rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-5826 
Symantec Endpoint Protection (SEP) and Symantec Endpoint Protection Small Business Edition (SEP SBE), prior to 14.2 RU2 MP1 and prior to 14.2.5569.2100 respectively, may be susceptible to an out of bounds vulnerability, which is a type of issue that results in an existing application reading memory outside of the bounds of the memory that had been allocated to the program.
Problem types: description: Out of Bounds
Affected products: vendor: n/a
product: Symantec Endpoint Protection (SEP) and Symantec Endpoint Protection Small Business Edition (SEP SBE)
Published: 2020-02-11T17:09:08.000Z
CVE-2020-5827 
Symantec Endpoint Protection Manager (SEPM), prior to 14.2 RU2 MP1, may be susceptible to an out of bounds vulnerability, which is a type of issue that results in an existing application reading memory outside of the bounds of the memory that had been allocated to the program.
Problem types: description: Out of Bounds
Affected products: vendor: n/a
product: Symantec Endpoint Protection Manager (SEPM)
Published: 2020-02-11T17:09:19.000Z
CVE-2020-5828 
Symantec Endpoint Protection Manager (SEPM), prior to 14.2 RU2 MP1, may be susceptible to an out of bounds vulnerability, which is a type of issue that results in an existing application reading memory outside of the bounds of the memory that had been allocated to the program.
Problem types: description: Out of Bounds
Affected products: vendor: n/a
product: Symantec Endpoint Protection Manager (SEPM)
Published: 2020-02-11T17:11:18.000Z
CVE-2020-5829 
Symantec Endpoint Protection Manager (SEPM), prior to 14.2 RU2 MP1, may be susceptible to an out of bounds vulnerability, which is a type of issue that results in an existing application reading memory outside of the bounds of the memory that had been allocated to the program.
Problem types: description: Out of Bounds
Affected products: vendor: n/a
product: Symantec Endpoint Protection Manager (SEPM)
Published: 2020-02-11T17:11:31.000Z
CVE-2020-5830 
Symantec Endpoint Protection Manager (SEPM), prior to 14.2 RU2 MP1, may be susceptible to an out of bounds vulnerability, which is a type of issue that results in an existing application reading memory outside of the bounds of the memory that had been allocated to the program.
Problem types: description: Out of Bounds
Affected products: vendor: n/a
product: Symantec Endpoint Protection Manager (SEPM)
Published: 2020-02-11T17:12:50.000Z
CVE-2020-5831 
Symantec Endpoint Protection Manager (SEPM), prior to 14.2 RU2 MP1, may be susceptible to an out of bounds vulnerability, which is a type of issue that results in an existing application reading memory outside of the bounds of the memory that had been allocated to the program.
Problem types: description: Out of Bounds
Affected products: vendor: n/a
product: Symantec Endpoint Protection Manager (SEPM)
Published: 2020-02-11T17:12:59.000Z
CVE-2020-5832 
Symantec Data Center Security Manager Component, prior to 6.8.2 (aka 6.8 MP2), may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected from an application or user.
Problem types: description: Privilege Escalation
Affected products: vendor: n/a
product: Data Center Security Manager Component
Published: 2020-04-06T19:22:18.000Z
CVE-2020-5833 
Symantec Endpoint Protection Manager, prior to 14.3, may be susceptible to an out of bounds vulnerability, which is a type of issue that results in an existing application reading memory outside of the bounds of the memory that had been allocated to the program.
Problem types: description: Out of Bounds
Affected products: vendor: n/a
product: Symantec Endpoint Protection Manager
Published: 2020-05-11T19:19:45.000Z
CVE-2020-5834 
Symantec Endpoint Protection Manager, prior to 14.3, may be susceptible to a directory traversal attack that could allow a remote actor to determine the size of files in the directory.
Problem types: description: Directory Traversal
Affected products: vendor: n/a
product: Symantec Endpoint Protection Manager
Published: 2020-05-11T19:19:56.000Z
CVE-2020-5835 
Symantec Endpoint Protection Manager, prior to 14.3, has a race condition in client remote deployment which may result in an elevation of privilege on the remote machine.
Problem types: description: Elevation of Privilege
Affected products: vendor: n/a
product: Symantec Endpoint Protection Manager
Published: 2020-05-11T19:22:58.000Z
CVE-2020-5836 
Symantec Endpoint Protection, prior to 14.3, can potentially reset the ACLs on a file as a limited user while Symantec Endpoint Protection's Tamper Protection feature is disabled.
Problem types: description: Elevation of Privilege
Affected products: vendor: n/a
product: Symantec Endpoint Protection
Published: 2020-05-11T19:23:11.000Z
CVE-2020-5837 
Symantec Endpoint Protection, prior to 14.3, may not respect file permissions when writing to log files that are replaced by symbolic links, which can lead to a potential elevation of privilege.
Problem types: description: Elevation of Privilege
Affected products: vendor: n/a
product: Symantec Endpoint Protection
Published: 2020-05-11T19:25:45.000Z
CVE-2020-5838 
Symantec IT Analytics, prior to 2.9.1, may be susceptible to a cross-site scripting (XSS) exploit, which is a type of issue that can potentially enable attackers to inject client-side scripts into web pages viewed by other users.
Problem types: description: Cross-site Scripting
Affected products: vendor: n/a
product: IT Analytics
Published: 2020-05-13T15:42:20.000Z
CVE-2020-5839 
Symantec Endpoint Detection And Response, prior to 4.4, may be susceptible to an information disclosure issue, which is a type of vulnerability that could potentially allow unauthorized access to data.
Problem types: description: Information Disclosure
Affected products: vendor: n/a
product: Symantec Endpoint Detection And Response
Published: 2020-07-08T15:08:54.000Z
CVE-2020-5840 
An issue was discovered in HashBrown CMS before 1.3.2. Server/Entity/Resource/Connection.js allows an attacker to reach a parent directory via a crafted name or ID field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-06T17:21:07.000Z
CVE-2020-5841 
An issue was discovered in OpServices OpMon 9.3.1-1. Using password change parameters, an attacker could perform SQL injection without authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-07T20:49:30.000Z
CVE-2020-5842 
Codoforum 4.8.3 allows XSS in the user registration page: via the username field to the index.php?u=/user/register URI. The payload is, for example, executed on the admin/index.php?page=users/manage page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-07T19:17:55.000Z
CVE-2020-5843 
Codoforum 4.8.3 allows XSS in the admin dashboard via a category to the Manage Users screen.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-07T12:51:19.000Z
CVE-2020-5844 
index.php?sec=godmode/extensions&sec2=extensions/files_repo in Pandora FMS v7.0 NG allows authenticated administrators to upload malicious PHP scripts, and execute them via base64 decoding of the file location. This affects v7.0NG.742_FIX_PERL2020.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-16T17:22:05.000Z
CVE-2020-5846 
An insecure file upload and code execution issue was discovered in Ahsay Cloud Backup Suite 8.3.0.30 via a "PUT /obs/obm7/file/upload" request with the base64-encoded pathname in the X-RSW-custom-encode-path HTTP header, and the content in the HTTP request body. It is possible to upload a file into any directory of the server. One can insert a JSP shell into the web server's directory and execute it. This leads to full system access as the configured user (e.g., Administrator) when starting from any authenticated session (e.g., a trial account). This is fixed in the 83/830122/cbs-*-hotfix-task26000 builds.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-06T20:11:38.000Z
CVE-2020-5847 
Unraid through 6.8.0 allows Remote Code Execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-16T17:23:24.000Z
CVE-2020-5849 
Unraid 6.8.0 allows authentication bypass.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-16T17:24:23.000Z
CVE-2020-5851 
On impacted versions and platforms the Trusted Platform Module (TPM) system integrity check cannot detect modifications to specific system components. This issue only impacts specific engineering hotfixes and platforms. NOTE: This vulnerability does not affect any of the BIG-IP major, minor or maintenance releases you obtained from downloads.f5.com. The affected Engineering Hotfix builds are as follows: Hotfix-BIGIP-14.1.0.2.0.45.4-ENG Hotfix-BIGIP-14.1.0.2.0.62.4-ENG
Problem types: description: Compromise detection failure
Affected products: vendor: n/a
product: BIG-IP
Published: 2020-01-14T15:03:29.000Z
CVE-2020-5852 
Undisclosed traffic patterns received may cause a disruption of service to the Traffic Management Microkernel (TMM). This vulnerability affects TMM through a virtual server configured with a FastL4 profile. Traffic processing is disrupted while TMM restarts. This issue only impacts specific engineering hotfixes. NOTE: This vulnerability does not affect any of the BIG-IP major, minor or maintenance releases you obtained from downloads.f5.com. The affected Engineering Hotfix builds are as follows: Hotfix-BIGIP-14.1.2.1.0.83.4-ENG Hotfix-BIGIP-12.1.4.1.0.97.6-ENG Hotfix-BIGIP-11.5.4.2.74.291-HF2
Problem types: description: DoS
Affected products: vendor: F5
product: BIG-IP
Published: 2020-01-14T16:07:01.000Z
CVE-2020-5853 
In BIG-IP APM portal access on versions 15.0.0-15.1.0, 14.0.0-14.1.2.3, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, when backend servers serve HTTP pages with special JavaScript code, this can lead to internal portal access name conflict.
Problem types: description: XSS
Affected products: vendor: F5
product: BIG-IP APM
Published: 2020-01-14T16:14:02.000Z
CVE-2020-5854 
On BIG-IP 15.0.0-15.0.1.1, 14.1.0-14.1.2.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.6.0-11.6.5.1, the tmm crashes under certain circumstances when using the connector profile if a specific sequence of connections are made.
Problem types: description: DoS
Affected products: vendor: F5
product: BIG-IP
Published: 2020-02-06T15:40:54.000Z
CVE-2020-5855 
When the Windows Logon Integration feature is configured for all versions of BIG-IP Edge Client for Windows, unauthorized users who have physical access to an authorized user's machine can get shell access under unprivileged user.
Problem types: description: Unauthorized Access
Affected products: vendor: F5
product: Edge Client for Windows
Published: 2020-02-06T15:37:27.000Z
CVE-2020-5856 
On BIG-IP 15.0.0-15.0.1.1 and 14.1.0-14.1.2.2, while processing specifically crafted traffic using the default 'xnet' driver, Virtual Edition instances hosted in Amazon Web Services (AWS) may experience a TMM restart.
Problem types: description: DoS
Affected products: vendor: F5
product: BIG-IP
Published: 2020-02-06T15:32:56.000Z
CVE-2020-5857 
On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2.2, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, undisclosed HTTP behavior may lead to a denial of service.
Problem types: description: DoS
Affected products: vendor: n/a
product: BIG-IP
Published: 2020-03-27T14:20:49.000Z
CVE-2020-5858 
On BIG-IP 15.0.0-15.0.1.2, 14.1.0-14.1.2.2, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5.1 and BIG-IQ 7.0.0, 6.0.0-6.1.0, and 5.2.0-5.4.0, users with non-administrator roles (for example, Guest or Resource Administrator) with tmsh shell access can execute arbitrary commands with elevated privilege via a crafted tmsh command.
Problem types: description: Privilege escalation
Affected products: vendor: n/a
product: BIG-IP, BIG-IQ
Published: 2020-03-27T14:31:27.000Z
CVE-2020-5859 
On BIG-IP 15.1.0.1, specially formatted HTTP/3 messages may cause TMM to produce a core file.
Problem types: description: DoS
Affected products: vendor: n/a
product: BIG-IP
Published: 2020-03-27T14:29:43.000Z
CVE-2020-5860 
On BIG-IP 15.0.0-15.1.0.2, 14.1.0-14.1.2.3, 13.1.0-13.1.3.2, 12.1.0-12.1.5.1, and 11.5.2-11.6.5.1 and BIG-IQ 7.0.0, 6.0.0-6.1.0, and 5.2.0-5.4.0, in a High Availability (HA) network failover in Device Service Cluster (DSC), the failover service does not require a strong form of authentication and HA network failover traffic is not encrypted by Transport Layer Security (TLS).
Problem types: description: MITM
Affected products: vendor: n/a
product: BIG-IP, BIG-IQ
Published: 2020-03-27T14:26:47.000Z
CVE-2020-5861 
On BIG-IP 12.1.0-12.1.5, the TMM process may produce a core file in some cases when Ram Cache incorrectly optimizes stored data resulting in memory errors.
Problem types: description: DoS
Affected products: vendor: n/a
product: BIG-IP
Published: 2020-03-27T14:34:01.000Z
CVE-2020-5862 
On BIG-IP 15.1.0-15.1.0.1, 15.0.0-15.0.1.1, and 14.1.0-14.1.2.2, under certain conditions, TMM may crash or stop processing new traffic with the DPDK/ENA driver on AWS systems while sending traffic. This issue does not affect any other platforms, hardware or virtual, or any other cloud provider since the affected driver is specific to AWS.
Problem types: description: DoS
Affected products: vendor: n/a
product: BIG-IP
Published: 2020-03-27T14:41:18.000Z
CVE-2020-5863 
In NGINX Controller versions prior to 3.2.0, an unauthenticated attacker with network access to the Controller API can create unprivileged user accounts. The user which is created is only able to upload a new license to the system but cannot view or modify any other components of the system.
Problem types: description: DoS
Affected products: vendor: n/a
product: NGINX Controller
Published: 2020-03-27T14:35:31.000Z
CVE-2020-5864 
In versions of NGINX Controller prior to 3.2.0, communication between NGINX Controller and NGINX Plus instances skip TLS verification by default.
Problem types: description: n/a
Affected products: vendor: n/a
product: NGINX Controller
Published: 2020-04-23T18:32:40.000Z
CVE-2020-5865 
In versions prior to 3.3.0, the NGINX Controller is configured to communicate with its Postgres database server over unencrypted channels, making the communicated data vulnerable to interception via man-in-the-middle (MiTM) attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: NGINX Controller
Published: 2020-04-23T18:16:00.000Z
CVE-2020-5866 
In versions of NGINX Controller prior to 3.3.0, the helper.sh script, which is used optionally in NGINX Controller to change settings, uses sensitive items as command-line arguments.
Problem types: description: n/a
Affected products: vendor: n/a
product: NGINX Controller
Published: 2020-04-23T18:37:50.000Z
CVE-2020-5867 
In versions prior to 3.3.0, the NGINX Controller Agent installer script 'install.sh' uses HTTP instead of HTTPS to check and install packages
Problem types: description: n/a
Affected products: vendor: n/a
product: NGINX Controller
Published: 2020-04-23T19:58:59.000Z
CVE-2020-5868 
In BIG-IQ 6.0.0-7.0.0, a remote access vulnerability has been discovered that may allow a remote user to execute shell commands on affected systems using HTTP requests to the BIG-IQ user interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: BIG-IQ
Published: 2020-04-24T12:54:06.000Z
CVE-2020-5869 
In BIG-IQ 5.2.0-7.0.0, high availability (HA) synchronization is not secure by TLS and may allow on-path attackers to read / modify confidential data in transit.
Problem types: description: n/a
Affected products: vendor: n/a
product: BIG-IQ
Published: 2020-04-24T13:05:03.000Z
CVE-2020-5870 
In BIG-IQ 5.2.0-7.0.0, high availability (HA) synchronization mechanisms do not use any form of authentication for connecting to the peer.
Problem types: description: n/a
Affected products: vendor: n/a
product: BIG-IQ
Published: 2020-04-24T13:17:01.000Z
CVE-2020-5871 
On BIG-IP 14.1.0-14.1.2.3, undisclosed requests can lead to a denial of service (DoS) when sent to BIG-IP HTTP/2 virtual servers. The problem can occur when ciphers, which have been blacklisted by the HTTP/2 RFC, are used on backend servers. This is a data-plane issue. There is no control-plane exposure.
Problem types: description: DoS
Affected products: vendor: n/a
product: BIG-IP
Published: 2020-04-30T19:49:40.000Z
CVE-2020-5872 
On BIG-IP 14.1.0-14.1.2.3, 14.0.0-14.0.1, 13.1.0-13.1.3.1, and 12.1.0-12.1.4.1, when processing TLS traffic with hardware cryptographic acceleration enabled on platforms with Intel QAT hardware, the Traffic Management Microkernel (TMM) may stop responding and cause a failover event.
Problem types: description: DoS
Affected products: vendor: n/a
product: BIG-IP
Published: 2020-04-30T19:53:14.000Z
CVE-2020-5873 
On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.6.1-11.6.5 and BIG-IQ 5.2.0-7.1.0, a user associated with the Resource Administrator role who has access to the secure copy (scp) utility but does not have access to Advanced Shell (bash) can execute arbitrary commands using a maliciously crafted scp request.
Problem types: description: Privilege escalation
Affected products: vendor: n/a
product: BIG-IP
vendor: n/a
product: BIG-IQ
Published: 2020-04-30T20:21:54.000Z
CVE-2020-5874 
On BIG-IP APM 15.0.0-15.0.1.2, 14.1.0-14.1.2.3, and 14.0.0-14.0.1, in certain circumstances, an attacker sending specifically crafted requests to a BIG-IP APM virtual server may cause a disruption of service provided by the Traffic Management Microkernel(TMM).
Problem types: description: DoS
Affected products: vendor: n/a
product: BIG-IP APM
Published: 2020-04-30T20:17:27.000Z
CVE-2020-5875 
On BIG-IP 15.0.0-15.0.1 and 14.1.0-14.1.2.3, under certain conditions, the Traffic Management Microkernel (TMM) may generate a core file and restart while processing SSL traffic with an HTTP/2 full proxy.
Problem types: description: DoS
Affected products: vendor: n/a
product: BIG-IP
Published: 2020-04-30T20:27:12.000Z
CVE-2020-5876 
On BIG-IP 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, a race condition exists where mcpd and other processes may make unencrypted connection attempts to a new configuration sync peer. The race condition can occur when changing the ConfigSync IP address of a peer, adding a new peer, or when the Traffic Management Microkernel (TMM) first starts up.
Problem types: description: Session hijacking
Affected products: vendor: n/a
product: BIG-IP
Published: 2020-04-30T20:30:25.000Z
CVE-2020-5877 
On BIG-IP 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, malformed input to the DATAGRAM::tcp iRules command within a FLOW_INIT event may lead to a denial of service.
Problem types: description: DoS
Affected products: vendor: n/a
product: BIG-IP
Published: 2020-04-30T20:33:11.000Z
CVE-2020-5878 
On versions 15.1.0-15.1.0.1, 15.0.0-15.0.1.1, and 14.1.0-14.1.2.3, Traffic Management Microkernel (TMM) may restart on BIG-IP Virtual Edition (VE) while processing unusual IP traffic.
Problem types: description: DoS
Affected products: vendor: n/a
product: BIG-IP VE
Published: 2020-04-30T20:24:29.000Z
CVE-2020-5879 
On BIG-IP ASM 11.6.1-11.6.5.1, under certain configurations, the BIG-IP system sends data plane traffic to back-end servers unencrypted, even when a Server SSL profile is applied.
Problem types: description: Information Disclosure
Affected products: vendor: n/a
product: BIG-IP ASM
Published: 2020-04-30T20:46:04.000Z
CVE-2020-5880 
Om BIG-IP 15.0.0-15.0.1.3 and 14.1.0-14.1.2.3, the restjavad process may expose a way for attackers to upload arbitrary files on the BIG-IP system, bypassing the authorization system. Resulting error messages may also reveal internal paths of the server.
Problem types: description: DoS
Affected products: vendor: n/a
product: BIG-IP
Published: 2020-04-30T20:54:58.000Z
CVE-2020-5881 
On versions 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, and 13.1.0-13.1.3.3, when the BIG-IP Virtual Edition (VE) is configured with VLAN groups and there are devices configured with OSPF connected to it, the Network Device Abstraction Layer (NDAL) Interfaces can lock up and in turn disrupting the communication between the mcpd and tmm processes.
Problem types: description: DoS
Affected products: vendor: n/a
product: BIG-IP VE
Published: 2020-04-30T20:39:57.000Z
CVE-2020-5882 
On BIG-IP 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5, and 11.6.1-11.6.5.1, under certain conditions, the Intel QuickAssist Technology (QAT) cryptography driver may produce a Traffic Management Microkernel (TMM) core file.
Problem types: description: DoS
Affected products: vendor: n/a
product: BIG-IP
Published: 2020-04-30T20:37:23.000Z
CVE-2020-5883 
On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2.3, 14.0.0-14.0.1, and 13.1.0-13.1.3.1, when a virtual server is configured with HTTP explicit proxy and has an attached HTTP_PROXY_REQUEST iRule, POST requests sent to the virtual server cause an xdata memory leak.
Problem types: description: DoS
Affected products: vendor: n/a
product: BIG-IP
Published: 2020-04-30T20:48:18.000Z
CVE-2020-5884 
On versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.4, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the default deployment mode for BIG-IP high availability (HA) pair mirroring is insecure. This is a control plane issue that is exposed only on the network used for mirroring.
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: BIG-IP
Published: 2020-04-30T20:34:57.000Z
CVE-2020-5885 
On versions 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, and 12.1.0-12.1.5.1, BIG-IP systems set up for connection mirroring in a high availability (HA) pair transfer sensitive cryptographic objects over an insecure communications channel. This is a control plane issue which is exposed only on the network used for connection mirroring.
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: BIG-IP
Published: 2020-04-30T20:41:59.000Z
CVE-2020-5886 
On versions 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, and 12.1.0-12.1.5.1, BIG-IP systems setup for connection mirroring in a High Availability (HA) pair transfers sensitive cryptographic objects over an insecure communications channel. This is a control plane issue which is exposed only on the network used for connection mirroring.
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: BIG-IP
Published: 2020-04-30T20:50:43.000Z
CVE-2020-5887 
On versions 15.1.0-15.1.0.1, 15.0.0-15.0.1.2, and 14.1.0-14.1.2.3, BIG-IP Virtual Edition (VE) may expose a mechanism for remote attackers to access local daemons and bypass port lockdown settings.
Problem types: description: Unauthorized access
Affected products: vendor: n/a
product: BIG-IP VE
Published: 2020-04-30T20:43:51.000Z
CVE-2020-5888 
On versions 15.1.0-15.1.0.1, 15.0.0-15.0.1.2, and 14.1.0-14.1.2.3, BIG-IP Virtual Edition (VE) may expose a mechanism for adjacent network (layer 2) attackers to access local daemons and bypass port lockdown settings.
Problem types: description: Unauthorized access
Affected products: vendor: n/a
product: BIG-IP VE
Published: 2020-04-30T21:04:52.000Z
CVE-2020-5889 
On versions 15.1.0-15.1.0.1, 15.0.0-15.0.1.2, and 14.1.0-14.1.2.3, in BIG-IP APM portal access, a specially crafted HTTP request can lead to reflected XSS after the BIG-IP APM system rewrites the HTTP response from the untrusted backend server and sends it to the client.
Problem types: description: XSS
Affected products: vendor: n/a
product: BIG-IP APM
Published: 2020-04-30T20:58:48.000Z