CVE-2008-7032

Web Management Console Cross-site request forgery CSRF vulnerability in the web management console in F5 BIG-IP 9.4.3 allows remote attackers to hijack the authentication of administrators for requests that create new administrators and execute shell commands, as demonstrated using...

Cross site request forgery (csrf)

Web Management Console Cross-site request forgery CSRF vulnerability in the web management console in F5 BIG-IP 9.4.3 allows remote attackers to hijack the authentication of administrators for requests that create new administrators and execute shell commands, as demonstrated using...

CVE-2008-7032

Web Management Console Cross-site request forgery CSRF vulnerability in the web management console in F5 BIG-IP 9.4.3 allows remote attackers to hijack the authentication of administrators for requests that create new administrators and execute shell commands, as demonstrated using...

CVE-2008-7032

Technical details about CVE-2008-7032 are not publicly available in the provided documents. Monitor for updates from vendors and security feeds to obtain affected products/versions, impact, exploit status, and remediation.

SOL10417 - BIG-IP ASM and PSM remote buffer overflow exploit

F5 Product Development tracked this issue as CR126690 and it was fixed in BIG-IP ASM and PSM 9.4.8 and 10.1.0. For information about upgrading, refer to the BIG-IP ASM or PSM release notes. Important: This issue was re-introduced in 9.4.8 HF-1, and then fixed in 9.4.8 HF-2 and later as CR133530...

SOL10441 - Microsoft Active Template Library (ATL) vulnerabilities VU#456745

Information about this advisory is available at the following locations: F5 Product Development tracked this issue as ID 296507 formerly CR125945 for FirePass, and it was fixed in FirePass 6.1.0. For information about upgrading, refer to the FirePass release notes. Obtaining and installing patche...

SOL10366 - BIND vulnerability - CVE-2009-0696

F5 Product Development has determined that these BIG-IP and Enterprise Manager versions use a vulnerable version of BIND. However, the vulnerable code is not used by default on these BIG-IP or Enterprise Manager systems. These products are only vulnerable if BIND was manually configured and enabl...

CVE-2009-2119

Cross-site scripting XSS vulnerability in the login interface my.logon.php3 in F5 FirePass SSL VPN 5.5 through 5.5.2 and 6.0 through 6.0.3 allows remote attackers to inject arbitrary web script or HTML via a base64-encoded xcho parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in the login interface my.logon.php3 in F5 FirePass SSL VPN 5.5 through 5.5.2 and 6.0 through 6.0.3 allows remote attackers to inject arbitrary web script or HTML via a base64-encoded xcho parameter...

CVE-2009-2119

Cross-site scripting XSS vulnerability in the login interface my.logon.php3 in F5 FirePass SSL VPN 5.5 through 5.5.2 and 6.0 through 6.0.3 allows remote attackers to inject arbitrary web script or HTML via a base64-encoded xcho parameter...

CVE-2009-2119

CVE-2009-2119 is an XSS vulnerability in the FirePass login interface (my.logon.php3) affecting F5 FirePass SSL VPN 5.5–5.5.2 and 6.0–6.0.3. The issue allows remote attackers to inject arbitrary script/HTML via a base64-encoded xcho parameter. The root cause is insufficient sanitization of input ...

SOL10143 - Cross-Site Scripting Vulnerabilities in the FirePass logon

Cross-site scripting XSS vulnerabilities exist in the FirePass logon page, which is accessible prior to authentication. The affected FirePass page fails to fully sanitize HTTP request input before the web page content is sent to the browser. By altering the HTTP request input in the cookie, a...

SOL9990 - icclib vulnerabilities CVE-2009-0583 and CVE-2009-0584

Description Multiple integer overflow flaws which could lead to heap-based buffer overflows, as well as multiple insufficient input validation flaws, were found in Ghostscript's International Color Consortium Format library icclib. Using specially-crafted ICC profiles, an attacker could create a...

CVE-2008-6474

The management interface in F5 BIG-IP 9.4.3 allows remote authenticated users with Resource Manager privileges to inject arbitrary Perl code via unspecified configuration settings related to Perl EP3 with templates, probably triggering static code injection...

Code injection

The management interface in F5 BIG-IP 9.4.3 allows remote authenticated users with Resource Manager privileges to inject arbitrary Perl code via unspecified configuration settings related to Perl EP3 with templates, probably triggering static code injection...

CVE-2008-6474

The CVE-2008-6474 issue affects F5 BIG-IP 9.4.3 (management CLI/Web interface). The vulnerability is a remote code-injection where remote authenticated users with Resource Manager privileges can exploit unsanitized input related to Perl EP3 templates to create arbitrary Perl code execution with t...

CVE-2008-6474

The management interface in F5 BIG-IP 9.4.3 allows remote authenticated users with Resource Manager privileges to inject arbitrary Perl code via unspecified configuration settings related to Perl EP3 with templates, probably triggering static code injection...

SOL9761 - PHP vulnerability - CVE-2008-5557

A heap-based buffer overflow in PHP 4.3.0 through 5.2.6 may allow attackers to execute arbitrary code. Information about this advisory is available at the following location: Note: This link takes you to a resource outside of AskF5, and it is possible that the information may be removed without o...

SOL9754 - BIND 9 vulnerability CVE-2009-0025

BIND does not properly check the return value from the OpenSSL DSAverify function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature. Information about this advisory is available at the following location: Note: The previous link takes y...

SOL9642 - Samba vulnerability CVE-2008-1105

Specifically crafted SMB responses can result in a heap overflow in the Samba client code. Information about this advisory is available at the following location: Note: This link takes you to a resource outside of AskF5, and it is possible that the information may be removed without our knowledge...