deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-6621
Published: 2019-07-02
Description: On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4.1, 11.6.1-11.6.3.4, and 11.5.2-11.5.8 and BIG-IQ 7.0.0-7.1.0.2, 6.0.0-6.1.0, and 5.1.0-5.4.0, an undisclosed iControl REST worker is vulnerable to command injection by an admin/resource admin user. This issue impacts both iControl REST and tmsh implementations.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://support.f5.com/csp/article/K20541896; https://support.f5.com/csp/article/K20541896?utm_source=f5support&amp%3Butm_medium=RSS; https://support.f5.com/csp/article/K20541896
CVE: CVE-2019-6622
Published: 2019-07-02
Description: On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.5, 13.0.0-13.1.1.4, 12.1.0-12.1.4.1, and 11.5.1-11.6.4, an undisclosed iControl REST worker is vulnerable to command injection by an administrator or resource administrator user. This attack is only exploitable on multi-bladed systems.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://support.f5.com/csp/article/K44885536; https://support.f5.com/csp/article/K44885536
CVE: CVE-2019-6624
Published: 2019-07-02
Description: On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, an undisclosed traffic pattern sent to a BIG-IP UDP virtual server may lead to a denial-of-service (DoS).
CVSS Score: 7.5 (HIGH)
References: https://support.f5.com/csp/article/K07127032; https://support.f5.com/csp/article/K07127032
CVE: CVE-2019-13177
Published: 2019-07-02
Description: verification.py in django-rest-registration (aka Django REST Registration library) before 0.5.0 relies on a static string for signatures (i.e., the Django Signing API is misused), which allows remote attackers to spoof the verification process. This occurs because incorrect code refactoring led to calling a security-critical function with an incorrect argument.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-347
References: https://github.com/apragacz/django-rest-registration/releases/tag/0.5.0; https://github.com/apragacz/django-rest-registration/security/advisories/GHSA-p3w6-jcg4-52xh; https://github.com/apragacz/django-rest-registration/releases/tag/0.5.0
CVE: CVE-2019-6623
Published: 2019-07-02
Description: On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, undisclosed traffic sent to BIG-IP iSession virtual server may cause the Traffic Management Microkernel (TMM) to restart, resulting in a Denial-of-Service (DoS).
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/109048; https://support.f5.com/csp/article/K72335002; https://support.f5.com/csp/article/K72335002?utm_source=f5support&amp%3Butm_medium=RSS
CVE: CVE-2019-13178
Published: 2019-07-02
Description: modules/luksbootkeyfile/main.py in Calamares versions 3.1 through 3.2.10 has a race condition between the time when the LUKS encryption keyfile is created and when secure permissions are set.
CVSS Score: 8.1 (HIGH)
CWE: CWE-362
References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00017.html; http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00020.html; http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00021.html
CVE: CVE-2019-13179
Published: 2019-07-02
Description: Calamares versions 3.1 through 3.2.10 copies a LUKS encryption keyfile from /crypto_keyfile.bin (mode 0600 owned by root) to /boot within a globally readable initramfs image with insecure permissions, which allows this originally protected file to be read by any user, thereby disclosing decryption keys for LUKS containers created with Full Disk Encryption.
CVSS Score: 7.5 (HIGH)
CWE: CWE-522
References: https://bugs.launchpad.net/ubuntu/+source/initramfs-tools/+bug/1835095; https://bugs.launchpad.net/ubuntu/+source/initramfs-tools/+bug/1835096; https://bugzilla.redhat.com/show_bug.cgi?id=1726542
CVE: CVE-2019-10183
Published: 2019-07-03
Description: Virt-install(1) utility used to provision new virtual machines has introduced an option '--unattended' to create VMs without user interaction. This option accepts guest VM password as command line arguments, thus leaking them to others users on the system via process listing. It was introduced recently in the virt-manager v2.2.0 release.
CVSS Score: 3.2 (LOW)
CWE: CWE-200, CWE-200
References: http://www.securityfocus.com/bid/109027; https://access.redhat.com/errata/RHSA-2019:3464; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10183
CVE: CVE-2019-13164
Published: 2019-07-03
Description: qemu-bridge-helper.c in QEMU 3.1 and 4.0.0 does not ensure that a network interface name (obtained from bridge.conf or a --br=bridge option) is limited to the IFNAMSIZ size, which can lead to an ACL bypass.
CVSS Score: 7.8 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00008.html; http://www.openwall.com/lists/oss-security/2019/07/02/2
CVE: CVE-2019-3619
Published: 2019-07-03
Description: Information Disclosure vulnerability in the Agent Handler in McAfee ePolicy Orchestrator (ePO) 5.9.x and 5.10.0 prior to 5.10.0 update 4 allows remote unauthenticated attacker to view sensitive information in plain text via sniffing the traffic between the Agent Handler and the SQL server.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-319
References: http://www.securityfocus.com/bid/109066; https://kc.mcafee.com/corporate/index?page=content&id=SB10286; http://www.securityfocus.com/bid/109066
CVE: CVE-2018-11426
Published: 2019-07-03
Description: A weak Cookie parameter is used in the web application of Moxa OnCell G3100-HSPA Series version 1.4 Build 16062919 and prior. An attacker can brute force parameters required to bypass authentication and access the web interface to use all its functions except for password change.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://github.com/klsecservices/Advisories/blob/master/KL-MOXA-2018-105.md; https://github.com/klsecservices/Advisories/blob/master/KL-MOXA-2018-105.md
CVE: CVE-2018-11427
Published: 2019-07-03
Description: CSRF tokens are not used in the web application of Moxa OnCell G3100-HSPA Series version 1.4 Build 16062919 and prior, which makes it possible to perform CSRF attacks on the device administrator.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/klsecservices/Advisories/blob/master/KL-MOXA-2018-106.md; https://github.com/klsecservices/Advisories/blob/master/KL-MOXA-2018-106.md
CVE: CVE-2018-11215
Published: 2019-07-03
Description: Remote code execution is possible in Cloudera Data Science Workbench version 1.3.0 and prior releases via unspecified attack vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-200
References: https://www.cloudera.com/documentation/other/security-bulletins/topics/Security-Bulletin.html; https://www.cloudera.com/documentation/other/security-bulletins/topics/Security-Bulletin.html
CVE: CVE-2018-11227
Published: 2019-07-03
Description: Monstra CMS 3.0.4 and earlier has XSS via index.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/monstra-cms/monstra/issues; https://github.com/monstra-cms/monstra/issues/438; https://www.exploit-db.com/exploits/44646
CVE: CVE-2018-11317
Published: 2019-07-03
Description: Subrion CMS before 4.1.4 has XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/intelliants/subrion/blob/610b21d3ff185bd287d55fe016d4266abf04a3bf/includes/classes/ia.admin.sitemap.php#L79-L83; https://github.com/intelliants/subrion/releases/tag/v4.1.4; https://github.com/intelliants/subrion/blob/610b21d3ff185bd287d55fe016d4266abf04a3bf/includes/classes/ia.admin.sitemap.php#L79-L83
CVE: CVE-2018-11420
Published: 2019-07-03
Description: There is Memory corruption in the web interface of Moxa OnCell G3100-HSPA Series version 1.5 Build 17042015 and prio,r a different vulnerability than CVE-2018-11423.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/klsecservices/Advisories/blob/master/KL-MOXA-2018-101.md; https://github.com/klsecservices/Advisories/blob/master/KL-MOXA-2018-101.md
CVE: CVE-2018-11421
Published: 2019-07-03
Description: Moxa OnCell G3100-HSPA Series version 1.6 Build 17100315 and prior use a proprietary monitoring protocol that does not provide confidentiality, integrity, and authenticity security controls. All information is sent in plain text, and can be intercepted and modified. The protocol is vulnerable to remote unauthenticated disclosure of sensitive information, including the administrator's password. Under certain conditions, it's also possible to retrieve additional information, such as content of HTTP requests to the device, or the previously used password, due to memory leakages.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-319
References: https://github.com/klsecservices/Advisories/blob/master/KL-MOXA-2018-103.md; https://github.com/klsecservices/Advisories/blob/master/KL-MOXA-2018-103.md
CVE: CVE-2018-11422
Published: 2019-07-03
Description: Moxa OnCell G3100-HSPA Series version 1.6 Build 17100315 and prior use a proprietary configuration protocol that does not provide confidentiality, integrity, and authenticity security controls. All information is sent in plain text, and can be intercepted and modified. Any commands (including device reboot, configuration download or upload, or firmware upgrade) are accepted and executed by the device without authentication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-319
References: https://github.com/klsecservices/Advisories/blob/master/KL-MOXA-2018-104.md; https://github.com/klsecservices/Advisories/blob/master/KL-MOXA-2018-104.md
CVE: CVE-2018-11423
Published: 2019-07-03
Description: There is Memory corruption in the web interface Moxa OnCell G3100-HSPA Series version 1.6 Build 17100315 and prior, different vulnerability than CVE-2018-11420.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://github.com/klsecservices/Advisories/blob/master/KL-MOXA-2018-102.md; https://github.com/klsecservices/Advisories/blob/master/KL-MOXA-2018-102.md
CVE: CVE-2018-11424
Published: 2019-07-03
Description: There is Memory corruption in the web interface of Moxa OnCell G3470A-LTE Series version 1.6 Build 18021314 and prior, a different vulnerability than CVE-2018-11425.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/klsecservices/Advisories/blob/master/KL-MOXA-2018-002.md; https://github.com/klsecservices/Advisories/blob/master/KL-MOXA-2018-002.md
CVE: CVE-2018-11425
Published: 2019-07-03
Description: Memory corruption issue was discovered in Moxa OnCell G3470A-LTE Series version 1.6 Build 18021314 and prior, a different vulnerability than CVE-2018-11424.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://github.com/klsecservices/Advisories/blob/master/KL-MOXA-2018-003.md; https://github.com/klsecservices/Advisories/blob/master/KL-MOXA-2018-003.md
CVE: CVE-2019-10717
Published: 2019-07-03
Description: BlogEngine.NET 3.3.7.0 allows /api/filemanager Directory Traversal via the path parameter.
CVSS Score: 7.1 (HIGH)
CWE: CWE-22
References: http://seclists.org/fulldisclosure/2019/Jun/44; https://github.com/rxtur/BlogEngine.NET/commits/master; https://www.securitymetrics.com/blog/Blogenginenet-Directory-Traversal-Listing-Login-Page-Unvalidated-Redirect
CVE: CVE-2019-10721
Published: 2019-07-03
Description: BlogEngine.NET 3.3.7.0 allows a Client Side URL Redirect via the ReturnUrl parameter, related to BlogEngine/BlogEngine.Core/Services/Security/Security.cs, login.aspx, and register.aspx.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://github.com/rxtur/BlogEngine.NET/commits/master; https://www.securitymetrics.com/blog/Blogenginenet-Directory-Traversal-Listing-Login-Page-Unvalidated-Redirect; https://github.com/rxtur/BlogEngine.NET/commits/master
CVE: CVE-2017-17972
Published: 2019-07-03
Description: packages/subjects/pub/subjects.php in Archon 3.21 rev-1 has XSS in the referer parameter in an index.php?subjecttypeid=xxx request, aka Open Bug Bounty ID OBB-466362.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.openbugbounty.org/reports/466362/; https://www.openbugbounty.org/reports/466362/
CVE: CVE-2017-18346
Published: 2019-07-03
Description: SQL injection vulnerability in /wbg/core/_includes/authorization.inc.php in CMS Web-Gooroo through 2013-01-19 allows remote attackers to execute arbitrary SQL commands via the wbg_login parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://vuldb.com/?id.123295; https://www.exploit-db.com/exploits/42577/; https://vuldb.com/?id.123295
CVE: CVE-2017-6216
Published: 2019-07-03
Description: novaksolutions/infusionsoft-php-sdk v2016-10-31 is vulnerable to a reflected XSS in the leadscoring.php resulting code execution
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/novaksolutions/infusionsoft-php-sdk/issues/111; https://github.com/novaksolutions/infusionsoft-php-sdk/issues/111
CVE: CVE-2017-6900
Published: 2019-07-03
Description: An issue was discovered in Riello NetMan 204 14-2 and 15-2. The issue is with the login script and wrongpass Python script used for authentication. When calling wrongpass, the variables $VAL0 and $VAL1 should be enclosed in quotes to prevent the potential for Bash command injection. Further to this, VAL0 and VAL1 should be sanitised to ensure they do not contain malicious characters. Passing it the username of '-' will cause it to time out and log the user in because of poor error handling. This will log the attacker in as an administrator where the telnet / ssh services can be enabled, and the credentials for local users can be reset. Also, login.cgi accepts the username as a GET parameter, so login can be achieved by browsing to the /cgi-bin/login.cgi?username=-%20a URI.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-255
References: https://blog.synack.co.uk/2017/01/31/my-first-exploit-db-post/; https://web.archive.org/web/[PII_REDACTED]0702/https://blog.synack.co.uk/2017/01/31/my-first-exploit-db-post/; https://blog.synack.co.uk/2017/01/31/my-first-exploit-db-post/
CVE: CVE-2017-9325
Published: 2019-07-03
Description: The provided secure solrconfig.xml sample configuration does not enforce Sentry authorization on /update/json/docs.
CVSS Score: 7.5 (HIGH)
CWE: CWE-285
References: https://www.cloudera.com/documentation/other/security-bulletins/topics/Security-Bulletin.html; https://www.cloudera.com/documentation/other/security-bulletins/topics/Security-Bulletin.html
CVE: CVE-2017-9326
Published: 2019-07-03
Description: The keystore password for the Spark History Server may be exposed in unsecured files under the /var/run/cloudera-scm-agent directory managed by Cloudera Manager. The keystore file itself is not exposed.
CVSS Score: 7.5 (HIGH)
CWE: CWE-255
References: https://www.cloudera.com/documentation/other/security-bulletins/topics/Security-Bulletin.html; https://www.cloudera.com/documentation/other/security-bulletins/topics/Security-Bulletin.html
CVE: CVE-2017-9327
Published: 2019-07-03
Description: Secret data of processes managed by CM is not secured by file permissions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-275
References: https://www.cloudera.com/documentation/other/security-bulletins/topics/Security-Bulletin.html; https://www.cloudera.com/documentation/other/security-bulletins/topics/Security-Bulletin.html
CVE: CVE-2018-11686
Published: 2019-07-03
Description: The Publish Service in FlexPaper (later renamed FlowPaper) 2.3.6 allows remote code execution via setup.php and change_config.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://flowpaper.com/blog/; https://redtimmysec.wordpress.com/2019/03/07/flexpaper-remote-code-execution; https://flowpaper.com/blog/
CVE: CVE-2018-12250
Published: 2019-07-03
Description: An issue was discovered in Elite CMS Pro 2.01. In /admin/add_sidebar.php, the ?page= parameter is vulnerable to SQL injection.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: http://elitecms.net/download.php; https://cxsecurity.com/issue/WLB[PII_REDACTED]; http://elitecms.net/download.php
CVE: CVE-2018-15811
Published: 2019-07-03
Description: DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-326, CWE-326
References: http://packetstormsecurity.com/files/157080/DotNetNuke-Cookie-Deserialization-Remote-Code-Execution.html; https://github.com/dnnsoftware/Dnn.Platform/releases; https://www.dnnsoftware.com/community/security/security-center
CVE: CVE-2018-15812
Published: 2019-07-03
Description: DNN (aka DotNetNuke) 9.2 through 9.2.1 incorrectly converts encryption key source values, resulting in lower than expected entropy.
CVSS Score: 7.5 (HIGH)
CWE: CWE-331
References: http://packetstormsecurity.com/files/157080/DotNetNuke-Cookie-Deserialization-Remote-Code-Execution.html; https://github.com/dnnsoftware/Dnn.Platform/releases; https://www.dnnsoftware.com/community/security/security-center
CVE: CVE-2018-18325
Published: 2019-07-03
Description: DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. NOTE: this issue exists because of an incomplete fix for CVE-2018-15811.
CVSS Score: 7.5 (HIGH)
CWE: CWE-326, CWE-326
References: http://packetstormsecurity.com/files/157080/DotNetNuke-Cookie-Deserialization-Remote-Code-Execution.html; https://github.com/dnnsoftware/Dnn.Platform/releases; https://www.dnnsoftware.com/community/security/security-center
CVE: CVE-2018-18326
Published: 2019-07-03
Description: DNN (aka DotNetNuke) 9.2 through 9.2.2 incorrectly converts encryption key source values, resulting in lower than expected entropy. NOTE: this issue exists because of an incomplete fix for CVE-2018-15812.
CVSS Score: 7.5 (HIGH)
CWE: CWE-331
References: http://packetstormsecurity.com/files/157080/DotNetNuke-Cookie-Deserialization-Remote-Code-Execution.html; https://github.com/dnnsoftware/Dnn.Platform/releases; https://www.dnnsoftware.com/community/security/security-center
CVE: CVE-2019-13186
Published: 2019-07-03
Description: In MiniCMS V1.10, stored XSS was found in mc-admin/post-edit.php via the tags box. An attacker can use it to get a user's cookie. This is different from CVE-2018-10296, CVE-2018-16233, and CVE-2018-20520.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/bg5sbk/MiniCMS/issues/31; https://github.com/bg5sbk/MiniCMS/issues/31
CVE: CVE-2019-5630
Published: 2019-07-03
Description: A Cross-Site Request Forgery (CSRF) vulnerability was found in Rapid7 Nexpose InsightVM Security Console versions 6.5.0 through 6.5.68. This issue allows attackers to exploit CSRF vulnerabilities on API endpoints using Flash to circumvent a cross-domain pre-flight OPTIONS request.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-352
References: https://help.rapid7.com/nexpose/en-us/release-notes#6.5.69; https://help.rapid7.com/nexpose/en-us/release-notes#6.5.69
CVE: CVE-2018-12715
Published: 2019-07-03
Description: DIGISOL DG-HR3400 devices have XSS via a modified SSID when the apssid value is unchanged.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://indiancybersecuritysolutions.com/cve-2018-12715-digisol-dg-hr3400/; https://www.exploit-db.com/exploits/44955; https://indiancybersecuritysolutions.com/cve-2018-12715-digisol-dg-hr3400/
CVE: CVE-2018-14866
Published: 2019-07-03
Description: Incorrect access control in the TransientModel framework in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated attackers to access data in transient records that they do not own by making an RPC call before garbage collection occurs.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-732
References: https://github.com/odoo/odoo/issues/32509; https://github.com/odoo/odoo/issues/32509
CVE: CVE-2019-12570
Published: 2019-07-03
Description: A SQL injection vulnerability in the Xpert Solution "Server Status by Hostname/IP" plugin 4.6 for WordPress allows an authenticated user to execute arbitrary SQL commands via GET parameters.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/ivoschyk-cs/exploit_wp/blob/master/CVE-2019-12570; https://wpvulndb.com/vulnerabilities/9964; https://github.com/ivoschyk-cs/exploit_wp/blob/master/CVE-2019-12570
CVE: CVE-2019-6625
Published: 2019-07-03
Description: On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, and 11.5.1-11.6.4, a reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Traffic Management User Interface (TMUI) also known as the BIG-IP Configuration utility.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://support.f5.com/csp/article/K79902360; https://support.f5.com/csp/article/K79902360
CVE: CVE-2019-6626
Published: 2019-07-03
Description: On BIG-IP (AFM, Analytics, ASM) 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, and 11.5.1-11.6.3.4, A reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Traffic Management User Interface (TMUI), also known as the Configuration utility.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://support.f5.com/csp/article/K00432398; https://support.f5.com/csp/article/K00432398
CVE: CVE-2019-6627
Published: 2019-07-03
Description: On F5 SSL Orchestrator 14.1.0-14.1.0.5, on rare occasions, specific to a certain race condition, TMM may restart when SSL Forward Proxy enforces the bypass action for an SSL Orchestrator transparent virtual server with SNAT enabled.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-362
References: https://support.f5.com/csp/article/K36320691; https://support.f5.com/csp/article/K36320691
CVE: CVE-2019-6628
Published: 2019-07-03
Description: On BIG-IP PEM 14.1.0-14.1.0.5 and 14.0.0-14.0.0.4, under certain conditions, the TMM process may terminate and restart while processing BIG-IP PEM traffic with the OpenVPN classifier.
CVSS Score: 7.5 (HIGH)
References: https://support.f5.com/csp/article/K04730051; https://support.f5.com/csp/article/K04730051
CVE: CVE-2019-6629
Published: 2019-07-03
Description: On BIG-IP 14.1.0-14.1.0.5, undisclosed SSL traffic to a virtual server configured with a Client SSL profile may cause TMM to fail and restart. The Client SSL profile must have session tickets enabled and use DHE cipher suites to be affected. This only impacts the data plane, there is no impact to the control plane.
CVSS Score: 7.5 (HIGH)
References: https://support.f5.com/csp/article/K95434410; https://support.f5.com/csp/article/K95434410?utm_source=f5support&amp%3Butm_medium=RSS; https://support.f5.com/csp/article/K95434410
CVE: CVE-2019-6630
Published: 2019-07-03
Description: On F5 SSL Orchestrator 14.1.0-14.1.0.5 and 14.0.0-14.0.0.4, undisclosed traffic flow may cause TMM to restart under certain circumstances.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/109097; https://support.f5.com/csp/article/K33444350; http://www.securityfocus.com/bid/109097
CVE: CVE-2019-6631
Published: 2019-07-03
Description: On BIG-IP 11.5.1-11.6.4, iRules performing HTTP header manipulation may cause an interruption to service when processing traffic handled by a Virtual Server with an associated HTTP profile, in specific circumstances, when the requests do not strictly conform to RFCs.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/109119; https://support.f5.com/csp/article/K19501795; https://support.f5.com/csp/article/K19501795?utm_source=f5support&amp%3Butm_medium=RSS
CVE: CVE-2019-6633
Published: 2019-07-03
Description: On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4.1, and 11.5.1-11.6.4, when the BIG-IP system is licensed with Appliance mode, user accounts with Administrator and Resource Administrator roles can bypass Appliance mode restrictions.
CVSS Score: 4.4 (MEDIUM)
References: http://www.securityfocus.com/bid/109113; https://support.f5.com/csp/article/K73522927; http://www.securityfocus.com/bid/109113
CVE: CVE-2019-7165
Published: 2019-07-03
Description: A buffer overflow in DOSBox 0.74-2 allows attackers to execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00047.html; http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00053.html; https://lists.debian.org/debian-lts-announce/2019/07/msg00004.html