rainbutterfly/cve_corpus huggingface dataset:
CVE-2017-6060 
Stack-based buffer overflow in jstest_main.c in mujstest in Artifex Software, Inc. MuPDF 1.10a allows remote attackers to have unspecified impact via a crafted image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-15T14:00:00.000Z
CVE-2017-6061 
Cross-site scripting (XSS) vulnerability in the help component of SAP BusinessObjects Financial Consolidation 10.0.0.1933 allows remote attackers to inject arbitrary web script or HTML via a GET request. /finance/help/en/frameset.htm is the URI for this component. The vendor response is SAP Security Note 2368106.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-16T03:49:00.000Z
CVE-2017-6062 
The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc) module before 2.1.5 for the Apache HTTP Server does not skip OIDC_CLAIM_ and OIDCAuthNHeader headers in an "OIDCUnAuthAction pass" configuration, which allows remote attackers to bypass authentication via crafted HTTP traffic.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-02T06:00:00.000Z
CVE-2017-6065 
SQL injection vulnerability in inc/lib/Control/Backend/menus.control.php in GeniXCMS through 1.0.2 allows remote authenticated users to execute arbitrary SQL commands via the order parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-17T20:00:00.000Z
CVE-2017-6066 
Subrion CMS 4.0.5 has CSRF in admin/languages/edit/1/. The attacker can perform any Edit Language action, and can optionally insert XSS via the title parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-27T01:55:00.000Z
CVE-2017-6067 
Symphony 2.6.9 has XSS in publish/notes/edit/##/saved/ via the bottom form field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-27T01:55:00.000Z
CVE-2017-6068 
Subrion CMS 4.0.5 has CSRF in admin/blocks/add/. The attacker can create any block, and can optionally insert XSS via the content parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-27T01:55:00.000Z
CVE-2017-6069 
Subrion CMS 4.0.5 has CSRF in admin/blog/add/. The attacker can add any tag, and can optionally insert XSS via the tags parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-27T01:55:00.000Z
CVE-2017-6070 
CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to execute PHP code via the cntnt01fbrp_forma_form_template parameter in admin_store_form.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-21T07:46:00.000Z
CVE-2017-6071 
CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to conduct information-disclosure attacks via exportxml.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-21T07:46:00.000Z
CVE-2017-6072 
CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to conduct information-disclosure attacks via defaultadmin.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-21T07:46:00.000Z
CVE-2017-6074 
The dccp_rcv_state_process function in net/dccp/input.c in the Linux kernel through 4.9.11 mishandles DCCP_PKT_REQUEST packet data structures in the LISTEN state, which allows local users to obtain root privileges or cause a denial of service (double free) via an application that makes an IPV6_RECVPKTINFO setsockopt system call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-18T21:40:00.000Z
CVE-2017-6076 
In versions of wolfSSL before 3.10.2 the function fp_mul_comba makes it easier to extract RSA key information for a malicious user who has access to view cache on a machine.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-23T21:00:00.000Z
CVE-2017-6077 
ping.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the ping_IPAddr field of an HTTP POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-22T23:00:00.000Z
CVE-2017-6078 
FastStone MaxView 3.0 and 3.1 allows user-assisted attackers to cause a denial of service (application crash) via a malformed BMP image with a crafted biSize field in the BITMAPINFOHEADER section.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-21T07:46:00.000Z
CVE-2017-6079 
The HTTP web-management application on Edgewater Networks Edgemarc appliances has a hidden page that allows for user-defined commands such as specific iptables routes, etc., to be set. You can use this page as a web shell essentially to execute commands, though you get no feedback client-side from the web application: if the command is valid, it executes. An example is the wget command. The page that allows this has been confirmed in firmware as old as 2006.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-16T17:00:00.000Z
CVE-2017-6080 
An issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1, caused by lack of a protection mechanism involving HTTP Access-Control headers. To exploit the vulnerability, an attacker can send cross-domain requests directly to the REST API for users with a valid session cookie and receive the result.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-13T06:14:00.000Z
CVE-2017-6081 
A CSRF issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1. To exploit the vulnerability, an attacker can send cross-domain requests directly to the REST API for users with a valid session cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-13T06:14:00.000Z
CVE-2017-6086 
Multiple cross-site request forgery (CSRF) vulnerabilities in the addAction and purgeAction functions in ViMbAdmin 3.0.15 allow remote attackers to hijack the authentication of logged administrators to (1) add an administrator user via a crafted POST request to <vimbadmin directory>/application/controllers/DomainController.php, (2) remove an administrator user via a crafted GET request to <vimbadmin directory>/application/controllers/DomainController.php, (3) change an administrator password via a crafted POST request to <vimbadmin directory>/application/controllers/DomainController.php, (4) add a mailbox via a crafted POST request to <vimbadmin directory>/application/controllers/MailboxController.php, (5) delete a mailbox via a crafted POST request to <vimbadmin directory>/application/controllers/MailboxController.php, (6) archive a mailbox address via a crafted GET request to <vimbadmin directory>/application/controllers/ArchiveController.php, (7) add an alias address via a crafted POST request to <vimbadmin directory>/application/controllers/AliasController.php, or (8) remove an alias address via a crafted GET request to <vimbadmin directory>/application/controllers/AliasController.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-27T20:00:00.000Z
CVE-2017-6087 
EyesOfNetwork ("EON") 5.0 and earlier allows remote authenticated users to execute arbitrary code via shell metacharacters in the selected_events[] parameter in the (1) acknowledge, (2) delete, or (3) ownDisown function in module/monitoring_ged/ged_functions.php or the (4) module parameter to module/index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-24T14:00:00.000Z
CVE-2017-6088 
Multiple SQL injection vulnerabilities in EyesOfNetwork (aka EON) 5.0 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) bp_name, (2) display, (3) search, or (4) equipment parameter to module/monitoring_ged/ged_functions.php or the (5) type parameter to monitoring_ged/ajax.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-11T18:00:00.000Z
CVE-2017-6089 
SQL injection vulnerability in PhpCollab 2.5.1 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) project or id parameters to topics/deletetopics.php; the (2) id parameter to bookmarks/deletebookmarks.php; or the (3) id parameter to calendar/deletecalendar.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-02T17:00:00.000Z
CVE-2017-6090 
Unrestricted file upload vulnerability in clients/editclient.php in PhpCollab 2.5.1 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in logos_clients/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-02T17:00:00.000Z
CVE-2017-6094 
CPEs used by subscribers on the access network receive their individual configuration settings from a central GAPS instance. A CPE identifies itself by the MAC address of its WAN interface and a certain "chk" value (48bit) derived from the MAC. The algorithm used to compute the "chk" was disclosed by reverse engineering the CPE's firmware. As a result, it is possible to forge valid "chk" values for any given MAC address and therefore receive the configuration settings of other subscribers' CPEs. The configuration settings often contain sensitive values, for example credentials (username/password) for VoIP services. This issue affects Genexis B.V. GAPS up to 7.2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-20T20:00:00.000Z
CVE-2017-6095 
A SQL injection issue was discovered in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects /inc/lists/csvexport.php (Unauthenticated) with the GET Parameter: list_id.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-21T07:46:00.000Z
CVE-2017-6096 
A SQL injection issue was discovered in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects /inc/lists/view-list.php (Requires authentication to Wordpress admin) with the GET Parameter: filter_list.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-21T07:46:00.000Z
CVE-2017-6097 
A SQL injection issue was discovered in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects /inc/campaign/count_of_send.php (Requires authentication to Wordpress admin) with the POST Parameter: camp_id.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-21T07:46:00.000Z
CVE-2017-6098 
A SQL injection issue was discovered in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects /inc/campaign_save.php (Requires authentication to Wordpress admin) with the POST Parameter: list_id.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-21T07:46:00.000Z
CVE-2017-6099 
Cross-site scripting (XSS) vulnerability in GetAuthDetails.html.php in PayPal PHP Merchant SDK (aka merchant-sdk-php) 3.9.1 allows remote attackers to inject arbitrary web script or HTML via the token parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-23T21:00:00.000Z
CVE-2017-6100 
tcpdf before 6.2.0 uploads files from the server generating PDF-files to an external FTP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-23T19:00:00.000Z
CVE-2017-6102 
Persistent XSS in wordpress plugin rockhoist-badges v1.2.2.
Problem types: description: XSS
Affected products: vendor: blairjordan
product: wordpress plugin rockhoist-badges
Published: 2017-03-02T22:00:00.000Z
CVE-2017-6103 
Persistent XSS Vulnerability in Wordpress plugin AnyVar v0.1.1.
Problem types: description: XSS
Affected products: vendor: matt_dev
product: Wordpress plugin AnyVar
Published: 2017-03-02T22:00:00.000Z
CVE-2017-6104 
Remote file upload vulnerability in Wordpress Plugin Mobile App Native 3.0.
Problem types: description: file upload
Affected products: vendor: zendkmobileapp
product: Wordpress Plugin Mobile App Native 3.0
Published: 2017-03-02T22:00:00.000Z
CVE-2017-6127 
Multiple cross-site request forgery (CSRF) vulnerabilities in the access portal on the DIGISOL DG-HR1400 Wireless Router with firmware 1.00.02 allow remote attackers to hijack the authentication of administrators for requests that (1) change the SSID, (2) change the Wi-Fi password, or (3) possibly have unspecified other impact via crafted requests to form2WlanBasicSetup.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-21T20:00:00.000Z
CVE-2017-6128 
An attacker may be able to cause a denial-of-service (DoS) attack against the sshd component in F5 BIG-IP, Enterprise Manager, BIG-IQ, and iWorkflow.
Problem types: description: sshd is vulnerable to DoS
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, Edge Gateway, GTM, Link Controller, PEM, PSM, WebAccelerator, WebSafe
vendor: F5 Networks, Inc.
product: Enterprise Manager
vendor: F5 Networks, Inc.
product: BIG-IQ Cloud, Device, Security, ADC, Centralized Management, Cloud and Orchestration
vendor: F5 Networks, Inc.
product: iWorkflow
Published: 2017-05-01T15:00:00.000Z
CVE-2017-6129 
In F5 BIG-IP APM software version 13.0.0 and 12.1.2, in some circumstances, APM tunneled VPN flows can cause a VPN/PPP connflow to be prematurely freed or cause TMM to stop responding with a "flow not in use" assertion. An attacker may be able to disrupt traffic or cause the BIG-IP system to fail over to another device in the device group.
Problem types: description: Denial of Service
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP APM
Published: 2017-12-21T17:00:00.000Z
CVE-2017-6130 
F5 SSL Intercept iApp 1.5.0 - 1.5.7 and SSL Orchestrator 2.0 is vulnerable to a Server-Side Request Forgery (SSRF) attack when deployed using the Dynamic Domain Bypass (DDB) feature feature plus SNAT Auto Map option for egress traffic.
Problem types: description: Server-Side Request Forgery
Affected products: vendor: F5 Networks
product: SSL Intercept iApp 1.5.0 - 1.5.7 and SSL Orchestrator 2.0
Published: 2017-04-06T14:00:00.000Z
CVE-2017-6131 
In some circumstances, an F5 BIG-IP version 12.0.0 to 12.1.2 and 13.0.0 Azure cloud instance may contain a default administrative password which could be used to remotely log into the BIG-IP system. The impacted administrative account is the Azure instance administrative user that was created at deployment. The root and admin accounts are not vulnerable. An attacker may be able to remotely access the BIG-IP host via SSH.
Problem types: description: default administrative password
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP Azure cloud instance
Published: 2017-05-23T15:00:00.000Z
CVE-2017-6132 
In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and Websafe software version 13.0.0, 12.0.0 to 12.1.2, 11.6.0 to 11.6.1 and 11.5.0 - 11.5.4, an undisclosed sequence of packets sent to BIG-IP High Availability state mirror listeners (primary and/or secondary IP) may cause TMM to restart.
Problem types: description: Denial of Service
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM, Websafe
Published: 2017-12-21T17:00:00.000Z
CVE-2017-6133 
In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM and WebSafe software version 13.0.0 and 12.1.0 - 12.1.2, undisclosed HTTP requests may cause a denial of service.
Problem types: description: Denial of Service
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, WebSafe
Published: 2017-12-21T17:00:00.000Z
CVE-2017-6134 
In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and WebSafe software version 13.0.0, 12.1.0 - 12.1.2 and 11.5.1 - 11.6.1, an undisclosed sequence of packets, sourced from an adjacent network may cause TMM to crash.
Problem types: description: Denial of Service
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM, WebSafe
Published: 2017-12-21T17:00:00.000Z
CVE-2017-6135 
In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and WebSafe software version 13.0.0, a slow memory leak as a result of undisclosed IPv4 or IPv6 packets sent to BIG-IP management port or self IP addresses may lead to out of memory (OOM) conditions.
Problem types: description: Denial of Service
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM, WebSafe
Published: 2017-12-21T17:00:00.000Z
CVE-2017-6136 
In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and WebSafe software version 13.0.0 and 12.0.0 - 12.1.2, undisclosed traffic patterns sent to BIG-IP virtual servers, with the TCP Fast Open and Tail Loss Probe options enabled in the associated TCP profile, may cause a disruption of service to the Traffic Management Microkernel (TMM).
Problem types: description: Denial of Service
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM, WebSafe
Published: 2017-12-21T17:00:00.000Z
CVE-2017-6137 
In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, PSM, WebAccelerator, and WebSafe 11.6.1 HF1, 12.0.0 HF3, 12.0.0 HF4, and 12.1.0 through 12.1.2, undisclosed traffic patterns received while software SYN cookie protection is engaged may cause a disruption of service to the Traffic Management Microkernel (TMM) on specific platforms and configurations.
Problem types: description: Denial of Service
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, PSM, WebAccelerator, WebSafe
Published: 2017-05-09T15:00:00.000Z
CVE-2017-6138 
In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and WebSafe software version 13.0.0 and 12.1.0 - 12.1.2, malicious requests made to virtual servers with an HTTP profile can cause the TMM to restart. The issue is exposed with BIG-IP APM profiles, regardless of settings. The issue is also exposed with the non-default "normalize URI" configuration options used in iRules and/or BIG-IP LTM policies.
Problem types: description: Denial of Service
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM, WebSafe
Published: 2017-12-21T17:00:00.000Z
CVE-2017-6139 
In F5 BIG-IP APM software version 13.0.0 and 12.1.2, under rare conditions, the BIG-IP APM system appends log details when responding to client requests. Details in the log file can vary; customers running debug mode logging with BIG-IP APM are at highest risk.
Problem types: description: Information Leakage
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP APM
Published: 2017-12-21T17:00:00.000Z
CVE-2017-6140 
On the BIG-IP 2000s, 2200s, 4000s, 4200v, i5600, i5800, i7600, i7800, i10600,i10800, and VIPRION 4450 blades, running version 11.5.0, 11.5.1, 11.5.2, 11.5.3, 11.5.4, 11.6.0, 11.6.1, 12.0.0, 12.1.0, 12.1.1 or 12.1.2 of BIG-IP LTM, AAM, AFM, Analytics, ASM, DNS, GTM or PEM, an undisclosed sequence of packets sent to Virtual Servers with client or server SSL profiles may cause disruption of data plane services.
Problem types: description: Denial of Service
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP LTM, AAM, AFM, Analytics, ASM, DNS, GTM, PEM
Published: 2017-12-21T17:00:00.000Z
CVE-2017-6141 
In F5 BIG-IP LTM, AAM, AFM, APM, ASM, Link Controller, PEM, and WebSafe 12.1.0 through 12.1.2, certain values in a TLS abbreviated handshake when using a client SSL profile with the Session Ticket option enabled may cause disruption of service to the Traffic Management Microkernel (TMM). The Session Ticket option is disabled by default.
Problem types: description: TLS abbreviated handshake vulnerability
Affected products: vendor: F5 Networks, Inc.
product: F5 BIG-IP LTM, AAM, AFM, APM, ASM, Link Controller, PEM, WebSafe
Published: 2017-10-20T15:00:00.000Z
CVE-2017-6142 
X509 certificate verification was not correctly implemented in the early access "user id" feature in the F5 BIG-IP Advanced Firewall Manager versions 13.0.0, 12.1.0-12.1.2, and 11.6.0-11.6.2, and thus did not properly validate the remote server's identity on certain versions of BIG-IP.
Problem types: description: Failed certificate validation
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP AFM
Published: 2018-01-19T14:00:00.000Z
CVE-2017-6143 
X509 certificate verification was not correctly implemented in the IP Intelligence Subscription and IP Intelligence feed-list features, and thus the remote server's identity is not properly validated in F5 BIG-IP 12.0.0-12.1.2, 11.6.0-11.6.2, or 11.5.0-11.5.5.
Problem types: description: MITM
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP (AFM, ASM)
Published: 2018-04-13T13:00:00.000Z
CVE-2017-6144 
In F5 BIG-IP PEM 12.1.0 through 12.1.2 when downloading the Type Allocation Code (TAC) database file via HTTPS, the server's certificate is not verified. Attackers in a privileged network position may be able to launch a man-in-the-middle attack against these connections. TAC databases are used in BIG-IP PEM for Device Type and OS (DTOS) and Tethering detection. Customers not using BIG-IP PEM, not configuring downloads of TAC database files, or not using HTTP for that download are not affected.
Problem types: description: Certificate verification vulnerability
Affected products: vendor: F5 Networks, Inc.
product: F5 BIG-IP PEM
Published: 2017-10-20T15:00:00.000Z
CVE-2017-6145 
iControl REST in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, and WebSafe 12.0.0 through 12.1.2 and 13.0.0 includes a service to convert authorization BIGIPAuthCookie cookies to X-F5-Auth-Token tokens. This service does not properly re-validate cookies when making that conversion, allowing once-valid but now expired cookies to be converted to valid tokens.
Problem types: description: Cookie verification vulnerability
Affected products: vendor: F5 Networks, Inc.
product: F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, WebSafe
Published: 2017-10-20T15:00:00.000Z
CVE-2017-6147 
In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, and WebSafe 12.1.2-HF1 and 13.0.0, an undisclosed type of responses may cause TMM to restart, causing an interruption of service when "SSL Forward Proxy" setting is enabled in both the Client and Server SSL profiles assigned to a BIG-IP Virtual Server.
Problem types: description: TMM SSL Forward Proxy
Affected products: vendor: F5 Networks, Inc.
product: F5 BIG-IP
Published: 2017-09-18T17:00:00.000Z
CVE-2017-6148 
Responses to SOCKS proxy requests made through F5 BIG-IP version 13.0.0, 12.0.0-12.1.3.1, 11.6.1-11.6.2, or 11.5.1-11.5.5 may cause a disruption of services provided by TMM. The data plane is impacted and exposed only when a SOCKS proxy profile is attached to a Virtual Server. The control plane is not impacted by this vulnerability.
Problem types: description: DoS
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP (LTM, AAM, AFM, APM, ASM, Link Controller, PEM, WebSafe)
Published: 2018-04-13T13:00:00.000Z