deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-34158
Published: 2022-08-04
Description: A carefully crafted invocation on the Image plugin could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow a group privilege escalation of the attacker's account. Further examination of this issue established that it could also be used to modify the email associated with the attacked account, and then a reset password request from the login page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-34158; https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-34158
CVE: CVE-2022-2643
Published: 2022-08-04
Description: A vulnerability has been found in SourceCodester Online Admission System and classified as critical. This vulnerability affects unknown code of the component POST Parameter Handler. The manipulation of the argument shift leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this entry is VDB-205564.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/badboycxcc/Student-Admission-Sqlinjection; https://vuldb.com/?id.205564; https://github.com/badboycxcc/Student-Admission-Sqlinjection
CVE: CVE-2022-2644
Published: 2022-08-04
Description: A vulnerability was found in SourceCodester Online Admission System and classified as critical. This issue affects some unknown processing of the component GET Parameter Handler. The manipulation of the argument eid leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-205565 was assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/badboycxcc/Student-Admission-Sqlinjection; https://vuldb.com/?id.205565; https://github.com/badboycxcc/Student-Admission-Sqlinjection
CVE: CVE-2022-2645
Published: 2022-08-04
Description: A vulnerability has been found in SourceCodester Garage Management System and classified as problematic. Affected by this vulnerability is an unknown functionality of the file edituser.php. The manipulation of the argument id with the input 1\"><ScRiPt>alert(1)</sCrIpT> leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-205573 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://vuldb.com/?id.205573; https://vuldb.com/?id.205573
CVE: CVE-2022-2646
Published: 2022-08-04
Description: A vulnerability, which was classified as problematic, was found in SourceCodester Online Admission System. Affected is an unknown function of the file index.php. The manipulation of the argument eid with the input 8</h3><script>alert(1)</script> leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-205572.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/badboycxcc/Student-Admission-Xss; https://vuldb.com/?id.205572; https://github.com/badboycxcc/Student-Admission-Xss
CVE: CVE-2022-2647
Published: 2022-08-04
Description: A vulnerability was found in jeecg-boot. It has been declared as critical. This vulnerability affects unknown code of the file /api/. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-205594 is the identifier assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-434, CWE-434
References: https://vuldb.com/?id.205594; https://www.cnblogs.com/J0o1ey/p/16550583.html; https://vuldb.com/?id.205594
CVE: CVE-2022-2648
Published: 2022-08-04
Description: A vulnerability was found in SourceCodester Multi Language Hotel Management Software. It has been rated as critical. This issue affects some unknown processing. The manipulation of the argument room_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-205595.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/gdianq/Sparkz-Hotel-Management-Sqlinjection/tree/main; https://vuldb.com/?id.205595; https://github.com/gdianq/Sparkz-Hotel-Management-Sqlinjection/tree/main
CVE: CVE-2022-2651
Published: 2022-08-04
Description: Authentication Bypass by Primary Weakness in GitHub repository bookwyrm-social/bookwyrm prior to 0.4.5.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-305
References: http://packetstormsecurity.com/files/168423/Bookwyrm-0.4.3-Authentication-Bypass.html; https://github.com/bookwyrm-social/bookwyrm/commit/7bbe42fb30a79a26115524d18b697d895563c92f; https://huntr.dev/bounties/428eee94-f1a0-45d0-9e25[PII_REDACTED]50
CVE: CVE-2022-2652
Published: 2022-08-04
Description: Depending on the way the format strings in the card label are crafted it's possible to leak kernel stack memory. There is also the possibility for DoS due to the v4l2loopback kernel module crashing when providing the card label on request (reproduce e.g. with many %s modifiers in a row).
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-134
References: https://github.com/umlaeute/v4l2loopback/commit/e4cd225557486c420f6a34411f98c575effd43dd; https://huntr.dev/bounties/1b055da5-7a9e-4409-99d7-030280d242d5; https://github.com/umlaeute/v4l2loopback/commit/e4cd225557486c420f6a34411f98c575effd43dd
CVE: CVE-2022-2653
Published: 2022-08-04
Description: With this vulnerability an attacker can read many sensitive files like configuration files, or the /proc/self/environ file, that contains the environment variable used by the web server that includes database credentials. If the web server user is root, an attacker will be able to read any file in the system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/plankanban/planka/commit/ac1df5201dfdaf68d37f7e1b272bc137870d7418; https://huntr.dev/bounties/5dff7cf9-8bb2-4f67-a02d-b94db5009d70; https://github.com/plankanban/planka/commit/ac1df5201dfdaf68d37f7e1b272bc137870d7418
CVE: CVE-2022-32963
Published: 2022-08-04
Description: OMICARD EDM’s mail file relay function has a path traversal vulnerability. An unauthenticated remote attacker can exploit this vulnerability to by-pass authentication and access arbitrary system files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://www.chtsecurity.com/news/48032532-b2de-401c-97a8-a2be5691988f; https://www.twcert.org.tw/tw/cp-132-6371-05bdc-1.html; https://www.chtsecurity.com/news/48032532-b2de-401c-97a8-a2be5691988f
CVE: CVE-2022-32964
Published: 2022-08-04
Description: OMICARD EDM’s API function has insufficient validation for user input. An unauthenticated remote attacker can inject arbitrary SQL commands to access, modify, delete database or disrupt service.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.chtsecurity.com/news/48032532-b2de-401c-97a8-a2be5691988f; https://www.twcert.org.tw/tw/cp-132-6372-f61bc-1.html; https://www.chtsecurity.com/news/48032532-b2de-401c-97a8-a2be5691988f
CVE: CVE-2022-32965
Published: 2022-08-04
Description: OMICARD EDM has a hard-coded machine key. An unauthenticated remote attacker can use the machine key to send serialized payload to the server to execute arbitrary code, manipulate system data and disrupt service.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798, CWE-798
References: https://www.chtsecurity.com/news/48032532-b2de-401c-97a8-a2be5691988f; https://www.twcert.org.tw/tw/cp-132-6373-34d51-1.html; https://www.chtsecurity.com/news/48032532-b2de-401c-97a8-a2be5691988f
CVE: CVE-2022-35216
Published: 2022-08-04
Description: OMICARD EDM’s mail image relay function has a path traversal vulnerability. An unauthenticated remote attacker can exploit this vulnerability to by-pass authentication and access arbitrary system files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://www.chtsecurity.com/news/48032532-b2de-401c-97a8-a2be5691988f; https://www.twcert.org.tw/tw/cp-132-6374-1c6c9-1.html; https://www.chtsecurity.com/news/48032532-b2de-401c-97a8-a2be5691988f
CVE: CVE-2022-2656
Published: 2022-08-04
Description: A vulnerability classified as critical has been found in SourceCodester Multi Language Hotel Management Software. Affected is an unknown function. The manipulation of the argument email leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-205596.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/gdianq/Sparkz-Hotel-Management-loginpage-Sqlinjection/blob/main/README.md; https://vuldb.com/?id.205596; https://github.com/gdianq/Sparkz-Hotel-Management-loginpage-Sqlinjection/blob/main/README.md
CVE: CVE-2022-25168
Published: 2022-08-04
Description: Apache Hadoop's FileUtil.unTar(File, File) API does not escape the input file name before being passed to the shell. An attacker can inject arbitrary commands. This is only used in Hadoop 3.3 InMemoryAliasMap.completeBootstrapTransfer, which is only ever run by a local user. It has been used in Hadoop 2.x for yarn localization, which does enable remote code execution. It is used in Apache Spark, from the SQL command ADD ARCHIVE. As the ADD ARCHIVE command adds new binaries to the classpath, being able to execute shell scripts does not confer new permissions to the caller. SPARK-38305. "Check existence of file before untarring/zipping", which is included in 3.3.0, 3.1.4, 3.2.2, prevents shell commands being executed, regardless of which version of the hadoop libraries are in use. Users should upgrade to Apache Hadoop 2.10.2, 3.2.4, 3.3.3 or upper (including HADOOP-18136).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://lists.apache.org/thread/mxqnb39jfrwgs3j6phwvlrfq4mlox130; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://lists.apache.org/thread/mxqnb39jfrwgs3j6phwvlrfq4mlox130
CVE: CVE-2022-31118
Published: 2022-08-04
Description: Nextcloud server is an open source personal cloud solution. In affected versions an attacker could brute force to find if federated sharing is being used and potentially try to brute force access tokens for federated shares (`a-zA-Z0-9` ^ 15). It is recommended that the Nextcloud Server is upgraded to 22.2.9, 23.0.6 or 24.0.2. Users unable to upgrade may disable federated sharing via the Admin Sharing settings in `index.php/settings/admin/sharing`.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770, CWE-307
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2vwh-5v93-3vcq; https://github.com/nextcloud/server/pull/32843/commits/6eb692da7fe73c899cb6a8d2aa045eddb1f14018; https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2vwh-5v93-3vcq
CVE: CVE-2022-31120
Published: 2022-08-04
Description: Nextcloud server is an open source personal cloud solution. The audit log is used to get a full trail of the actions which has been incompletely populated. In affected versions federated share events were not properly logged which would allow brute force attacks to go unnoticed. This behavior exacerbates the impact of CVE-2022-31118. It is recommended that the Nextcloud Server is upgraded to 22.2.7, 23.0.4 or 24.0.0. There are no workarounds available.
CVSS Score: 2.1 (LOW)
CWE: CWE-778
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-9qvg-7fwg-722x; https://github.com/nextcloud/server/pull/31594/commits/1d8bf9a89c[PII_REDACTED]a1d365000a5831be8655; https://portal.nextcloud.com/article/using-the-audit-log-44.html
CVE: CVE-2022-31132
Published: 2022-08-04
Description: Nextcloud Mail is an email application for the nextcloud personal cloud product. Affected versions shipped with a CSS minifier on the path `./vendor/cerdic/css-tidy/css_optimiser.php`. Access to the minifier is unrestricted and access may lead to Server-Side Request Forgery (SSRF). It is recommendet to upgrade to Mail 1.12.7 or Mail 1.13.6. Users unable to upgrade may manually delete the file located at `./vendor/cerdic/css-tidy/css_optimiser.php`
CVSS Score: 8.3 (HIGH)
CWE: CWE-918
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-24pm-rjfv-23mh; https://github.com/nextcloud/security-advisories/security/advisories/GHSA-24pm-rjfv-23mh
CVE: CVE-2022-30535
Published: 2022-08-04
Description: In versions 2.x before 2.3.0 and all versions of 1.x, An attacker authorized to create or update ingress objects can obtain the secrets available to the NGINX Ingress Controller. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://support.f5.com/csp/article/K52125139; https://support.f5.com/csp/article/K52125139
CVE: CVE-2022-31119
Published: 2022-08-04
Description: Nextcloud Mail is an email application for the nextcloud personal cloud product. Affected versions of Nextcloud mail would log user passwords to disk in the event of a misconfiguration. Should an attacker gain access to the logs complete access to affected accounts would be obtainable. It is recommended that the Nextcloud Mail is upgraded to 1.12.1. Operators should inspect their logs and remove passwords which have been logged. There are no workarounds to prevent logging in the event of a misconfiguration.
CVSS Score: 3.1 (LOW)
CWE: CWE-532, CWE-532
References: https://github.com/nextcloud/mail/issues/823; https://github.com/nextcloud/mail/pull/6488/commits/ab9ade57fbc1f465ffe905248f93f328d638d7e5; https://github.com/nextcloud/security-advisories/security/advisories/GHSA-63m3-w68h-3wjg
CVE: CVE-2022-31473
Published: 2022-08-04
Description: In BIG-IP Versions 16.1.x before 16.1.1 and 15.1.x before 15.1.4, when running in Appliance mode, an authenticated attacker may be able to bypass Appliance mode restrictions due to a directory traversal vulnerability in an undisclosed page within iApps. A successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: https://support.f5.com/csp/article/K34893234; https://support.f5.com/csp/article/K34893234
CVE: CVE-2022-32455
Published: 2022-08-04
Description: In BIG-IP Versions 16.1.x before 16.1.2.2, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, when a BIG-IP LTM Client SSL profile is configured on a virtual server to perform client certificate authentication with session tickets enabled, undisclosed requests cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119, CWE-119
References: https://support.f5.com/csp/article/K16852653; https://support.f5.com/csp/article/K16852653
CVE: CVE-2022-33203
Published: 2022-08-04
Description: In BIG-IP Versions 16.1.x before 16.1.3, 15.1.x before 15.1.6.1, and 14.1.x before 14.1.5, when a BIG-IP APM access policy with Service Connect agent is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://support.f5.com/csp/article/K52534925; https://support.f5.com/csp/article/K52534925
CVE: CVE-2022-33947
Published: 2022-08-04
Description: In BIG-IP Versions 16.1.x before 16.1.3, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, a vulnerability exists in undisclosed pages of the BIG-IP DNS Traffic Management User Interface (TMUI) that allows an authenticated attacker with at least operator role privileges to cause the Tomcat process to restart and perform unauthorized DNS requests and operations through undisclosed requests. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-502, CWE-502
References: https://support.f5.com/csp/article/K38893457; https://support.f5.com/csp/article/K38893457
CVE: CVE-2022-33962
Published: 2022-08-04
Description: In BIG-IP Versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and all versions of 13.1.x, certain iRules commands may allow an attacker to bypass the access control restrictions for a self IP address, regardless of the port lockdown settings. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-269
References: https://support.f5.com/csp/article/K80970653; https://support.f5.com/csp/article/K80970653
CVE: CVE-2022-33968
Published: 2022-08-04
Description: In BIG-IP Versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and all versions of 13.1.x, when an LTM monitor or APM SSO is configured on a virtual server, and NTLM challenge-response is in use, undisclosed traffic can cause a buffer over-read. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 3.7 (LOW)
CWE: CWE-125
References: https://support.f5.com/csp/article/K23465404; https://support.f5.com/csp/article/K23465404
CVE: CVE-2022-34651
Published: 2022-08-04
Description: In BIG-IP Versions 16.1.x before 16.1.3.1 and 15.1.x before 15.1.6.1, when an LTM Client or Server SSL profile with TLS 1.3 enabled is configured on a virtual server, along with an iRule that calls HTTP::respond, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://support.f5.com/csp/article/K59197053; https://support.f5.com/csp/article/K59197053
CVE: CVE-2022-34655
Published: 2022-08-04
Description: In BIG-IP Versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.6.1, and 14.1.x before 14.1.5, when an iRule containing the HTTP::payload command is configured on a virtual server, undisclosed traffic can cause Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-457, CWE-908
References: https://support.f5.com/csp/article/K93504311; https://support.f5.com/csp/article/K93504311
CVE: CVE-2022-34844
Published: 2022-08-04
Description: In BIG-IP Versions 16.1.x before 16.1.3.1 and 15.1.x before 15.1.6.1, and all versions of BIG-IQ 8.x, when the Data Plane Development Kit (DPDK)/Elastic Network Adapter (ENA) driver is used with BIG-IP or BIG-IQ on Amazon Web Services (AWS) systems, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Successful exploitation relies on conditions outside of the attacker's control. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20
References: https://support.f5.com/csp/article/K34511555; https://support.f5.com/csp/article/K34511555
CVE: CVE-2022-34851
Published: 2022-08-04
Description: In BIG-IP Versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and all versions of 13.1.x, and BIG-IQ Centralized Management all versions of 8.x, an authenticated attacker may cause iControl SOAP to become unavailable through undisclosed requests. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: https://support.f5.com/csp/article/K50310001; https://support.f5.com/csp/article/K50310001
CVE: CVE-2022-34862
Published: 2022-08-04
Description: In BIG-IP Versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, when an LTM virtual server is configured to perform normalization, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835, CWE-835
References: https://support.f5.com/csp/article/K66510514; https://support.f5.com/csp/article/K66510514
CVE: CVE-2022-34865
Published: 2022-08-04
Description: In BIG-IP Versions 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, Traffic Intelligence feeds, which use HTTPS, do not verify the remote endpoint identity, allowing for potential data poisoning. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-295
References: https://support.f5.com/csp/article/K25046752; https://support.f5.com/csp/article/K25046752
CVE: CVE-2022-35236
Published: 2022-08-04
Description: In BIG-IP Versions 16.1.x before 16.1.2.2, 15.1.x before 15.1.6.1, and 14.1.x before 14.1.5, when an HTTP2 profile is configured on a virtual server, undisclosed traffic can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://support.f5.com/csp/article/K79933541; https://support.f5.com/csp/article/K79933541
CVE: CVE-2022-35240
Published: 2022-08-04
Description: In BIG-IP Versions 16.1.x before 16.1.2.2, 15.1.x before 15.1.6.1, and 14.1.x before 14.1.5, when the Message Routing (MR) Message Queuing Telemetry Transport (MQTT) profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-404
References: https://support.f5.com/csp/article/K28405643; https://support.f5.com/csp/article/K28405643
CVE: CVE-2022-35241
Published: 2022-08-04
Description: In versions 2.x before 2.3.1 and all versions of 1.x, when NGINX Instance Manager is in use, undisclosed requests can cause an increase in disk resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://support.f5.com/csp/article/K37080719; https://support.f5.com/csp/article/K37080719
CVE: CVE-2022-35243
Published: 2022-08-04
Description: In BIG-IP Versions 16.1.x before 16.1.3, 15.1.x before 15.1.5.1, 14.1.x before 14.1.5, and all versions of 13.1.x, when running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, using an undisclosed iControl REST endpoint. A successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 8.7 (HIGH)
CWE: CWE-269
References: https://support.f5.com/csp/article/K11010341; https://support.f5.com/csp/article/K11010341
CVE: CVE-2022-35245
Published: 2022-08-04
Description: In BIG-IP Versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, and 14.1.x before 14.1.5.1, when a BIG-IP APM access policy is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://support.f5.com/csp/article/K58235223; https://support.f5.com/csp/article/K58235223
CVE: CVE-2022-35272
Published: 2022-08-04
Description: In BIG-IP Versions 17.0.x before 17.0.0.1 and 16.1.x before 16.1.3.1, when source-port preserve-strict is configured on an HTTP Message Routing Framework (MRF) virtual server, undisclosed traffic may cause the Traffic Management Microkernel (TMM) to produce a core file and the connection to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-404
References: https://support.f5.com/csp/article/K90024104; https://support.f5.com/csp/article/K90024104