rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-6563 
Moxa IKS and EDS generate a predictable cookie calculated with an MD5 hash, allowing an attacker to capture the administrator's password, which could lead to a full compromise of the device.
Problem types: cwe_id: CWE-341
description: Predictable from observable state CWE-341
Affected products: vendor: ICS-CERT
product: Moxa IKS, EDS
Published: 2019-03-05T21:00:00.000Z
CVE-2019-6564 
GE Communicator, all versions prior to 4.0.517, allows a non-administrative user to place malicious files within the installer file directory, which may allow an attacker to gain administrative privileges on a system during installation or upgrade.
Problem types: cwe_id: CWE-427
description: UNCONTROLLED SEARCH PATH CWE-427
Affected products: vendor: n/a
product: GE Communicator
Published: 2019-05-09T14:27:08.000Z
CVE-2019-6565 
Moxa IKS and EDS fails to properly validate user input, giving unauthenticated and authenticated attackers the ability to perform XSS attacks, which may be used to send a malicious script.
Problem types: cwe_id: CWE-79
description: Cross-site scripting CWE-79
Affected products: vendor: ICS-CERT
product: Moxa IKS, EDS
Published: 2019-03-05T21:00:00.000Z
CVE-2019-6566 
GE Communicator, all versions prior to 4.0.517, allows a non-administrative user to replace the uninstaller with a malicious version, which could allow an attacker to gain administrator privileges to the system.
Problem types: cwe_id: CWE-284
description: IMPROPER ACCESS CONTROLS CWE-284
Affected products: vendor: n/a
product: GE Communicator
Published: 2019-05-09T14:51:49.000Z
CVE-2019-6567 
A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All Versions < V5.2.4), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions < V5.5.0), SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants) (All versions < V4.1.3), SCALANCE X-414-3E (All versions). The affected devices store passwords in a recoverable format. An attacker may extract and recover device passwords from the device configuration. Successful exploitation requires access to a device configuration backup and impacts confidentiality of the stored passwords.
Problem types: cwe_id: CWE-257
description: CWE-257: Storing Passwords in a Recoverable Format
Affected products: vendor: Siemens
product: SCALANCE X-200 switch family (incl. SIPLUS NET variants)
vendor: Siemens
product: SCALANCE X-200IRT switch family (incl. SIPLUS NET variants)
vendor: Siemens
product: SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants)
vendor: Siemens
product: SCALANCE X-414-3E
Published: 2019-06-12T13:47:56.000Z
CVE-2019-6570 
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0). Due to insufficient checking of user permissions, an attacker may access URLs that require special authorization. An attacker must have access to a low privileged account in order to exploit the vulnerability.
Problem types: cwe_id: CWE-280
description: CWE-280: Improper Handling of Insufficient Permissions or Privileges
Affected products: vendor: Siemens
product: SINEMA Remote Connect Server
Published: 2019-04-17T13:40:24.000Z
CVE-2019-6571 
A vulnerability has been identified in SIEMENS LOGO!8 (6ED1052-xyyxx-0BA8 FS:01 to FS:06 / Firmware version V1.80.xx and V1.81.xx), SIEMENS LOGO!8 (6ED1052-xyy08-0BA0 FS:01 / Firmware version < V1.82.02). An attacker with network access to port 10005/tcp of the LOGO! device could cause a Denial-of-Service condition by sending specially crafted packets. The security vulnerability could be exploited by an unauthenticated attacker with network access to the affected service. No user interaction is required to exploit this security vulnerability. Successful exploitation of the security vulnerability compromises availability of the targeted system. At the time of advisory publication no public exploitation of this security vulnerability was known.
Problem types: cwe_id: CWE-119
description: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products: vendor: Siemens AG
product: SIEMENS LOGO!8
vendor: Siemens AG
product: SIEMENS LOGO!8
Published: 2019-06-12T13:47:56.000Z
CVE-2019-6572 
A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions < V15.1 Update 1), SIMATIC HMI Comfort Outdoor Panels 7" & 15" (All versions < V15.1 Update 1), SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 und KTP900F (All versions < V15.1 Update 1), SIMATIC WinCC Runtime Advanced (All versions < V15.1 Update 1), SIMATIC WinCC Runtime Professional (All versions < V15.1 Update 1), SIMATIC WinCC (TIA Portal) (All versions < V15.1 Update 1), SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) (All versions). The affected device offered SNMP read and write capacities with a publicly know hardcoded community string. The security vulnerability could be exploited by an attacker with network access to the affected device. Successful exploitation requires no system privileges and no user interaction. An attacker could use the vulnerability to compromise confidentiality and integrity of the affected system. At the time of advisory publication no public exploitation of this security vulnerability was known.
Problem types: cwe_id: CWE-200
description: CWE-200: Information Exposure
Affected products: vendor: Siemens AG
product: SIMATIC HMI Comfort Panels 4" - 22"
vendor: Siemens AG
product: SIMATIC HMI Comfort Outdoor Panels 7" & 15"
vendor: Siemens AG
product: SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 und KTP900F
vendor: Siemens AG
product: SIMATIC WinCC Runtime Advanced
vendor: Siemens AG
product: SIMATIC WinCC Runtime Professional
vendor: Siemens AG
product: SIMATIC WinCC (TIA Portal)
vendor: Siemens AG
product: SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel)
Published: 2019-05-14T19:54:48.000Z
CVE-2019-6574 
A vulnerability has been identified in SINAMICS PERFECT HARMONY GH180 with NXG I control, MLFBs: 6SR2...-, 6SR3...-, 6SR4...- (All Versions with option G21, G22, G23, G26, G28, G31, G32, G38, G43 or G46), SINAMICS PERFECT HARMONY GH180 with NXG II control, MLFBs: 6SR2...-, 6SR3...-, 6SR4...- (All Versions with option G21, G22, G23, G26, G28, G31, G32, G38, G43 or G46). An improperly configured Parameter Read/Write execution via Field bus network may cause the controller to restart. The vulnerability could be exploited by an attacker with network access to the device. Successful exploitation requires no privileges and no user interaction. An attacker could use the vulnerability to compromise the availability of the affected system. At the time of advisory publication no public exploitation of this security vulnerability was known.
Problem types: cwe_id: CWE-200
description: CWE-200: Information Exposure
Affected products: vendor: Siemens AG
product: SINAMICS PERFECT HARMONY GH180 with NXG I control, MLFBs: 6SR2...-, 6SR3...-, 6SR4...-
vendor: Siemens AG
product: SINAMICS PERFECT HARMONY GH180 with NXG II control, MLFBs: 6SR2...-, 6SR3...-, 6SR4...-
Published: 2019-05-14T19:54:48.000Z
CVE-2019-6575 
A vulnerability has been identified in SIMATIC CP 443-1 OPC UA (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions < V2.7), SIMATIC HMI Comfort Outdoor Panels 7" & 15" (incl. SIPLUS variants) (All versions < V15.1 Upd 4), SIMATIC HMI Comfort Panels 4" - 22" (incl. SIPLUS variants) (All versions < V15.1 Upd 4), SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 and KTP900F (All versions < V15.1 Upd 4), SIMATIC IPC DiagMonitor (All versions < V5.1.3), SIMATIC NET PC Software V13 (All versions), SIMATIC NET PC Software V14 (All versions < V14 SP1 Update 14), SIMATIC NET PC Software V15 (All versions), SIMATIC RF188C (All versions < V1.1.0), SIMATIC RF600R family (All versions < V3.2.1), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions >= V2.5 < V2.6.1), SIMATIC S7-1500 Software Controller (All versions between V2.5 (including) and V2.7 (excluding)), SIMATIC WinCC OA (All versions < V3.15 P018), SIMATIC WinCC Runtime Advanced (All versions < V15.1 Upd 4), SINEC NMS (All versions < V1.0 SP1), SINEMA Server (All versions < V14 SP2), SINUMERIK OPC UA Server (All versions < V2.1), TeleControl Server Basic (All versions < V3.1.1). Specially crafted network packets sent to affected devices on port 4840/tcp could allow an unauthenticated remote attacker to cause a denial of service condition of the OPC communication or crash the device. The security vulnerability could be exploited by an attacker with network access to the affected systems. Successful exploitation requires no system privileges and no user interaction. An attacker could use the vulnerability to compromise availability of the OPC communication.
Problem types: cwe_id: CWE-248
description: CWE-248: Uncaught Exception
Affected products: vendor: Siemens
product: SIMATIC CP 443-1 OPC UA
vendor: Siemens
product: SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)
vendor: Siemens
product: SIMATIC HMI Comfort Outdoor Panels 7" & 15" (incl. SIPLUS variants)
vendor: Siemens
product: SIMATIC HMI Comfort Panels 4" - 22" (incl. SIPLUS variants)
vendor: Siemens
product: SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 and KTP900F
vendor: Siemens
product: SIMATIC IPC DiagMonitor
vendor: Siemens
product: SIMATIC NET PC Software V13
vendor: Siemens
product: SIMATIC NET PC Software V14
vendor: Siemens
product: SIMATIC NET PC Software V15
vendor: Siemens
product: SIMATIC RF188C
vendor: Siemens
product: SIMATIC RF600R family
vendor: Siemens
product: SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants)
vendor: Siemens
product: SIMATIC S7-1500 Software Controller
vendor: Siemens
product: SIMATIC WinCC OA
vendor: Siemens
product: SIMATIC WinCC Runtime Advanced
vendor: Siemens
product: SINEC NMS
vendor: Siemens
product: SINEMA Server
vendor: Siemens
product: SINUMERIK OPC UA Server
vendor: Siemens
product: TeleControl Server Basic
Published: 2019-04-17T13:40:24.000Z
CVE-2019-6576 
A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions < V15.1 Update 1), SIMATIC HMI Comfort Outdoor Panels 7" & 15" (All versions < V15.1 Update 1), SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 und KTP900F (All versions < V15.1 Update 1), SIMATIC WinCC Runtime Advanced (All versions < V15.1 Update 1), SIMATIC WinCC Runtime Professional (All versions < V15.1 Update 1), SIMATIC WinCC (TIA Portal) (All versions < V15.1 Update 1), SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) (All versions). An attacker with network access to affected devices could potentially obtain a TLS session key. If the attacker is able to observe TLS traffic between a legitimate user and the device, then the attacker could decrypt the TLS traffic. The security vulnerability could be exploited by an attacker who has network access to the web interface of the device and who is able to observe TLS traffic between legitimate users and the web interface of the affected device. The vulnerability could impact the confidentiality of the communication between the affected device and a legitimate user. At the time of advisory publication no public exploitation of the security vulnerability was known.
Problem types: cwe_id: CWE-310
description: CWE-310: Cryptographic Issues
Affected products: vendor: Siemens AG
product: SIMATIC HMI Comfort Panels 4" - 22"
vendor: Siemens AG
product: SIMATIC HMI Comfort Outdoor Panels 7" & 15"
vendor: Siemens AG
product: SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 und KTP900F
vendor: Siemens AG
product: SIMATIC WinCC Runtime Advanced
vendor: Siemens AG
product: SIMATIC WinCC Runtime Professional
vendor: Siemens AG
product: SIMATIC WinCC (TIA Portal)
vendor: Siemens AG
product: SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel)
Published: 2019-05-14T19:54:48.000Z
CVE-2019-6577 
A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions < V15.1 Update 1), SIMATIC HMI Comfort Outdoor Panels 7" & 15" (All versions < V15.1 Update 1), SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 und KTP900F (All versions < V15.1 Update 1), SIMATIC WinCC Runtime Advanced (All versions < V15.1 Update 1), SIMATIC WinCC Runtime Professional (All versions < V15.1 Update 1), SIMATIC WinCC (TIA Portal) (All versions < V15.1 Update 1), SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) (All versions). The integrated web server could allow Cross-Site Scripting (XSS) attacks if an attacker is able to modify particular parts of the device configuration via SNMP. The security vulnerability could be exploited by an attacker with network access to the affected system. Successful exploitation requires system privileges and user interaction. An attacker could use the vulnerability to compromise confidentiality and the integrity of the affected system. At the stage of publishing this security advisory no public exploitation is known.
Problem types: cwe_id: CWE-80
description: CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Affected products: vendor: Siemens AG
product: SIMATIC HMI Comfort Panels 4" - 22"
vendor: Siemens AG
product: SIMATIC HMI Comfort Outdoor Panels 7" & 15"
vendor: Siemens AG
product: SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 und KTP900F
vendor: Siemens AG
product: SIMATIC WinCC Runtime Advanced
vendor: Siemens AG
product: SIMATIC WinCC Runtime Professional
vendor: Siemens AG
product: SIMATIC WinCC (TIA Portal)
vendor: Siemens AG
product: SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel)
Published: 2019-05-14T19:54:48.000Z
CVE-2019-6578 
A vulnerability has been identified in SINAMICS PERFECT HARMONY GH180 with NXG I control, MLFBs: 6SR2...-, 6SR3...-, 6SR4...- (All Versions with option G28), SINAMICS PERFECT HARMONY GH180 with NXG II control, MLFBs: 6SR2...-, 6SR3...-, 6SR4...- (All Versions with option G28). A denial of service vulnerability exists in the affected products. The vulnerability could be exploited by an attacker with network access to the device. Successful exploitation requires no privileges and no user interaction. An attacker could use the vulnerability to compromise availability of the affected system. At the time of advisory publication no public exploitation of this security vulnerability was known.
Problem types: cwe_id: CWE-400
description: CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')
Affected products: vendor: Siemens AG
product: SINAMICS PERFECT HARMONY GH180 with NXG I control, MLFBs: 6SR2...-, 6SR3...-, 6SR4...-
vendor: Siemens AG
product: SINAMICS PERFECT HARMONY GH180 with NXG II control, MLFBs: 6SR2...-, 6SR3...-, 6SR4...-
Published: 2019-05-14T19:54:48.000Z
CVE-2019-6579 
A vulnerability has been identified in Spectrum Power 4 (with Web Office Portal). An attacker with network access to the web server on port 80/TCP or 443/TCP could execute system commands with administrative privileges. The security vulnerability could be exploited by an unauthenticated attacker with network access to the affected service. No user interaction is required to exploit this security vulnerability. Successful exploitation of the security vulnerability compromises confidentiality, integrity or availability of the targeted system. At the time of advisory publication no public exploitation of this security vulnerability was known.
Problem types: cwe_id: CWE-77
description: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
Affected products: vendor: Siemens AG
product: Spectrum Power™ 4
Published: 2019-04-17T13:40:24.000Z
CVE-2019-6580 
A vulnerability has been identified in Siveillance VMS 2017 R2 (All versions < V11.2a), Siveillance VMS 2018 R1 (All versions < V12.1a), Siveillance VMS 2018 R2 (All versions < V12.2a), Siveillance VMS 2018 R3 (All versions < V12.3a), Siveillance VMS 2019 R1 (All versions < V13.1a). An attacker with network access to port 80/TCP could change device properties without authorization. No user interaction is required to exploit this security vulnerability. Successful exploitation compromises confidentiality, integrity and availability of the targeted system. At the time of advisory publication no public exploitation of this security vulnerability was known.
Problem types: cwe_id: CWE-862
description: CWE-862: Missing Authorization
Affected products: vendor: Siemens AG
product: Siveillance VMS 2017 R2
vendor: Siemens AG
product: Siveillance VMS 2018 R1
vendor: Siemens AG
product: Siveillance VMS 2018 R2
vendor: Siemens AG
product: Siveillance VMS 2018 R3
vendor: Siemens AG
product: Siveillance VMS 2019 R1
Published: 2019-06-12T13:47:57.000Z
CVE-2019-6581 
A vulnerability has been identified in Siveillance VMS 2017 R2 (All versions < V11.2a), Siveillance VMS 2018 R1 (All versions < V12.1a), Siveillance VMS 2018 R2 (All versions < V12.2a), Siveillance VMS 2018 R3 (All versions < V12.3a), Siveillance VMS 2019 R1 (All versions < V13.1a). An attacker with network access to port 80/TCP could change user roles without proper authorization. The security vulnerability could be exploited by an authenticated attacker with network access to the affected service. No user interaction is required to exploit this security vulnerability. Successful exploitation compromises confidentiality, integrity and availability of the targeted system. At the time of advisory publication no public exploitation of this security vulnerability was known.
Problem types: cwe_id: CWE-285
description: CWE-285: Improper Authorization
Affected products: vendor: Siemens AG
product: Siveillance VMS 2017 R2
vendor: Siemens AG
product: Siveillance VMS 2018 R1
vendor: Siemens AG
product: Siveillance VMS 2018 R2
vendor: Siemens AG
product: Siveillance VMS 2018 R3
vendor: Siemens AG
product: Siveillance VMS 2019 R1
Published: 2019-06-12T13:47:57.000Z
CVE-2019-6582 
A vulnerability has been identified in Siveillance VMS 2017 R2 (All versions < V11.2a), Siveillance VMS 2018 R1 (All versions < V12.1a), Siveillance VMS 2018 R2 (All versions < V12.2a), Siveillance VMS 2018 R3 (All versions < V12.3a), Siveillance VMS 2019 R1 (All versions < V13.1a). An attacker with network access to port 80/TCP can change user-defined event properties without proper authorization. The security vulnerability could be exploited by an authenticated attacker with network access to the affected service. No user interaction is required to exploit this security vulnerability. Successful exploitation compromises integrity of the user-defined event properties and the availability of corresponding functionality. At the time of advisory publication no public exploitation of this security vulnerability was known.
Problem types: cwe_id: CWE-285
description: CWE-285: Improper Authorization
Affected products: vendor: Siemens AG
product: Siveillance VMS 2017 R2
vendor: Siemens AG
product: Siveillance VMS 2018 R1
vendor: Siemens AG
product: Siveillance VMS 2018 R2
vendor: Siemens AG
product: Siveillance VMS 2018 R3
vendor: Siemens AG
product: Siveillance VMS 2019 R1
Published: 2019-06-12T13:47:57.000Z
CVE-2019-6584 
A vulnerability has been identified in SIEMENS LOGO!8 (6ED1052-xyyxx-0BA8 FS:01 to FS:06 / Firmware version V1.80.xx and V1.81.xx), SIEMENS LOGO!8 (6ED1052-xyy08-0BA0 FS:01 / Firmware version < V1.82.02). The integrated webserver does not invalidate the Session ID upon user logout. An attacker that successfully extracted a valid Session ID is able to use it even after the user logs out. The security vulnerability could be exploited by an attacker in a privileged network position who is able to read the communication between the affected device and the user or by an attacker who is able to obtain valid Session IDs through other means. The user must invoke a session to the affected device. At the time of advisory publication no public exploitation of this security vulnerability was known.
Problem types: cwe_id: CWE-384
description: CWE-384: Session Fixation
Affected products: vendor: Siemens AG
product: SIEMENS LOGO!8
vendor: Siemens AG
product: SIEMENS LOGO!8
Published: 2019-06-12T13:47:57.000Z
CVE-2019-6585 
A vulnerability has been identified in SCALANCE S602 (All versions >= V3.0 and < V4.1), SCALANCE S612 (All versions >= V3.0 and < V4.1), SCALANCE S623 (All versions >= V3.0 and < V4.1), SCALANCE S627-2M (All versions >= V3.0 and < V4.1). The integrated configuration web server of the affected devices could allow Cross-Site Scripting (XSS) attacks if unsuspecting users are tricked into accessing a malicious link. User interaction is required for a successful exploitation. The user must be logged into the web interface in order for the exploitation to succeed.
Problem types: cwe_id: CWE-80
description: CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Affected products: vendor: Siemens
product: SCALANCE S602
vendor: Siemens
product: SCALANCE S612
vendor: Siemens
product: SCALANCE S623
vendor: Siemens
product: SCALANCE S627-2M
Published: 2020-03-10T19:16:17.000Z
CVE-2019-6588 
In Liferay Portal before 7.1 CE GA4, an XSS vulnerability exists in the SimpleCaptcha API when custom code passes unsanitized input into the "url" parameter of the JSP taglib call <liferay-ui:captcha url="<%= url %>" /> or <liferay-captcha:captcha url="<%= url %>" />. Liferay Portal out-of-the-box behavior with no customizations is not vulnerable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-03T19:43:42.000Z
CVE-2019-6589 
On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.3, 12.1.0-12.1.3.7, and 11.6.0-11.6.3.2, a reflected Cross Site Scripting (XSS) vulnerability is present in an undisclosed page of the BIG-IP TMUI (Traffic Management User Interface) also known as the BIG-IP configuration utility.
Problem types: description: XSS
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator)
Published: 2019-02-14T00:00:00.000Z
CVE-2019-6590 
On BIG-IP LTM 13.0.0 to 13.0.1 and 12.1.0 to 12.1.3.6, under certain conditions, the TMM may consume excessive resources when processing SSL Session ID Persistence traffic.
Problem types: description: DoS
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP (LTM)
Published: 2019-02-05T19:00:00.000Z
CVE-2019-6591 
On BIG-IP APM 14.0.0 to 14.0.0.4, 13.0.0 to 13.1.1.3 and 12.1.0 to 12.1.3.7, a reflected cross-site scripting (XSS) vulnerability exists in the resource information page for authenticated users when a full webtop is configured on the BIG-IP APM system.
Problem types: description: XSS
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP (APM)
Published: 2019-02-05T18:00:00.000Z
CVE-2019-6592 
On BIG-IP 14.1.0-14.1.0.1, TMM may restart and produce a core file when validating SSL certificates in client SSL or server SSL profiles.
Problem types: description: DoS
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator)
Published: 2019-02-26T15:00:00.000Z
CVE-2019-6593 
On BIG-IP 11.5.1-11.5.4, 11.6.1, and 12.1.0, a virtual server configured with a Client SSL profile may be vulnerable to a chosen ciphertext attack against CBC ciphers. When exploited, this may result in plaintext recovery of encrypted messages through a man-in-the-middle (MITM) attack, despite the attacker not having gained access to the server's private key itself. (CVE-2019-6593 also known as Zombie POODLE and GOLDENDOODLE.)
Problem types: description: Information leakage
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator)
Published: 2019-02-26T15:00:00.000Z