp/JVN98115035/index.html
CVE: CVE-2021-27187
Published: 2021-02-12
Description: The Sovremennye Delovye Tekhnologii FX Aggregator terminal client 1 stores authentication credentials in cleartext in login.sav when the Save Password box is checked.
CVSS Score: 7.5 (HIGH)
CWE: CWE-522
References: https://github.com/jet-pentest/CVE-2021-27187; https://www.dnb.com/business-directory/company-profiles.pryaniki_ooo.13b676c626e38d534ff1a6a2a9fc7e6a.html; https://github.com/jet-pentest/CVE-2021-27187
CVE: CVE-2021-27188
Published: 2021-02-12
Description: The Sovremennye Delovye Tekhnologii FX Aggregator terminal client 1 allows attackers to cause a denial of service (access suspended for five hours) by making five invalid login attempts to a victim's account.
CVSS Score: 7.5 (HIGH)
CWE: CWE-307
References: https://github.com/jet-pentest/CVE-2021-27188; https://www.dnb.com/business-directory/company-profiles.pryaniki_ooo.13b676c626e38d534ff1a6a2a9fc7e6a.html; https://github.com/jet-pentest/CVE-2021-27188
CVE: CVE-2021-27204
Published: 2021-02-12
Description: Telegram before 7.4 (212543) Stable on macOS stores the local passcode in cleartext, leading to information disclosure.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-312
References: https://www.inputzero.io/2020/12/telegram-privacy-fails-again.html; https://www.youtube.com/watch?v=zEt-_5b4OaA; https://www.inputzero.io/2020/12/telegram-privacy-fails-again.html
CVE: CVE-2021-27205
Published: 2021-02-12
Description: Telegram before 7.4 (212543) Stable on macOS stores the local copy of self-destructed messages in a sandbox path, leading to sensitive information disclosure.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-312
References: https://www.inputzero.io/2020/12/telegram-privacy-fails-again.html; https://www.youtube.com/watch?v=Go-4srm_1fQ; https://www.inputzero.io/2020/12/telegram-privacy-fails-again.html
CVE: CVE-2021-27197
Published: 2021-02-12
Description: DSUtility.dll in Pelco Digital Sentry Server before 7.19.67 has an arbitrary file write vulnerability. The AppendToTextFile method doesn't check if it's being called from the application or from a malicious user. The vulnerability is triggered when a remote attacker crafts an HTML page (e.g., with "OBJECT classid=" and "<SCRIPT language='vbscript'>") to overwrite arbitrary files.
CVSS Score: 8.1 (HIGH)
CWE: CWE-346
References: https://github.com/vitorespf/Advisories/blob/master/Pelco_Digital_Sentry_Server_AFW.txt; https://support.pelco.com/s/article/What-is-the-Digital-Sentry-software-release-revision-history; https://github.com/vitorespf/Advisories/blob/master/Pelco_Digital_Sentry_Server_AFW.txt
CVE: CVE-2021-20406
Published: 2021-02-12
Description: IBM Security Verify Information Queue 1.0.6 and 1.0.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 196184.
CVSS Score: 2.2 (LOW)
CWE: CWE-326, CWE-327
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/196184; https://www.ibm.com/support/pages/node/6414763; https://exchange.xforce.ibmcloud.com/vulnerabilities/196184
CVE: CVE-2021-20407
Published: 2021-02-12
Description: IBM Security Verify Information Queue 1.0.6 and 1.0.7 discloses sensitive information in source code that could be used in further attacks against the system.  IBM X-Force ID:  196185.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-312
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/196185; https://www.ibm.com/support/pages/node/6414765; https://exchange.xforce.ibmcloud.com/vulnerabilities/196185
CVE: CVE-2021-20408
Published: 2021-02-12
Description: IBM Security Verify Information Queue 1.0.6 and 1.0.7 could disclose highly sensitive information to a local user due to inproper storage of a plaintext cryptographic key. IBM X-Force ID: 198187.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-312
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/196187; https://www.ibm.com/support/pages/node/6414767; https://exchange.xforce.ibmcloud.com/vulnerabilities/196187
CVE: CVE-2021-20409
Published: 2021-02-12
Description: IBM Security Verify Information Queue 1.0.6 and 1.0.7 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 196188.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-319
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/196188; https://www.ibm.com/support/pages/node/6414771; https://exchange.xforce.ibmcloud.com/vulnerabilities/196188
CVE: CVE-2021-20410
Published: 2021-02-12
Description: IBM Security Verify Information Queue 1.0.6 and 1.0.7 sends user credentials in plain clear text which can be read by an authenticated user using man in the middle techniques. IBM X-Force ID: 198190.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-522
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/196190; https://www.ibm.com/support/pages/node/6414773; https://exchange.xforce.ibmcloud.com/vulnerabilities/196190
CVE: CVE-2021-20411
Published: 2021-02-12
Description: IBM Security Verify Information Queue 1.0.6 and 1.0.7 could allow a user to impersonate another user on the system due to incorrectly updating the session identifier. IBM X-Force ID: 198191.
CVSS Score: 8.1 (HIGH)
CWE: CWE-669
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/196191; https://www.ibm.com/support/pages/node/6414777; https://exchange.xforce.ibmcloud.com/vulnerabilities/196191
CVE: CVE-2021-20412
Published: 2021-02-12
Description: IBM Security Verify Information Queue 1.0.6 and 1.0.7 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 198192.
CVSS Score: 7.5 (HIGH)
CWE: CWE-798
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/196192; https://www.ibm.com/support/pages/node/6414779; https://exchange.xforce.ibmcloud.com/vulnerabilities/196192
CVE: CVE-2021-22973
Published: 2021-02-12
Description: On BIG-IP version 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.5, and all 12.1.x versions, JSON parser function does not protect against out-of-bounds memory accesses or writes. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://support.f5.com/csp/article/K13323323; https://support.f5.com/csp/article/K13323323
CVE: CVE-2021-22974
Published: 2021-02-12
Description: On BIG-IP version 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, and 13.1.x before 13.1.3.6 and all versions of BIG-IQ 7.x and 6.x, an authenticated attacker with access to iControl REST over the control plane may be able to take advantage of a race condition to execute commands with an elevated privilege level. This vulnerability is due to an incomplete fix for CVE-2017-6167. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-362
References: https://support.f5.com/csp/article/K68652018; https://support.f5.com/csp/article/K68652018
CVE: CVE-2021-22975
Published: 2021-02-12
Description: On BIG-IP version 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, and 14.1.x before 14.1.3.1, under some circumstances, Traffic Management Microkernel (TMM) may restart on the BIG-IP system while passing large bursts of traffic. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
CVSS Score: 7.5 (HIGH)
References: https://support.f5.com/csp/article/K21971977; https://support.f5.com/csp/article/K21971977
CVE: CVE-2021-22976
Published: 2021-02-12
Description: On BIG-IP Advanced WAF and ASM version 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.6, and all 12.1.x versions, when the BIG-IP ASM system processes WebSocket requests with JSON payloads, an unusually large number of parameters can cause excessive CPU usage in the BIG-IP ASM bd process. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
CVSS Score: 7.5 (HIGH)
References: https://support.f5.com/csp/article/K88230177; https://support.f5.com/csp/article/K88230177
CVE: CVE-2021-22979
Published: 2021-02-12
Description: On BIG-IP version 16.0.x before 16.0.1, 15.1.x before 15.1.1, 14.1.x before 14.1.2.8, 13.1.x before 13.1.3.5, and all 12.1.x versions, a reflected Cross-Site Scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility when Fraud Protection Service is provisioned and allows an attacker to execute JavaScript in the context of the current logged-in user. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://support.f5.com/csp/article/K63497634; https://support.f5.com/csp/article/K63497634
CVE: CVE-2021-22980
Published: 2021-02-12
Description: In Edge Client version 7.2.x before 7.2.1.1, 7.1.9.x before 7.1.9.8, and 7.1.x-7.1.8.x before 7.1.8.5, an untrusted search path vulnerability in the BIG-IP APM Client Troubleshooting Utility (CTU) for Windows could allow an attacker to load a malicious DLL library from its current directory. User interaction is required to exploit this vulnerability in that the victim must run this utility on the Windows system. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://support.f5.com/csp/article/K29282483; https://support.f5.com/csp/article/K29282483
CVE: CVE-2021-22981
Published: 2021-02-12
Description: On all versions of BIG-IP 12.1.x and 11.6.x, the original TLS protocol includes a weakness in the master secret negotiation that is mitigated by the Extended Master Secret (EMS) extension defined in RFC 7627. TLS connections that do not use EMS are vulnerable to man-in-the-middle attacks during renegotiation. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
CVSS Score: 4.8 (MEDIUM)
References: https://support.f5.com/csp/article/K09121542; https://support.f5.com/csp/article/K09121542
CVE: CVE-2021-22982
Published: 2021-02-12
Description: On BIG-IP DNS and GTM version 13.1.x before 13.1.0.4, and all versions of 12.1.x and 11.6.x, big3d does not securely handle and parse certain payloads resulting in a buffer overflow. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
CVSS Score: 7.2 (HIGH)
CWE: CWE-120
References: https://support.f5.com/csp/article/K72708443; https://support.f5.com/csp/article/K72708443
CVE: CVE-2021-22983
Published: 2021-02-12
Description: On BIG-IP AFM version 15.1.x before 15.1.1, 14.1.x before 14.1.3.1, and 13.1.x before 13.1.3.5, authenticated users accessing the Configuration utility for AFM are vulnerable to a cross-site scripting attack if they attempt to access a maliciously-crafted URL. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://support.f5.com/csp/article/K76518456; https://support.f5.com/csp/article/K76518456
CVE: CVE-2021-22985
Published: 2021-02-12
Description: On BIG-IP APM version 16.0.x before 16.0.1.1, under certain conditions, when processing VPN traffic with APM, TMM consumes excessive memory. A malicious, authenticated VPN user may abuse this to perform a DoS attack against the APM. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://support.f5.com/csp/article/K88162221; https://support.f5.com/csp/article/K88162221