rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-22957 
A Cross-Origin Resource Sharing (CORS) vulnerability found in UniFi Protect application Version 1.19.2 and earlier allows a malicious actor who has convinced a privileged user to access a URL with malicious code to take over said user’s account.This vulnerability is fixed in UniFi Protect application Version 1.20.0 and later.
Problem types: cwe_id: CWE-16
description: Misconfiguration (CWE-16)
Affected products: vendor: n/a
product: UniFi Protect application
Published: 2021-11-24T18:49:30.000Z
CVE-2021-22958 
A Server-Side Request Forgery vulnerability was found in concrete5 < 8.5.5 that allowed a decimal notation encoded IP address to bypass the limitations in place for localhost allowing interaction with local services. Impact can vary depending on services exposed.CVSSv2.0 AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N
Problem types: cwe_id: CWE-918
description: Server-Side Request Forgery (SSRF) (CWE-918)
Affected products: vendor: n/a
product: https://github.com/concrete5/concrete5
Published: 2021-10-07T13:35:02.000Z
CVE-2021-22959 
The parser in accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS) in llhttp < v2.1.4 and < v6.0.6.
Problem types: cwe_id: CWE-444
description: HTTP Request Smuggling (CWE-444)
Affected products: vendor: NodeJS
product: Node
default_status: unaffected
Published: 2021-11-15T14:45:16.000Z
CVE-2021-22960 
The parse function in llhttp < 2.1.4 and < 6.0.6. ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling (HRS) under certain conditions.
Problem types: cwe_id: CWE-444
description: HTTP Request Smuggling (CWE-444)
Affected products: vendor: NodeJS
product: Node
default_status: unaffected
Published: 2021-11-03T19:22:42.000Z
CVE-2021-22961 
A code injection vulnerability exists within the firewall software of GlassWire v2.1.167 that could lead to arbitrary code execution from a file in the user path on first execution.
Problem types: cwe_id: CWE-94
description: Code Injection (CWE-94)
Affected products: vendor: n/a
product: GlassWire
Published: 2021-10-18T12:48:05.000Z
CVE-2021-22962 
An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack.
Affected products: vendor: Ivanti
product: Avalanche
default_status: unaffected
Published: 2023-12-19T15:43:26.251Z
CVE-2021-22963 
A redirect vulnerability in the fastify-static module version < 4.2.4 allows remote attackers to redirect users to arbitrary websites via a double slash // followed by a domain: http://localhost:3000//google.com/%2e%2e.The issue shows up on all the fastify-static applications that set redirect: true option. By default, it is false.
Problem types: cwe_id: CWE-601
description: Open Redirect (CWE-601)
Affected products: vendor: n/a
product: https://github.com/fastify/fastify-static
Published: 2021-10-14T14:50:11.000Z
CVE-2021-22964 
A redirect vulnerability in the `fastify-static` module version >= 4.2.4 and < 4.4.1 allows remote attackers to redirect Mozilla Firefox users to arbitrary websites via a double slash `//` followed by a domain: `http://localhost:3000//a//youtube.com/%2e%2e%2f%2e%2e`.A DOS vulnerability is possible if the URL contains invalid characters `curl --path-as-is "http://localhost:3000//^/.."`The issue shows up on all the `fastify-static` applications that set `redirect: true` option. By default, it is `false`.
Problem types: cwe_id: CWE-400
description: Denial of Service (CWE-400)
Affected products: vendor: n/a
product: https://github.com/fastify/fastify-static
Published: 2021-10-14T14:50:07.000Z
CVE-2021-22965 
A vulnerability in Pulse Connect Secure before 9.1R12.1 could allow an unauthenticated administrator to causes a denial of service when a malformed request is sent to the device.
Problem types: cwe_id: CWE-400
description: Denial of Service (CWE-400)
Affected products: vendor: n/a
product: Pulse Connect Secure
Published: 2021-11-19T18:10:38.000Z
CVE-2021-22966 
Privilege escalation from Editor to Admin using Groups in Concrete CMS versions 8.5.6 and below. If a group is granted "view" permissions on the bulkupdate page, then users in that group can escalate to being an administrator with a specially crafted curl. Fixed by adding a check for group permissions before allowing a group to be moved. Concrete CMS Security team CVSS scoring: 7.1 AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:HCredit for discovery: "Adrian Tiron from FORTBRIDGE ( https://www.fortbridge.co.uk/ )"This fix is also in Concrete version 9.0.0
Problem types: description: Privilege Escalation (CAPEC-233)
Affected products: vendor: n/a
product: https://github.com/concrete5/concrete5
Published: 2021-11-19T18:09:48.000Z
CVE-2021-22967 
In Concrete CMS (formerly concrete 5) below 8.5.7, IDOR Allows Unauthenticated User to Access Restricted Files If Allowed to Add Message to a Conversation.To remediate this, a check was added to verify a user has permissions to view files before attaching the files to a message in "add / edit message”.Concrete CMS security team gave this a CVSS v3.1 score of 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NCredit for discovery Adrian H
Problem types: cwe_id: CWE-639
description: Insecure Direct Object Reference (IDOR) (CWE-639)
Affected products: vendor: n/a
product: https://github.com/concrete5/concrete5
Published: 2021-11-19T18:11:07.000Z
CVE-2021-22968 
A bypass of adding remote files in Concrete CMS (previously concrete5) File Manager leads to remote code execution in Concrete CMS (concrete5) versions 8.5.6 and below.The external file upload feature stages files in the public directory even if they have disallowed file extensions. They are stored in a directory with a random name, but it's possible to stall the uploads and brute force the directory name. You have to be an admin with the ability to upload files, but this bug gives you the ability to upload restricted file types and execute them depending on server configuration.To fix this, a check for allowed file extensions was added before downloading files to a tmp directory.Concrete CMS Security Team gave this a CVSS v3.1 score of 5.4 AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:H/A:NThis fix is also in Concrete version 9.0.0
Problem types: cwe_id: CWE-98
description: Remote File Inclusion (CWE-98)
Affected products: vendor: n/a
product: https://github.com/concrete5/concrete5
Published: 2021-11-19T18:11:35.000Z
CVE-2021-22969 
Concrete CMS (formerly concrete5) versions below 8.5.7 has a SSRF mitigation bypass using DNS Rebind attack giving an attacker the ability to fetch cloud IAAS (ex AWS) IAM keys.To fix this Concrete CMS no longer allows downloads from the local network and specifies the validated IP when downloading rather than relying on DNS.Discoverer: Adrian Tiron from FORTBRIDGE ( https://www.fortbridge.co.uk/ )The Concrete CMS team gave this a CVSS 3.1 score of 3.5 AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N . Please note that Cloud IAAS provider mis-configurations are not Concrete CMS vulnerabilities. A mitigation for this vulnerability is to make sure that the IMDS configurations are according to a cloud provider's best practices.This fix is also in Concrete version 9.0.0
Problem types: cwe_id: CWE-918
description: Server-Side Request Forgery (SSRF) (CWE-918)
Affected products: vendor: n/a
product: https://github.com/concrete5/concrete5
Published: 2021-11-19T18:08:30.000Z
CVE-2021-22970 
Concrete CMS (formerly concrete5) versions 8.5.6 and below and version 9.0.0 allow local IP importing causing the system to be vulnerable toa. SSRF attacks on the private LAN servers by reading files from the local LAN. An attacker can pivot in the private LAN and exploit local network appsandb. SSRF Mitigation Bypass through DNS RebindingConcrete CMS security team gave this a CVSS score of 3.5 AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:NConcrete CMS is maintaining Concrete version 8.5.x until 1 May 2022 for security fixes.This CVE is shared with HackerOne Reports https://hackerone.com/reports/1364797 and https://hackerone.com/reports/1360016Reporters: Adrian Tiron from FORTBRIDGE (https://www.fortbridge.co.uk/ ) and Bipul Jaiswal
Problem types: cwe_id: CWE-918
description: Server-Side Request Forgery (SSRF) (CWE-918)
Affected products: vendor: n/a
product: https://github.com/concrete5/concrete5
Published: 2021-11-19T18:08:53.000Z
CVE-2021-22973 
On BIG-IP version 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.5, and all 12.1.x versions, JSON parser function does not protect against out-of-bounds memory accesses or writes. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
Problem types: description: DoS
Affected products: vendor: n/a
product: BIG-IP
Published: 2021-02-12T16:05:46.000Z
CVE-2021-22974 
On BIG-IP version 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, and 13.1.x before 13.1.3.6 and all versions of BIG-IQ 7.x and 6.x, an authenticated attacker with access to iControl REST over the control plane may be able to take advantage of a race condition to execute commands with an elevated privilege level. This vulnerability is due to an incomplete fix for CVE-2017-6167. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
Problem types: description: Privilege escalation
Affected products: vendor: n/a
product: BIG-IP, BIG-IQ
Published: 2021-02-12T16:23:27.000Z
CVE-2021-22975 
On BIG-IP version 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, and 14.1.x before 14.1.3.1, under some circumstances, Traffic Management Microkernel (TMM) may restart on the BIG-IP system while passing large bursts of traffic. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
Problem types: description: DoS
Affected products: vendor: n/a
product: BIG-IP
Published: 2021-02-12T16:02:21.000Z
CVE-2021-22976 
On BIG-IP Advanced WAF and ASM version 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.6, and all 12.1.x versions, when the BIG-IP ASM system processes WebSocket requests with JSON payloads, an unusually large number of parameters can cause excessive CPU usage in the BIG-IP ASM bd process. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
Problem types: description: DoS
Affected products: vendor: n/a
product: BIG-IP Advanced WAF & BIG-IP ASM
Published: 2021-02-12T17:43:49.000Z
CVE-2021-22977 
On BIG-IP version 16.0.0-16.0.1 and 14.1.2.4-14.1.3, cooperation between malicious HTTP client code and a malicious server may cause TMM to restart and generate a core file. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
Problem types: description: DoS
Affected products: vendor: n/a
product: BIG-IP
Published: 2021-02-12T19:23:48.000Z
CVE-2021-22978 
On BIG-IP version 16.0.x before 16.0.1, 15.1.x before 15.1.1, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.5, and all 12.1.x and 11.6.x versions, undisclosed endpoints in iControl REST allow for a reflected XSS attack, which could lead to a complete compromise of BIG-IP if the victim user is granted the admin role. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
Problem types: description: XSS
Affected products: vendor: n/a
product: BIG-IP
Published: 2021-02-12T19:18:12.000Z
CVE-2021-22979 
On BIG-IP version 16.0.x before 16.0.1, 15.1.x before 15.1.1, 14.1.x before 14.1.2.8, 13.1.x before 13.1.3.5, and all 12.1.x versions, a reflected Cross-Site Scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility when Fraud Protection Service is provisioned and allows an attacker to execute JavaScript in the context of the current logged-in user. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
Problem types: description: XSS
Affected products: vendor: n/a
product: BIG-IP
Published: 2021-02-12T17:55:15.000Z
CVE-2021-22980 
In Edge Client version 7.2.x before 7.2.1.1, 7.1.9.x before 7.1.9.8, and 7.1.x-7.1.8.x before 7.1.8.5, an untrusted search path vulnerability in the BIG-IP APM Client Troubleshooting Utility (CTU) for Windows could allow an attacker to load a malicious DLL library from its current directory. User interaction is required to exploit this vulnerability in that the victim must run this utility on the Windows system. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
Problem types: description: Code injection
Affected products: vendor: n/a
product: Edge Client
Published: 2021-02-12T17:52:28.000Z
CVE-2021-22981 
On all versions of BIG-IP 12.1.x and 11.6.x, the original TLS protocol includes a weakness in the master secret negotiation that is mitigated by the Extended Master Secret (EMS) extension defined in RFC 7627. TLS connections that do not use EMS are vulnerable to man-in-the-middle attacks during renegotiation. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
Problem types: description: MitM
Affected products: vendor: n/a
product: BIG-IP
Published: 2021-02-12T17:50:21.000Z
CVE-2021-22982 
On BIG-IP DNS and GTM version 13.1.x before 13.1.0.4, and all versions of 12.1.x and 11.6.x, big3d does not securely handle and parse certain payloads resulting in a buffer overflow. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
Problem types: description: DoS
Affected products: vendor: n/a
product: BIG-IP DNS and GTM
Published: 2021-02-12T17:46:11.000Z
CVE-2021-22983 
On BIG-IP AFM version 15.1.x before 15.1.1, 14.1.x before 14.1.3.1, and 13.1.x before 13.1.3.5, authenticated users accessing the Configuration utility for AFM are vulnerable to a cross-site scripting attack if they attempt to access a maliciously-crafted URL. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
Problem types: description: XSS
Affected products: vendor: n/a
product: BIG-IP AFM
Published: 2021-02-12T17:57:08.000Z
CVE-2021-22984 
On BIG-IP Advanced WAF and ASM version 15.1.x before 15.1.0.2, 15.0.x before 15.0.1.4, 14.1.x before 14.1.2.5, 13.1.x before 13.1.3.4, 12.1.x before 12.1.5.2, and 11.6.x before 11.6.5.2, when receiving a unauthenticated client request with a maliciously crafted URI, a BIG-IP Advanced WAF or ASM virtual server configured with a DoS profile with Proactive Bot Defense (versions prior to 14.1.0), or a Bot Defense profile (versions 14.1.0 and later), may subject clients and web servers to Open Redirection attacks. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
Problem types: description: open redirection
Affected products: vendor: n/a
product: BIG-IP Advanced WAF & BIG-IP ASM
Published: 2021-02-12T19:21:56.000Z
CVE-2021-22985 
On BIG-IP APM version 16.0.x before 16.0.1.1, under certain conditions, when processing VPN traffic with APM, TMM consumes excessive memory. A malicious, authenticated VPN user may abuse this to perform a DoS attack against the APM. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
Problem types: description: DoS
Affected products: vendor: n/a
product: BIG-IP APM
Published: 2021-02-12T17:48:22.000Z
CVE-2021-22986 
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3 amd BIG-IQ 7.1.0.x before 7.1.0.3 and 7.0.0.x before 7.0.0.2, the iControl REST interface has an unauthenticated remote command execution vulnerability. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
Problem types: description: Remote Command Execution
Affected products: vendor: n/a
product: BIG-IP; BIG-IQ
Published: 2021-03-31T14:04:47.000Z
CVE-2021-22987 
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3 when running in Appliance mode, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has an authenticated remote command execution vulnerability in undisclosed pages. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
Problem types: description: Remote Command Execution
Affected products: vendor: n/a
product: BIG-IP Appliance Mode
Published: 2021-03-31T16:43:17.000Z
CVE-2021-22988 
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, TMUI, also referred to as the Configuration utility, has an authenticated remote command execution vulnerability in undisclosed pages. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
Problem types: description: RCE
Affected products: vendor: n/a
product: BIG-IP
Published: 2021-03-31T14:03:11.000Z
CVE-2021-22989 
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, when running in Appliance mode with Advanced WAF or BIG-IP ASM provisioned, the TMUI, also referred to as the Configuration utility, has an authenticated remote command execution vulnerability in undisclosed pages. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
Problem types: description: RCE
Affected products: vendor: n/a
product: BIG-IP Advanced WAF or BIG-IP ASM in Appliance Mode
Published: 2021-03-31T16:48:26.000Z
CVE-2021-22990 
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, on systems with Advanced WAF or BIG-IP ASM provisioned, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has an authenticated remote command execution vulnerability in undisclosed pages. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
Problem types: description: RCE
Affected products: vendor: n/a
product: BIG-IP Advanced WAF or BIG-IP ASM
Published: 2021-03-31T16:44:38.000Z
CVE-2021-22991 
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, undisclosed requests to a virtual server may be incorrectly handled by the Traffic Management Microkernel (TMM) URI normalization, which may trigger a buffer overflow, resulting in a DoS attack. In certain situations, it may theoretically allow bypass of URL based access control or remote code execution (RCE). Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
Problem types: description: RCE
Affected products: vendor: n/a
product: BIG-IP
Published: 2021-03-31T17:23:14.000Z
CVE-2021-22992 
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, a malicious HTTP response to an Advanced WAF/BIG-IP ASM virtual server with Login Page configured in its policy may trigger a buffer overflow, resulting in a DoS attack. In certain situations, it may allow remote code execution (RCE), leading to complete system compromise. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
Problem types: description: RCE
Affected products: vendor: n/a
product: BIG-IP Advanced WAF and BIG-IP ASM
Published: 2021-03-31T16:47:05.000Z
CVE-2021-22993 
On BIG-IP Advanced WAF and BIG-IP ASM versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, DOM-based XSS on DoS Profile properties page. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
Problem types: description: XSS
Affected products: vendor: n/a
product: BIG-IP Advanced WAF and BIG-IP ASM
Published: 2021-03-31T17:45:51.000Z
CVE-2021-22994 
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, undisclosed endpoints in iControl REST allow for a reflected XSS attack, which could lead to a complete compromise of the BIG-IP system if the victim user is granted the admin role. This vulnerability is due to an incomplete fix for CVE-2020-5948. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
Problem types: description: XSS
Affected products: vendor: n/a
product: BIG-IP
Published: 2021-03-31T17:25:07.000Z
CVE-2021-22995 
On all 7.x and 6.x versions (fixed in 8.0.0), BIG-IQ high availability (HA) when using a Quorum device for automatic failover does not implement any form of authentication with the Corosync daemon. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
Problem types: description: DoS
Affected products: vendor: n/a
product: BIG-IQ
Published: 2021-03-31T16:45:54.000Z
CVE-2021-22996 
On all 7.x versions (fixed in 8.0.0), when set up for auto failover, a BIG-IQ Data Collection Device (DCD) cluster member that receives an undisclosed message may cause the corosync process to abort. This behavior may lead to a denial-of-service (DoS) and impact the stability of a BIG-IQ high availability (HA) cluster. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
Problem types: description: DoS
Affected products: vendor: n/a
product: BIG-IQ
Published: 2021-03-31T17:34:21.000Z
CVE-2021-22997 
On all 7.x and 6.x versions (fixed in 8.0.0), BIG-IQ HA ElasticSearch service does not implement any form of authentication for the clustering transport services, and all data used by ElasticSearch for transport is unencrypted. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
Problem types: description: information disclosure
Affected products: vendor: n/a
product: BIG-IQ
Published: 2021-03-31T17:35:54.000Z
CVE-2021-22998 
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, SYN flood protection thresholds are not enforced in secure network address translation (SNAT) listeners. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
Problem types: description: DoS
Affected products: vendor: n/a
product: BIG-IP
Published: 2021-03-31T17:37:25.000Z
CVE-2021-22999 
On versions 15.0.x before 15.1.0 and 14.1.x before 14.1.4, the BIG-IP system provides an option to connect HTTP/2 clients to HTTP/1.x servers. When a client is slow to accept responses and it closes a connection prematurely, the BIG-IP system may indefinitely retain some streams unclosed. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
Problem types: description: DoS
Affected products: vendor: n/a
product: BIG-IP
Published: 2021-03-31T17:29:56.000Z
CVE-2021-23000 
On BIG-IP versions 13.1.3.4-13.1.3.6 and 12.1.5.2, if the tmm.http.rfc.enforcement BigDB key is enabled in a BIG-IP system, or the Bad host header value is checked in the AFM HTTP security profile associated with a virtual server, in rare instances, a specific sequence of malicious requests may cause TMM to restart. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
Problem types: description: DoS
Affected products: vendor: n/a
product: BIG-IP
Published: 2021-03-31T17:26:29.000Z