Code injection

The access policy logon page logon.inc in F5 BIG-IP APM 11.1.0 through 11.2.1 allows remote attackers to conduct clickjacking attacks via unspecified vectors...

CVE-2013-5975

The access policy logon page logon.inc in F5 BIG-IP APM 11.1.0 through 11.2.1 allows remote attackers to conduct clickjacking attacks via unspecified vectors...

CVE-2013-5976

The CVE-2013-5976 XSS vulnerability affects F5 BIG-IP APM: the access policy logout page (logout.inc) accepts the LastMRH_Session cookie to inject arbitrary script/HTML. Affected versions: BIG-IP APM 10.1.0–10.2.4 and 11.1.0–11.3.0. The security advisory (K14712) notes the vulnerability in the lo...

CVE-2013-5976

Cross-site scripting XSS vulnerability in the access policy logout page logout.inc in F5 BIG-IP APM 10.1.0 through 10.2.4 and 11.1.0 through 11.3.0 allows remote attackers to inject arbitrary web script or HTML via the LastMRHSession cookie...

CVE-2013-5975

The CVE-2013-5975 issue concerns the Access Policy Manager logon.inc page in F5 BIG-IP APM, where 11.1.0–11.2.1 are vulnerable to clickjacking via unspecified vectors. The associated advisory (K14700) confirms vulnerable APM 11.1.0–11.2.1 and notes that the vulnerability was addressed in BIG-IP A...

SOL14712 - The BIG-IP APM access policy logout page may be vulnerable to XSS cookie tampering

Recommended action To eliminate this vulnerability, upgrade to a version that is listed in the Versions known to be not vulnerable column in the previous table. To mitigate this vulnerability, you can modify the logout web page to null the specific code identified at issue. To do so, perform the...

SOL14700 - BIG-IP APM clickjacking vulnerability

Note: This issue has been addressed in BIG-IP APM 11.3.0 and later through the use of the x-frame-options header in the Access Policy pages. Modifying a BIG-IP APM 11.3.0 or later system dB variable settings for apm.xframeoptions or apm.xframeoptions.allowfrom from their defaults may open the...

Security Fix for VSX in Remote Access Policy Calculation

...

F5 BIG-IP 11.2.0 SQL Injection

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: SQL Injection product: F5 BIG-IP vulnerable version: =11.2.0 fixed version: 11.2.0 HF3 11.2.1 HF3 CVE number: CVE-2012-3000 impact: Medium homepage: http://www.f5.com/...

CVE-2009-2453

Citrix XenApp formerly Presentation Server 4.5 Hotfix Rollup Pack 3 does not apply an access policy when it is defined with the Access Gateway Advanced Edition filters, which allows attackers to bypass intended access restrictions via unknown vectors...

Design/Logic Flaw

Citrix XenApp formerly Presentation Server 4.5 Hotfix Rollup Pack 3 does not apply an access policy when it is defined with the Access Gateway Advanced Edition filters, which allows attackers to bypass intended access restrictions via unknown vectors...

CVE-2009-2453

CVE-2009-2453 affects Citrix XenApp (formerly Presentation Server) 4.5 Hotfix Rollup Pack 3. The issue is that an access policy is not applied when the policy is defined with the Access Gateway Advanced Edition filters, enabling bypass of intended access restrictions via unknown vectors. The conn...

dbus-daemon protection bypass

User can bypass security access policy for some methods...

Novell Access Management SSLVPN Server - Security Bypass

source: https://www.securityfocus.com/bid/22787/info Novell Access Management SSLVPN Server is prone to a security-bypass vulnerability. A remote authenticated attacker can exploit this issue to access corporate resources normally restricted within VPN access policy. This may lead to other attack...

RHEL 2.1 : LPRng (RHSA-2002:120)

The LPRng print spooler, as shipped in Red Hat Linux Advanced Server 2.1, accepts all remote print jobs by default. Updated LPRng packages are available to fix this issue. With its default configuration, LPRng will accept job submissions from any host, which is not appropriate in a workstation...