CVE-2021-23033

On BIG-IP Advanced WAF and BIG-IP ASM version 16.x before 16.1.0x, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.3, 13.1.x before 13.1.4.1, and all versions of 12.1.x, when a WebSocket profile is configured on a virtual server, undisclosed requests can cause bd to terminate. Note: Software version...

CVE-2021-23033

On BIG-IP Advanced WAF and BIG-IP ASM version 16.x before 16.1.0x, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.3, 13.1.x before 13.1.4.1, and all versions of 12.1.x, when a WebSocket profile is configured on a virtual server, undisclosed requests can cause bd to terminate. Note: Software version...

CVE-2021-23031

On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4.1, 13.1.x before 13.1.4, 12.1.x before 12.1.6, and 11.6.x before 11.6.5.3, an authenticated user may perform a privilege escalation on the BIG-IP Advanced WAF and ASM Configuration utility. Note: Software versions which...

CVE-2021-23036

CVE-2021-23036 affects F5 BIG-IP TMM when BIG-IP ASM and DataSafe are configured on a virtual server; undisclosed requests can crash TMM, causing DoS. Affected 16.0.x likely until 16.0.1.2; fixes are in 16.0.1.2 and 16.1.0 per advisory K05043394. Remediation: upgrade to a version with the fix (16...

CVE-2021-23033

CVE-2021-23033 affects BIG-IP Advanced WAF and BIG-IP ASM WebSocket processing. When a WebSocket profile is configured on a virtual server, undisclosed requests can cause the bd process to terminate, resulting in DoS. Affected software/branches include BIG-IP AWAF/ASM 16.x before 16.1.0x, 15.1.x ...

CVE-2021-23053

On version 15.1.x before 15.1.3, 14.1.x before 14.1.3.1, and 13.1.x before 13.1.3.6, when the brute force protection feature of BIG-IP Advanced WAF or BIG-IP ASM is enabled on a virtual server and the virtual server is under brute force attack, the MySQL database may run out of disk space due to...

CVE-2021-23050

On BIG-IP Advanced WAF and BIG-IP ASM version 16.0.x before 16.0.1.2 and 15.1.x before 15.1.3 and NGINX App Protect on all versions before 3.5.0, when a cross-site request forgery CSRF-enabled policy is configured on a virtual server, an undisclosed HTML response may cause the bd process to...

CVE-2021-23053

On version 15.1.x before 15.1.3, 14.1.x before 14.1.3.1, and 13.1.x before 13.1.3.6, when the brute force protection feature of BIG-IP Advanced WAF or BIG-IP ASM is enabled on a virtual server and the virtual server is under brute force attack, the MySQL database may run out of disk space due to...

Design/Logic Flaw

On version 15.1.x before 15.1.3, 14.1.x before 14.1.3.1, and 13.1.x before 13.1.3.6, when the brute force protection feature of BIG-IP Advanced WAF or BIG-IP ASM is enabled on a virtual server and the virtual server is under brute force attack, the MySQL database may run out of disk space due to...

CVE-2021-23050

On BIG-IP Advanced WAF and BIG-IP ASM version 16.0.x before 16.0.1.2 and 15.1.x before 15.1.3 and NGINX App Protect on all versions before 3.5.0, when a cross-site request forgery CSRF-enabled policy is configured on a virtual server, an undisclosed HTML response may cause the bd process to...

CVE-2021-23050

CVE-2021-23050 affects BIG-IP Advanced WAF and BIG-IP ASM (and related NGINX App Protect) when a CSRF-enabled policy on a virtual server is configured. The vulnerability can cause the bd process to terminate due to an undisclosed HTML response, leading to DoS as described in vendor advisories. Af...

CVE-2021-23053

Summary (CVE-2021-23053): The vulnerability affects BIG-IP with Advanced WAF/ASM brute-force protection enabled on a virtual server. Under a brute-force attack, the MySQL database may exhaust disk space due to the absence of a row limit on undisclosed tables. Affected versions: BIG-IP 15.1.x befo...

PT-2021-15358

Name of the Vulnerable Software and Affected Versions BIG-IP Advanced WAF and BIG-IP ASM versions 12.1.x BIG-IP Advanced WAF and BIG-IP ASM versions 13.1.x before 13.1.4.1 BIG-IP Advanced WAF and BIG-IP ASM versions 14.1.x before 14.1.4.3 BIG-IP Advanced WAF and BIG-IP ASM versions 15.1.x before...

CVE-2021-23030: Improper Input Validation

On BIG-IP Advanced WAF and BIG-IP ASM version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.3, 13.1.x before 13.1.4.1, and all versions of 12.1.x, when a WebSocket profile is configured on a virtual server, undisclosed requests can cause bd to terminate. Note: Software...

PT-2021-15355

Name of the Vulnerable Software and Affected Versions BIG-IP Advanced WAF and BIG-IP ASM versions 12.1.x BIG-IP Advanced WAF and BIG-IP ASM versions 13.1.x before 13.1.4.1 BIG-IP Advanced WAF and BIG-IP ASM versions 14.1.x before 14.1.4.3 BIG-IP Advanced WAF and BIG-IP ASM versions 15.1.x before...

EulerOS 2.0 SP2 : nasm (EulerOS-SA-2021-2410)

According to the version of the nasm package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Netwide Assembler NASM 2.13.02rc2 has a buffer over-read in the parseline function in asm/parser.c via uncontrolled access to nasmregflags.CVE-2018-88...

PT-2021-15353

Name of the Vulnerable Software and Affected Versions F5 BIG-IP ASM versions 13.1.x through 13.1.4 F5 BIG-IP ASM versions 14.1.x through 14.1.4.2 F5 BIG-IP ASM versions 15.1.x through 15.1.3.1 F5 BIG-IP ASM versions 16.0.x through 16.0.1.2 Description When JSON content profiles are configured for...

PT-2021-15373

Name of the Vulnerable Software and Affected Versions F5 BIG-IP Advanced WAF and BIG-IP ASM versions 15.1.x through 15.1.2 F5 BIG-IP Advanced WAF and BIG-IP ASM versions 16.0.x through 16.0.1.1 NGINX App Protect versions prior to 3.5.0 Description The issue arises when a cross-site request forger...

CVE-2021-23036: Improper Input Validation

On version 16.0.x before 16.0.1.2, when a BIG-IP ASM and DataSafe profile are configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel TMM to terminate. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2021-23029: Server-Side Request Forgery (SSRF)

On version 16.0.x before 16.0.1.2, insufficient permission checks may allow authenticated users with guest privileges to perform Server-Side Request Forgery SSRF attacks through F5 Advanced Web Application Firewall WAF and the BIG-IP ASM Configuration utility. Note: Software versions which have...