rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-5890 
On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, and 12.1.0-12.1.5.1 and BIG-IQ 5.2.0-7.1.0, when creating a QKView, credentials for binding to LDAP servers used for remote authentication of the BIG-IP administrative interface will not fully obfuscate if they contain whitespace.
Problem types: description: Information Disclosure
Affected products: vendor: n/a
product: BIG-IP
vendor: n/a
product: BIG-IQ
Published: 2020-04-30T21:08:17.000Z
CVE-2020-5891 
On BIG-IP 15.1.0-15.1.0.1, 15.0.0-15.0.1.2, and 14.1.0-14.1.2.3, undisclosed HTTP/2 requests can lead to a denial of service when sent to a virtual server configured with the Fallback Host setting and a server-side HTTP/2 profile.
Problem types: description: DoS
Affected products: vendor: n/a
product: BIG-IP
Published: 2020-04-30T20:57:00.000Z
CVE-2020-5892 
In versions 7.1.5-7.1.8, the BIG-IP Edge Client components in BIG-IP APM, Edge Gateway, and FirePass legacy allow attackers to obtain the full session ID from process memory.
Problem types: description: Information Disclosure
Affected products: vendor: n/a
product: BIG-IP Edge Client
Published: 2020-04-30T21:03:08.000Z
CVE-2020-5893 
In versions 7.1.5-7.1.8, when a user connects to a VPN using BIG-IP Edge Client over an unsecure network, BIG-IP Edge Client responds to authentication requests over HTTP while sending probes for captive portal detection.
Problem types: description: Brute Force
Affected products: vendor: n/a
product: BIG-IP Edge Client
Published: 2020-04-30T21:00:49.000Z
CVE-2020-5894 
On versions 3.0.0-3.3.0, the NGINX Controller webserver does not invalidate the server-side session token after users log out.
Problem types: description: Session Hijacking
Affected products: vendor: n/a
product: NGINX Controller
Published: 2020-05-07T12:25:56.000Z
CVE-2020-5895 
On NGINX Controller versions 3.1.0-3.3.0, AVRD uses world-readable and world-writable permissions on its socket, which allows processes or users on the local system to write arbitrary data into the socket. A local system attacker can make AVRD segmentation fault (SIGSEGV) by writing malformed messages to the socket.
Problem types: description: DoS
Affected products: vendor: n/a
product: NGINX Controller
Published: 2020-05-07T12:28:24.000Z
CVE-2020-5896 
On versions 7.1.5-7.1.9, the BIG-IP Edge Client's Windows Installer Service's temporary folder has weak file and folder permissions.
Problem types: description: Privilege Escalation
Affected products: vendor: n/a
product: F5 Edge Client
Published: 2020-05-12T15:24:59.000Z
CVE-2020-5897 
In versions 7.1.5-7.1.9, there is use-after-free memory vulnerability in the BIG-IP Edge Client Windows ActiveX component.
Problem types: description: RCE
Affected products: vendor: n/a
product: F5 Edge Client
Published: 2020-05-12T15:20:53.000Z
CVE-2020-5898 
In versions 7.1.5-7.1.9, BIG-IP Edge Client Windows Stonewall driver does not sanitize the pointer received from the userland. A local user on the Windows client system can send crafted DeviceIoControl requests to \\.\urvpndrv device causing the Windows kernel to crash.
Problem types: description: DOS
Affected products: vendor: n/a
product: F5 Edge Client
Published: 2020-05-12T15:27:44.000Z
CVE-2020-5899 
In NGINX Controller 3.0.0-3.4.0, recovery code required to change a user's password is transmitted and stored in the database in plain text, which allows an attacker who can intercept the database connection or have read access to the database, to request a password reset using the email address of another registered user then retrieve the recovery code.
Problem types: description: account hijacking
Affected products: vendor: n/a
product: NGINX Controller
Published: 2020-07-01T14:01:58.000Z
CVE-2020-5900 
In versions 3.0.0-3.4.0, 2.0.0-2.9.0, and 1.0.1, there is insufficient cross-site request forgery (CSRF) protections for the NGINX Controller user interface.
Problem types: description: CSRF
Affected products: vendor: n/a
product: NGINX Controller
Published: 2020-07-01T13:59:42.000Z
CVE-2020-5901 
In NGINX Controller 3.3.0-3.4.0, undisclosed API endpoints may allow for a reflected Cross Site Scripting (XSS) attack. If the victim user is logged in as admin this could result in a complete compromise of the system.
Problem types: description: XSS
Affected products: vendor: n/a
product: NGINX Controller
Published: 2020-07-01T14:03:33.000Z
CVE-2020-5902 
In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages.
Problem types: description: RCE
Affected products: vendor: n/a
product: BIG-IP
Published: 2020-07-01T00:00:00.000Z
CVE-2020-5903 
In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, a Cross-Site Scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility.
Problem types: description: XSS
Affected products: vendor: n/a
product: BIG-IP
Published: 2020-07-01T14:42:00.000Z
CVE-2020-5904 
In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, a cross-site request forgery (CSRF) vulnerability in the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, exists in an undisclosed page.
Problem types: description: CSRF
Affected products: vendor: n/a
product: BIG-IP
Published: 2020-07-01T14:39:30.000Z
CVE-2020-5905 
In version 11.6.1-11.6.5.2 of the BIG-IP system Configuration utility Network > WCCP page, the system does not sanitize all user-provided data before display.
Problem types: description: XSS
Affected products: vendor: n/a
product: BIG-IP
Published: 2020-07-01T14:40:49.000Z
CVE-2020-5906 
In versions 13.1.0-13.1.3.3, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, the BIG-IP system does not properly enforce the access controls for the scp.blacklist files. This allows Admin and Resource Admin users with Secure Copy (SCP) protocol access to read and overwrite blacklisted files via SCP.
Problem types: description: privilege escalation
Affected products: vendor: n/a
product: BIG-IP
Published: 2020-07-01T14:33:20.000Z
CVE-2020-5907 
In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, an authorized user provided with access only to the TMOS Shell (tmsh) may be able to conduct arbitrary file read/writes via the built-in sftp functionality.
Problem types: description: privilege escalation
Affected products: vendor: n/a
product: BIG-IP
Published: 2020-07-01T14:43:10.000Z
CVE-2020-5908 
In versions bundled with BIG-IP APM 12.1.0-12.1.5 and 11.6.1-11.6.5.2, Edge Client for Linux exposes full session ID in the local log files.
Problem types: description: information leakage
Affected products: vendor: n/a
product: Edge Client for Linux
Published: 2020-07-01T14:34:38.000Z
CVE-2020-5909 
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, when users run the command displayed in NGINX Controller user interface (UI) to fetch the agent installer, the server TLS certificate is not verified.
Problem types: description: MITM
Affected products: vendor: n/a
product: NGINX Controller
Published: 2020-07-02T12:26:39.000Z
CVE-2020-5910 
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the Neural Autonomic Transport System (NATS) messaging services in use by the NGINX Controller do not require any form of authentication, so any successful connection would be authorized.
Problem types: description: data leakage
Affected products: vendor: n/a
product: NGINX Controller
Published: 2020-07-02T12:25:11.000Z
CVE-2020-5911 
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller installer starts the download of Kubernetes packages from an HTTP URL On Debian/Ubuntu system.
Problem types: description: MITM
Affected products: vendor: n/a
product: NGINX Controller
Published: 2020-07-02T12:23:40.000Z
CVE-2020-5912 
In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the restjavad process's dump command does not follow current best coding practices and may overwrite arbitrary files.
Problem types: description: DoS
Affected products: vendor: n/a
product: BIG-IP
Published: 2020-08-26T14:31:13.000Z
CVE-2020-5913 
In versions 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.2, the BIG-IP Client or Server SSL profile ignores revoked certificates, even when a valid CRL is present. This impacts SSL/TLS connections and may result in a man-in-the-middle attack on the connections.
Problem types: description: BIG-IP SSL/TLS CRL vulnerability
Affected products: vendor: n/a
product: BIG-IP
Published: 2020-08-26T14:03:08.000Z
CVE-2020-5914 
In BIG-IP ASM versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, undisclosed server cookie scenario may cause BD to restart under some circumstances.
Problem types: description: DoS
Affected products: vendor: n/a
product: BIG-IP ASM
Published: 2020-08-26T14:17:16.000Z
CVE-2020-5915 
In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, an undisclosed TMUI page contains a vulnerability which allows a stored XSS when BIG-IP systems are setup in a device trust.
Problem types: description: XSS
Affected products: vendor: n/a
product: BIG-IP
Published: 2020-08-26T14:28:30.000Z
CVE-2020-5916 
In BIG-IP versions 15.1.0-15.1.0.4 and 15.0.0-15.0.1.3 the Certificate Administrator user role and higher privileged roles can perform arbitrary file reads outside of the web root directory.
Problem types: description: Information leakage
Affected products: vendor: n/a
product: BIG-IP
Published: 2020-08-26T14:25:55.000Z
CVE-2020-5917 
In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.2 and BIG-IQ versions 5.2.0-7.0.0, the host OpenSSH servers utilize keys of less than 2048 bits which are no longer considered secure.
Problem types: description: MitM
Affected products: vendor: n/a
product: BIG-IP, BIG-IQ
Published: 2020-08-26T14:06:50.000Z
CVE-2020-5918 
In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management Microkernel (TMM) may stop responding when processing Stream Control Transmission Protocol (SCTP) traffic when traffic volume is high. This vulnerability affects TMM by way of a virtual server configured with an SCTP profile.
Problem types: description: DoS
Affected products: vendor: n/a
product: BIG-IP
Published: 2020-08-26T14:11:34.000Z
CVE-2020-5919 
In versions 15.1.0-15.1.0.4, rendering of certain session variables by BIG-IP APM UI-based agents in an access profile configured with Modern customization, may cause the Traffic Management Microkernel (TMM) to stop responding.
Problem types: description: DoS
Affected products: vendor: n/a
product: BIG-IP APM
Published: 2020-08-26T14:22:51.000Z
CVE-2020-5920 
In versions 15.0.0-15.1.0.5, 14.1.0-14.1.2.7, 13.1.0-13.1.3.4, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, a vulnerability in the BIG-IP AFM Configuration utility may allow any authenticated BIG-IP user to perform a read-only blind SQL injection attack.
Problem types: description: SQL injection
Affected products: vendor: n/a
product: BIG-IP AFM
Published: 2020-08-26T14:50:34.000Z
CVE-2020-5921 
in BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.6, 13.1.0-13.1.3.4, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.2, Syn flood causes large number of MCPD context messages destined to secondary blades consuming memory leading to MCPD failure. This issue affects only VIPRION hosts with two or more blades installed. Single-blade VIPRION hosts are not affected.
Problem types: description: DoS
Affected products: vendor: n/a
product: BIG-IP
Published: 2020-08-26T15:21:04.000Z
CVE-2020-5922 
In BIG-IP versions 15.0.0-15.1.0.4, 14.1.0-14.1.2.6, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.2, iControl REST does not implement Cross Site Request Forgery protections for users which make use of Basic Authentication in a web browser.
Problem types: description: CSRF
Affected products: vendor: n/a
product: BIG-IP
Published: 2020-08-26T14:44:42.000Z
CVE-2020-5923 
In BIG-IP versions 15.0.0-15.1.0.4, 14.1.0-14.1.2.6, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1 and BIG-IQ versions 5.4.0-7.0.0, Self-IP port-lockdown bypass via IPv6 link-local addresses.
Problem types: description: Unauthorized access
Affected products: vendor: n/a
product: BIG-IP, BIG-IQ
Published: 2020-08-26T14:41:43.000Z
CVE-2020-5924 
In BIG-IP APM versions 12.1.0-12.1.5.1 and 11.6.1-11.6.5.2, RADIUS authentication leaks memory when the username for authentication is not set.
Problem types: description: DoS
Affected products: vendor: n/a
product: BIG-IP APM
Published: 2020-08-26T14:38:45.000Z
CVE-2020-5925 
In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.6, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, undisclosed internally generated UDP traffic may cause the Traffic Management Microkernel (TMM) to restart under some circumstances.
Problem types: description: DoS
Affected products: vendor: n/a
product: BIG-IP
Published: 2020-08-26T15:32:08.000Z
CVE-2020-5926 
In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, and 14.1.0-14.1.2.6, a BIG-IP virtual server with a Session Initiation Protocol (SIP) ALG profile, parsing SIP messages that contain a multi-part MIME payload with certain boundary strings can cause TMM to free memory to the wrong cache.
Problem types: description: DoS
Affected products: vendor: n/a
product: BIG-IP
Published: 2020-08-26T15:43:13.000Z
CVE-2020-5927 
In versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, and 14.1.0-14.1.2.6, BIG-IP ASM Configuration utility Stored-Cross Site Scripting.
Problem types: description: XSS
Affected products: vendor: n/a
product: BIG-IP ASM
Published: 2020-08-26T15:14:25.000Z
CVE-2020-5928 
In versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.6, 13.1.0-13.1.3.4, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, BIG-IP ASM Configuration utility CSRF protection token can be reused multiple times.
Problem types: description: CSRF
Affected products: vendor: n/a
product: BIG-IP ASM
Published: 2020-08-26T15:45:44.000Z
CVE-2020-5929 
In versions 13.0.0-13.0.0 HF2, 12.1.0-12.1.2 HF1, and 11.6.1-11.6.2, BIG-IP platforms with Cavium Nitrox SSL hardware acceleration cards, a Virtual Server configured with a Client SSL profile, and using Anonymous (ADH) or Ephemeral (DHE) Diffie-Hellman key exchange and Single DH use option not enabled in the options list may be vulnerable to crafted SSL/TLS Handshakes that may result with a PMS (Pre-Master Secret) that starts in a 0 byte and may lead to a recovery of plaintext messages as BIG-IP TLS/SSL ADH/DHE sends different error messages acting as an oracle. Similar error messages when PMS starts with 0 byte coupled with very precise timing measurement observation may also expose this vulnerability.
Problem types: description: TLS Oracle
Affected products: vendor: n/a
product: BIG-IP
Published: 2020-09-25T13:22:47.000Z
CVE-2020-5930 
In BIG-IP 15.0.0-15.1.0.4, 14.1.0-14.1.2.7, 13.1.0-13.1.3.3, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2 and BIG-IQ 5.2.0-7.1.0, unauthenticated attackers can cause disruption of service via undisclosed methods.
Problem types: description: DoS
Affected products: vendor: n/a
product: BIG-IP, BIG-IQ
Published: 2020-09-25T13:19:40.000Z
CVE-2020-5931 
On BIG-IP 15.1.0-15.1.0.5, 14.1.0-14.1.2.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, Virtual servers with a OneConnect profile may incorrectly handle WebSockets related HTTP response headers, causing TMM to restart.
Problem types: description: DoS
Affected products: vendor: n/a
product: BIG-IP
Published: 2020-10-29T15:17:17.000Z
CVE-2020-5932 
On BIG-IP ASM 15.1.0-15.1.0.5, a cross-site scripting (XSS) vulnerability exists in the BIG-IP ASM Configuration utility response and blocking pages. An authenticated user with administrative privileges can specify a response page with any content, including JavaScript code that will be executed when preview is opened.
Problem types: description: XSS
Affected products: vendor: n/a
product: BIG-IP ASM
Published: 2020-10-29T15:14:43.000Z
CVE-2020-5933 
On versions 15.1.0-15.1.0.5, 14.1.0-14.1.2.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, when a BIG-IP system that has a virtual server configured with an HTTP compression profile processes compressed HTTP message payloads that require deflation, a Slowloris-style attack can trigger an out-of-memory condition on the BIG-IP system.
Problem types: description: DoS
Affected products: vendor: n/a
product: BIG-IP
Published: 2020-10-29T15:11:39.000Z
CVE-2020-5934 
On BIG-IP APM 15.1.0-15.1.0.5, 14.1.0-14.1.2.3, and 13.1.0-13.1.3.3, when multiple HTTP requests from the same client to configured SAML Single Logout (SLO) URL are passing through a TCP Keep-Alive connection, traffic to TMM can be disrupted.
Problem types: description: DoS
Affected products: vendor: n/a
product: BIG-IP APM
Published: 2020-10-29T15:19:45.000Z
CVE-2020-5935 
On BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, FPS, GTM, Link Controller, PEM) versions 15.1.0-15.1.0.5, 14.1.0-14.1.2.3, and 13.1.0-13.1.3.3, when handling MQTT traffic through a BIG-IP virtual server associated with an MQTT profile and an iRule performing manipulations on that traffic, TMM may produce a core file.
Problem types: description: DoS
Affected products: vendor: n/a
product: BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, FPS, GTM, Link Controller, PEM)
Published: 2020-10-29T15:07:59.000Z
CVE-2020-5936 
On BIG-IP LTM 15.1.0-15.1.0.5, 14.1.0-14.1.2.7, 13.1.0-13.1.3.4, and 12.1.0-12.1.5.1, the Traffic Management Microkernel (TMM) process may consume excessive resources when processing SSL traffic and client authentication are enabled on the client SSL profile.
Problem types: description: DoS
Affected products: vendor: n/a
product: BIG-IP LTM
Published: 2020-10-29T15:21:47.000Z
CVE-2020-5937 
On BIG-IP AFM 15.1.0-15.1.0.5, the Traffic Management Microkernel (TMM) may produce a core file while processing layer 4 (L4) behavioral denial-of-service (DoS) traffic.
Problem types: description: DoS
Affected products: vendor: n/a
product: BIG-IP AFM
Published: 2020-10-29T13:32:15.000Z
CVE-2020-5938 
On BIG-IP 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, when negotiating IPSec tunnels with configured, authenticated peers, the peer may negotiate a different key length than the BIG-IP configuration would otherwise allow.
Problem types: description: Security downgrade
Affected products: vendor: n/a
product: BIG-IP
Published: 2020-10-29T13:29:08.000Z
CVE-2020-5939 
In versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.3, 15.0.0-15.0.1.3, 14.1.0-14.1.2.6, and 13.1.0-13.1.3.4, BIG-IP Virtual Edition (VE) systems on VMware, with an Intel-based 85299 Network Interface Controller (NIC) card and Single Root I/O Virtualization (SR-IOV) enabled on vSphere, may fail and leave the Traffic Management Microkernel (TMM) in a state where it cannot transmit traffic.
Problem types: description: DoS
Affected products: vendor: n/a
product: BIG-IP Virtual Edition (VE)
Published: 2020-11-05T19:14:16.000Z
CVE-2020-5940 
In versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.2.3, a stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Traffic Management User Interface (TMUI), also known as the BIG-IP Configuration utility.
Problem types: description: XSS
Affected products: vendor: n/a
product: BIG-IP
Published: 2020-11-05T19:20:00.000Z
CVE-2020-5941 
On BIG-IP versions 16.0.0-16.0.0.1 and 15.1.0-15.1.0.5, using the RESOLV::lookup command within an iRule may cause the Traffic Management Microkernel (TMM) to generate a core file and restart. This issue occurs when data exceeding the maximum limit of a hostname passes to the RESOLV::lookup command.
Problem types: description: DoS
Affected products: vendor: n/a
product: BIG-IP
Published: 2020-11-05T19:18:18.000Z
CVE-2020-5942 
In BIG-IP PEM versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.2.7, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, when processing Capabilities-Exchange-Answer (CEA) packets with certain attributes from the Policy and Charging Rules Function (PCRF) server, the Traffic Management Microkernel (TMM) may generate a core file and restart.
Problem types: description: DoS
Affected products: vendor: n/a
product: BIG-IP (PEM)
Published: 2020-11-05T19:15:48.000Z
CVE-2020-5943 
In versions 14.1.0-14.1.0.1 and 14.1.2.5-14.1.2.7, when a BIG-IP object is created or listed through the REST interface, the protected fields are obfuscated in the REST response, not protected via a SecureVault cryptogram as TMSH does. One example of protected fields is the GTM monitor password.
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: BIG-IP
Published: 2020-11-05T19:23:05.000Z
CVE-2020-5944 
In BIG-IQ 7.1.0, accessing the DoS Summary events and DNS Overview pages in the BIG-IQ system interface returns an error message due to disabled Grafana reverse proxy in web service configuration. F5 has done further review of this vulnerability and has re-classified it as a defect. CVE-2020-5944 will continue to be referenced in F5 Security Advisory K57274211 and will not be assigned to other F5 vulnerabilities.
Problem types: description: DoS
Affected products: vendor: n/a
product: BIG-IQ
Published: 2020-11-05T19:24:40.000Z
CVE-2020-5945 
In BIG-IP versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.2.7, undisclosed TMUI page contains a stored cross site scripting vulnerability (XSS). The issue allows a minor privilege escalation for resource admin to escalate to full admin.
Problem types: description: XSS
Affected products: vendor: n/a
product: BIG-IP
Published: 2020-11-05T19:21:24.000Z
CVE-2020-5946 
In BIG-IP Advanced WAF and FPS versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.2.7, under some circumstances, certain format client-side alerts sent to the BIG-IP virtual server configured with DataSafe may cause the Traffic Management Microkernel (TMM) to restart, resulting in a Denial-of-Service (DoS).
Problem types: description: DoS
Affected products: vendor: n/a
product: BIG-IP (Advanced WAF, FPS)
Published: 2020-11-05T19:26:28.000Z
CVE-2020-5947 
In versions 16.0.0-16.0.0.1 and 15.1.0-15.1.1, on specific BIG-IP platforms, attackers may be able to obtain TCP sequence numbers from the BIG-IP system that can be reused in future connections with the same source and destination port and IP numbers. Only these platforms are affected: BIG-IP 2000 series (C112), BIG-IP 4000 series (C113), BIG-IP i2000 series (C117), BIG-IP i4000 series (C115), BIG-IP Virtual Edition (VE).
Problem types: description: TCP sequence prediction
Affected products: vendor: n/a
product: BIG-IP 2000 series (C112), BIG-IP 4000 series (C113), BIG-IP i2000 series (C117), BIG-IP i4000 series (C115), BIG-IP Virtual Edition (VE)
Published: 2020-11-19T00:14:19.000Z
CVE-2020-5948 
On BIG-IP versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.2.7, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, undisclosed endpoints in iControl REST allow for a reflected XSS attack, which could lead to a complete compromise of the BIG-IP system if the victim user is granted the admin role.
Problem types: description: XSS
Affected products: vendor: n/a
product: BIG-IP
Published: 2020-12-11T18:56:29.000Z
CVE-2020-5949 
On BIG-IP versions 14.0.0-14.0.1 and 13.1.0-13.1.3.4, certain traffic pattern sent to a virtual server configured with an FTP profile can cause the FTP channel to break.
Problem types: description: DoS
Affected products: vendor: n/a
product: BIG-IP
Published: 2020-12-11T19:01:52.000Z
CVE-2020-5950 
On BIG-IP 14.1.0-14.1.2.6, undisclosed endpoints in iControl REST allow for a reflected XSS attack, which could lead to a complete compromise of the BIG-IP system if the victim user is granted the admin role.
Problem types: description: XSS
Affected products: vendor: n/a
product: BIG-IP
Published: 2020-12-11T18:58:08.000Z