deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-25213
Published: 2024-02-14
Description: Employee Managment System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /edit.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/BurakSevben/CVEs/blob/main/Employee%20Management%20System/Employee%20Managment%20System%20-%20SQL%20Injection%20-%203.md; https://github.com/BurakSevben/CVEs/blob/main/Employee%20Management%20System/Employee%20Managment%20System%20-%20SQL%20Injection%20-%203.md
CVE: CVE-2024-25214
Published: 2024-02-14
Description: An issue in Employee Managment System v1.0 allows attackers to bypass authentication via injecting a crafted payload into the E-mail and Password parameters at /alogin.html.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/BurakSevben/CVEs/blob/main/Employee%20Management%20System/Employee%20Managment%20System%20-%20Authentication%20Bypass.md; https://github.com/BurakSevben/CVEs/blob/main/Employee%20Management%20System/Employee%20Managment%20System%20-%20Authentication%20Bypass.md
CVE: CVE-2024-25215
Published: 2024-02-14
Description: Employee Managment System v1.0 was discovered to contain a SQL injection vulnerability via the pwd parameter at /aprocess.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/BurakSevben/CVEs/blob/main/Employee%20Management%20System/Employee%20Managment%20System%20-%20SQL%20Injection%20-%202.md; https://github.com/BurakSevben/CVEs/blob/main/Employee%20Management%20System/Employee%20Managment%20System%20-%20SQL%20Injection%20-%202.md
CVE: CVE-2024-25216
Published: 2024-02-14
Description: Employee Managment System v1.0 was discovered to contain a SQL injection vulnerability via the mailud parameter at /aprocess.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/BurakSevben/CVEs/blob/main/Employee%20Management%20System/Employee%20Managment%20System%20-%20SQL%20Injection%20-%201.md; https://github.com/BurakSevben/CVEs/blob/main/Employee%20Management%20System/Employee%20Managment%20System%20-%20SQL%20Injection%20-%201.md
CVE: CVE-2024-25217
Published: 2024-02-14
Description: Online Medicine Ordering System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /omos/?p=products/view_product.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/BurakSevben/CVEs/blob/main/Online%20Medicine%20Ordering%20System/OMOS%20-%20SQL%20Injection%28Unauthenticated%29.md; https://github.com/BurakSevben/CVEs/blob/main/Online%20Medicine%20Ordering%20System/OMOS%20-%20SQL%20Injection%28Unauthenticated%29.md
CVE: CVE-2024-25218
Published: 2024-02-14
Description: A cross-site scripting (XSS) vulnerability in Task Manager App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Project Name parameter /TaskManager/Projects.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/BurakSevben/CVEs/blob/main/Task%20Manager%20App/Task%20Manager%20App%20-%20Cross-Site-Scripting%20-1.md; https://github.com/BurakSevben/CVEs/blob/main/Task%20Manager%20App/Task%20Manager%20App%20-%20Cross-Site-Scripting%20-1.md
CVE: CVE-2024-25219
Published: 2024-02-14
Description: A cross-site scripting (XSS) vulnerability in Task Manager App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Task Name parameter /TaskManager/Task.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/BurakSevben/CVEs/blob/main/Task%20Manager%20App/Task%20Manager%20App%20-%20Cross-Site-Scripting%20-%202.md; https://github.com/BurakSevben/CVEs/blob/main/Task%20Manager%20App/Task%20Manager%20App%20-%20Cross-Site-Scripting%20-%202.md
CVE: CVE-2024-25220
Published: 2024-02-14
Description: Task Manager App v1.0 was discovered to contain a SQL injection vulnerability via the taskID parameter at /TaskManager/EditTask.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/BurakSevben/CVEs/blob/main/Task%20Manager%20App/Task%20Manager%20App%20-%20SQL%20Injection%20-%202.md; https://github.com/BurakSevben/CVEs/blob/main/Task%20Manager%20App/Task%20Manager%20App%20-%20SQL%20Injection%20-%202.md
CVE: CVE-2024-25221
Published: 2024-02-14
Description: A cross-site scripting (XSS) vulnerability in Task Manager App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Note Section parameter at /TaskManager/Tasks.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/BurakSevben/CVEs/blob/main/Task%20Manager%20App/Task%20Manager%20App%20-%20Cross-Site-Scripting%20-3.md; https://github.com/BurakSevben/CVEs/blob/main/Task%20Manager%20App/Task%20Manager%20App%20-%20Cross-Site-Scripting%20-3.md
CVE: CVE-2024-25222
Published: 2024-02-14
Description: Task Manager App v1.0 was discovered to contain a SQL injection vulnerability via the projectID parameter at /TaskManager/EditProject.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/BurakSevben/CVEs/blob/main/Task%20Manager%20App/Task%20Manager%20App%20-%20SQL%20Injection%20-%201.md; https://github.com/BurakSevben/CVEs/blob/main/Task%20Manager%20App/Task%20Manager%20App%20-%20SQL%20Injection%20-%201.md
CVE: CVE-2024-25223
Published: 2024-02-14
Description: Simple Admin Panel App v1.0 was discovered to contain a SQL injection vulnerability via the orderID parameter at /adminView/viewEachOrder.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/BurakSevben/CVEs/blob/main/Simple%20Admin%20Panel%20App/Simple%20Admin%20Panel%20App%20-%20SQL%20Injection.md; https://github.com/BurakSevben/CVEs/blob/main/Simple%20Admin%20Panel%20App/Simple%20Admin%20Panel%20App%20-%20SQL%20Injection.md
CVE: CVE-2024-25224
Published: 2024-02-14
Description: A cross-site scripting (XSS) vulnerability in Simple Admin Panel App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Size Number parameter under the Add Size function.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/BurakSevben/CVEs/blob/main/Simple%20Admin%20Panel%20App/Simple%20Admin%20Panel%20App%20-%20Cross-Site-Scripting%20-%202.md; https://github.com/BurakSevben/CVEs/blob/main/Simple%20Admin%20Panel%20App/Simple%20Admin%20Panel%20App%20-%20Cross-Site-Scripting%20-%202.md
CVE: CVE-2024-25225
Published: 2024-02-14
Description: A cross-site scripting (XSS) vulnerability in Simple Admin Panel App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Category Name parameter under the Add Category function.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/BurakSevben/CVEs/blob/main/Simple%20Admin%20Panel%20App/Simple%20Admin%20Panel%20App%20-%20Cross-Site-Scripting%20-%201.md; https://github.com/BurakSevben/CVEs/blob/main/Simple%20Admin%20Panel%20App/Simple%20Admin%20Panel%20App%20-%20Cross-Site-Scripting%20-%201.md
CVE: CVE-2024-25226
Published: 2024-02-14
Description: A cross-site scripting (XSS) vulnerability in Simple Admin Panel App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Category Name parameter under the Add Category function.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/BurakSevben/CVEs/blob/main/Supplier%20Managment%20System/Supplier%20Managment%20System%20-%20SQL%20Injection.md; https://github.com/BurakSevben/CVEs/blob/main/Supplier%20Managment%20System/Supplier%20Managment%20System%20-%20SQL%20Injection.md
CVE: CVE-2023-50387
Published: 2024-02-14
Description: Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770, CWE-770
References: http://www.openwall.com/lists/oss-security/2024/02/16/2; http://www.openwall.com/lists/oss-security/2024/02/16/3; https://access.redhat.com/security/cve/CVE-2023-50387
CVE: CVE-2023-50868
Published: 2024-02-14
Description: The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the "NSEC3" issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://www.openwall.com/lists/oss-security/2024/02/16/2; http://www.openwall.com/lists/oss-security/2024/02/16/3; https://access.redhat.com/security/cve/CVE-2023-50868
CVE: CVE-2023-27975
Published: 2024-02-14
Description: 
CWE-522: Insufficiently Protected Credentials vulnerability exists that could cause unauthorized
access to the project file in EcoStruxure Control Expert when a local user tampers with the
memory of the engineering workstation.


CVSS Score: 7.1 (HIGH)
CWE: CWE-522
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-044-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-044-01.pdf; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-044-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-044-01.pdf
CVE: CVE-2023-38137
Published: 2024-02-14
Description: Rejected reason: This is unused.
CVE: CVE-2023-38262
Published: 2024-02-14
Description: Rejected reason: This is unused.
CVE: CVE-2023-39450
Published: 2024-02-14
Description: Rejected reason: This is unused.
CVE: CVE-2023-42437
Published: 2024-02-14
Description: Rejected reason: This is unused.
CVE: CVE-2023-42665
Published: 2024-02-14
Description: Rejected reason: This is unused.
CVE: CVE-2023-42775
Published: 2024-02-14
Description: Rejected reason: This is unused.
CVE: CVE-2023-43749
Published: 2024-02-14
Description: Rejected reason: This is unused.
CVE: CVE-2023-45224
Published: 2024-02-14
Description: Rejected reason: This is unused.
CVE: CVE-2023-45738
Published: 2024-02-14
Description: Rejected reason: This is unused.
CVE: CVE-2023-45850
Published: 2024-02-14
Description: Rejected reason: This is unused.
CVE: CVE-2023-48729
Published: 2024-02-14
Description: Rejected reason: This is unused.
CVE: CVE-2023-48734
Published: 2024-02-14
Description: Rejected reason: This is unused.
CVE: CVE-2023-49588
Published: 2024-02-14
Description: Rejected reason: This is unused.
CVE: CVE-2023-49590
Published: 2024-02-14
Description: Rejected reason: This is unused.
CVE: CVE-2023-49609
Published: 2024-02-14
Description: Rejected reason: This is unused.
CVE: CVE-2023-49611
Published: 2024-02-14
Description: Rejected reason: This is unused.
CVE: CVE-2023-49710
Published: 2024-02-14
Description: Rejected reason: This is unused.
CVE: CVE-2023-49712
Published: 2024-02-14
Description: Rejected reason: This is unused.
CVE: CVE-2023-49811
Published: 2024-02-14
Description: Rejected reason: This is unused.
CVE: CVE-2023-49870
Published: 2024-02-14
Description: Rejected reason: This is unused.
CVE: CVE-2023-49872
Published: 2024-02-14
Description: Rejected reason: This is unused.
CVE: CVE-2023-50170
Published: 2024-02-14
Description: Rejected reason: This is unused.
CVE: CVE-2023-50174
Published: 2024-02-14
Description: Rejected reason: This is unused.
CVE: CVE-2023-50241
Published: 2024-02-14
Description: Rejected reason: This is unused.
CVE: CVE-2023-50293
Published: 2024-02-14
Description: Rejected reason: This is unused.
CVE: CVE-2023-50329
Published: 2024-02-14
Description: Rejected reason: This is unused.
CVE: CVE-2023-50335
Published: 2024-02-14
Description: Rejected reason: This is unused.
CVE: CVE-2023-50336
Published: 2024-02-14
Description: Rejected reason: This is unused.
CVE: CVE-2023-50337
Published: 2024-02-14
Description: Rejected reason: This is unused.
CVE: CVE-2023-51754
Published: 2024-02-14
Description: Rejected reason: This is unused.
CVE: CVE-2023-51755
Published: 2024-02-14
Description: Rejected reason: This is unused.
CVE: CVE-2023-52392
Published: 2024-02-14
Description: Rejected reason: This is unused.
CVE: CVE-2023-52395
Published: 2024-02-14
Description: Rejected reason: This is unused.
CVE: CVE-2023-52396
Published: 2024-02-14
Description: Rejected reason: This is unused.
CVE: CVE-2023-52398
Published: 2024-02-14
Description: Rejected reason: This is unused.
CVE: CVE-2023-52399
Published: 2024-02-14
Description: Rejected reason: This is unused.
CVE: CVE-2023-6408
Published: 2024-02-14
Description: 
CWE-924: Improper Enforcement of Message Integrity During Transmission in a
Communication Channel vulnerability exists that could cause a denial of service and loss of
confidentiality, integrity of controllers when conducting a Man in the Middle attack.


CVSS Score: 8.1 (HIGH)
CWE: CWE-924
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-044-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-044-01.pdf; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-044-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-044-01.pdf
CVE: CVE-2023-6409
Published: 2024-02-14
Description: 
CWE-798: Use of Hard-coded Credentials vulnerability exists that could cause unauthorized
access to a project file protected with application password when opening the file with
EcoStruxure Control Expert.


CVSS Score: 7.7 (HIGH)
CWE: CWE-798
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-044-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-044-01.pdf; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-044-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-044-01.pdf
CVE: CVE-2024-0568
Published: 2024-02-14
Description: 
CWE-287: Improper Authentication vulnerability exists that could cause unauthorized tampering
of device configuration over NFC communication.


CVSS Score: 8.8 (HIGH)
CWE: CWE-287
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-044-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-044-02.pdf; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-044-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-044-02.pdf
CVE: CVE-2024-21763
Published: 2024-02-14
Description: 
When BIG-IP AFM Device DoS or DoS profile is configured with NXDOMAIN attack vector and bad actor detection, undisclosed queries can cause the Traffic Management Microkernel (TMM) to terminate.  NOTE: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://my.f5.com/manage/s/article/K000137521; https://my.f5.com/manage/s/article/K000137521
CVE: CVE-2024-21771
Published: 2024-02-14
Description: 
For unspecified traffic patterns, BIG-IP AFM IPS engine may spend an excessive amount of time matching the traffic against signatures, resulting in Traffic Management Microkernel (TMM) restarting and traffic disruption.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS Score: 7.5 (HIGH)
CWE: CWE-770, CWE-770
References: https://my.f5.com/manage/s/article/K000137595; https://my.f5.com/manage/s/article/K000137595
CVE: CVE-2024-21782
Published: 2024-02-14
Description: BIG-IP or BIG-IQ Resource Administrators and Certificate Managers who have access to the secure copy (scp) utility but do not have access to Advanced shell (bash) can execute arbitrary commands with a specially crafted command string. This vulnerability is due to an incomplete fix for CVE-2020-5873. 


Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-78, CWE-78
References: https://my.f5.com/manage/s/article/K98606833; https://my.f5.com/manage/s/article/K98606833
CVE: CVE-2024-21789
Published: 2024-02-14
Description: 


When a BIG-IP ASM/Advanced WAF security policy is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization.
 Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS Score: 7.5 (HIGH)
CWE: CWE-772, CWE-772
References: https://my.f5.com/manage/s/article/K000137270; https://my.f5.com/manage/s/article/K000137270
CVE: CVE-2024-21849
Published: 2024-02-14
Description: 


When an Advanced WAF/ASM security policy and a Websockets profile are configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) process to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-466
References: https://my.f5.com/manage/s/article/K000135873; https://my.f5.com/manage/s/article/K000135873
CVE: CVE-2024-22093
Published: 2024-02-14
Description: When running in appliance mode, an authenticated remote command injection vulnerability exists in an undisclosed iControl REST endpoint on multi-bladed systems. A successful exploit can allow the attacker to cross a security boundary.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS Score: 8.7 (HIGH)
CWE: CWE-77, CWE-77
References: https://my.f5.com/manage/s/article/K000137522; https://my.f5.com/manage/s/article/K000137522
CVE: CVE-2024-22389
Published: 2024-02-14
Description: When BIG-IP is deployed in high availability (HA) and an iControl REST API token is updated, the change does not sync to the peer device.  


Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS Score: 7.2 (HIGH)
CWE: CWE-613
References: https://my.f5.com/manage/s/article/K32544615; https://my.f5.com/manage/s/article/K32544615
CVE: CVE-2024-23306
Published: 2024-02-14
Description: A vulnerability exists in BIG-IP Next CNF and SPK systems that may allow access to undisclosed sensitive files.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS Score: 7.1 (HIGH)
CWE: CWE-522
References: https://my.f5.com/manage/s/article/K000137886; https://my.f5.com/manage/s/article/K000137886
CVE: CVE-2024-23308
Published: 2024-02-14
Description: 
When a BIG-IP Advanced WAF or BIG-IP ASM policy with a Request Body Handling option is attached to a virtual server, undisclosed requests can cause the BD process to terminate. The condition results from setting the Request Body Handling option in the Header-Based Content Profile for an Allowed URL with "Apply value and content signatures and detect threat campaigns."  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://my.f5.com/manage/s/article/K000137416; https://my.f5.com/manage/s/article/K000137416
CVE: CVE-2024-23314
Published: 2024-02-14
Description: When HTTP/2 is configured on BIG-IP or BIG-IP Next SPK systems, undisclosed responses can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS Score: 7.5 (HIGH)
CWE: CWE-908
References: https://my.f5.com/manage/s/article/K000137675; https://my.f5.com/manage/s/article/K000137675
CVE: CVE-2024-23603
Published: 2024-02-14
Description: 
An SQL injection vulnerability exists in an undisclosed page of the BIG-IP Configuration utility.

 


Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS Score: 3.8 (LOW)
CWE: CWE-89, CWE-89
References: https://my.f5.com/manage/s/article/K000138047; https://my.f5.com/manage/s/article/K000138047
CVE: CVE-2024-23607
Published: 2024-02-14
Description: 
A directory traversal vulnerability exists in the F5OS QKView utility that allows an authenticated attacker to read files outside the QKView directory.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://my.f5.com/manage/s/article/K000132800; https://my.f5.com/manage/s/article/K000132800
CVE: CVE-2024-23805
Published: 2024-02-14
Description: 
Undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. For the Application Visibility and Reporting module, this may occur when the HTTP Analytics profile with URLs enabled under Collected Entities is configured on a virtual server and the DB variables avr.IncludeServerInURI or avr.CollectOnlyHostnameFromURI are enabled. For BIG-IP Advanced WAF and ASM, this may occur when either a DoS or Bot Defense profile is configured on a virtual server and the DB variables avr.IncludeServerInURI or avr.CollectOnlyHostnameFromURI are enabled.

Note: The DB variables avr.IncludeServerInURI and avr.CollectOnlyHostnameFromURI are not enabled by default. For more information about the HTTP Analytics profile and the Collect URLs setting, refer to  K30875743: Create a new Analytics profile and attach it to your virtual servers https://my.f5.com/manage/s/article/K30875743 .



 


Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS Score: 7.5 (HIGH)
CWE: CWE-131, CWE-131
References: https://my.f5.com/manage/s/article/K000137334; https://my.f5.com/manage/s/article/K000137334
CVE: CVE-2024-23976
Published: 2024-02-14
Description: When running in Appliance mode, an authenticated attacker assigned the Administrator role may be able to bypass Appliance
mode restrictions utilizing iAppsLX templates on a BIG-IP system.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-266
References: https://my.f5.com/manage/s/article/K91054692; https://my.f5.com/manage/s/article/K91054692
CVE: CVE-2024-23979
Published: 2024-02-14
Description: 
When SSL Client Certificate LDAP or Certificate Revocation List Distribution Point (CRLDP) authentication profile is configured on a virtual server, undisclosed requests can cause an increase in CPU resource utilization. 

 


Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS Score: 7.5 (HIGH)
CWE: CWE-770, CWE-770
References: https://my.f5.com/manage/s/article/K000134516; https://my.f5.com/manage/s/article/K000134516
CVE: CVE-2024-23982
Published: 2024-02-14
Description: 


When a BIG-IP PEM classification profile is configured on a UDP virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. This issue affects classification engines using signatures released between 09-08-2022 and 02-16-2023. See the table in the F5 Security Advisory for a complete list of affected classification signature files.  NOTE: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS Score: 7.5 (HIGH)
CWE: CWE-121, CWE-787
References: https://my.f5.com/manage/s/article/K000135946; https://my.f5.com/manage/s/article/K000135946
CVE: CVE-2024-24775
Published: 2024-02-14
Description: When a virtual server is enabled with VLAN group and SNAT listener is configured, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://my.f5.com/manage/s/article/K000137333; https://my.f5.com/manage/s/article/K000137333
CVE: CVE-2024-24966
Published: 2024-02-14
Description: 
When LDAP remote authentication is configured on F5OS, a remote user without an assigned role will be incorrectly authorized.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://my.f5.com/manage/s/article/K000133111; https://my.f5.com/manage/s/article/K000133111