apm-telescopes.de XSS vulnerability

Open Bug Bounty ID: OBB-393252 Description| Value ---|--- Affected Website:| apm-telescopes.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Code injection

In F5 BIG-IP LTM, AAM, AFM, APM, ASM, Link Controller, PEM, PSM software version 12.0.0 to 12.1.2, 11.6.0 to 11.6.1, 11.4.0 to 11.5.4, when a virtual server uses the standard configuration of HTTP/2 or SPDY profile with Client SSL profile, and the client initiates a number of concurrent streams...

Code injection

F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM, Websafe software version 12.0.0 to 12.1.2, 11.6.0 to 11.6.1 are vulnerable to a denial of service attack when the MPTCP option is enabled on a virtual server. Data plane is vulnerable when using the MPTCP option of a TC...

CVE-2017-6157

In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and Websafe software version 12.0.0 to 12.1.1, 11.6.0 to 11.6.1, 11.5.0 - 11.5.4, virtual servers with a configuration using the HTTP Explicit Proxy functionality and/or SOCKS profile are vulnerable to an...

CVE-2017-6163

CVE-2017-6163 affects BIG-IP LTM and multiple modules (AAM, AFM, APM, ASM, Link Controller, PEM, PSM). When a virtual server uses HTTP/2 or SPDY with a Client SSL profile, and a client opens concurrent streams beyond the advertised limit, the TMM data plane can be disrupted, while the control pla...

CVE-2017-0303

Summary : CVE-2017-0303 affects multiple BIG-IP products (e.g., BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM, WebSafe) with affected versions including 13.0.0 and 12.0.0–12.1.2, 11.5.1–11.6.1. The issue arises when connections handled by a Virtual Server with an assoc...

CVE-2017-6157

CVE-2017-6157 affects BIG-IP virtual servers configured with HTTP Explicit Proxy functionality and/or SOCKS profile across multiple BIG-IP modules. The issue allows an unauthenticated, remote attacker to modify system configuration, exfiltrate sensitive files, and potentially execute commands on ...

Authorization

iControl REST in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, and WebSafe 12.0.0 through 12.1.2 and 13.0.0 includes a service to convert authorization BIGIPAuthCookie cookies to X-F5-Auth-Token tokens. This service does not properly re-validate cookies when making that...

CVE-2017-13985

An authentication vulnerability in HPE BSM Platform Application Performance Management System Health product versions 9.26, 9.30 and 9.40, allows remote users to traverse directory leading to disclosure of information...

CVE-2017-13984

An authentication vulnerability in HPE BSM Platform Application Performance Management System Health product versions 9.26, 9.30 and 9.40, allows remote users to delete arbitrary files via servlet directory traversal...

Design/Logic Flaw

A potential security vulnerability has been identified in HPE Application Performance Management BSM Platform versions 9.26, 9.30, 9.40. The vulnerability could be remotely exploited to allow code execution...

Authentication flaw

An authentication vulnerability in HPE BSM Platform Application Performance Management System Health product versions 9.26, 9.30 and 9.40, allows remote users to bypass authentication...

Authentication flaw

An authentication vulnerability in HPE BSM Platform Application Performance Management System Health product versions 9.26, 9.30 and 9.40, allows remote users to traverse directory leading to disclosure of information...

CVE-2017-14350

The CVE-2017-14350 issue affects HPE Application Performance Management (BSM) Platform versions 9.26, 9.30, and 9.40. The confirmed root cause relates to the hpbsmsdr web service used by the Staging Data Replicator, which listens on port 29921 and lacks authentication, enabling remote code execut...

CVE-2017-14350

A potential security vulnerability has been identified in HPE Application Performance Management BSM Platform versions 9.26, 9.30, 9.40. The vulnerability could be remotely exploited to allow code execution...

CVE-2017-13985

The CVE-2017-13985 issue affects HPE BSM Platform Application Performance Management System Health (versions 9.26, 9.30, 9.40). The vulnerability is a path traversal/authentication flaw in the Email Servlet that leads to information disclosure. The ZDI advisory notes that exploitation requires au...

CVE-2017-13984

The CVE-2017-13984 issue affects Hewlett Packard Enterprise’s BSM Platform Application Performance Management System Health (HPE BSM Health) with versions 9.26, 9.30 and 9.40. The vulnerability resides in the SHExportToExcel servlet, where a directory-traversal flaw allows remote attackers to del...

CVE-2017-13985

An authentication vulnerability in HPE BSM Platform Application Performance Management System Health product versions 9.26, 9.30 and 9.40, allows remote users to traverse directory leading to disclosure of information...

CVE-2017-13984

An authentication vulnerability in HPE BSM Platform Application Performance Management System Health product versions 9.26, 9.30 and 9.40, allows remote users to delete arbitrary files via servlet directory traversal...

CVE-2017-13983

CVE-2017-13983 describes an authentication bypass vulnerability in the HPE BSM Platform Application Performance Management System Health (Health) suite, affecting versions 9.26, 9.30 and 9.40. The flaw enables remote attackers to bypass authentication, with the ZDI advisory noting the System Heal...