CVE-2008-1503

Cross-site scripting XSS vulnerability in the web management interface in F5 BIG-IP 9.4.3 allows remote attackers to inject arbitrary web script or HTML via 1 the name of a node object, or the 2 sysContact or 3 sysLocation SNMP configuration field, aka "Audit Log XSS." NOTE: these issues might be...

CVE-2008-1503

CVE-2008-1503 affects F5 BIG-IP 9.4.3 web management interface. The vulnerability is a Cross-site Scripting (XSS) flaw exploitable via user-supplied input in the node object name, or the sysContact/sysLocation SNMP configuration fields (Audit Log XSS). The notes suggest CSRF as a possible related...

CVE-2008-1503

Cross-site scripting XSS vulnerability in the web management interface in F5 BIG-IP 9.4.3 allows remote attackers to inject arbitrary web script or HTML via 1 the name of a node object, or the 2 sysContact or 3 sysLocation SNMP configuration field, aka "Audit Log XSS." NOTE: these issues might be...

F5 BIG-IP Web Management Audit Log XSS

F5 BIG-IP Web Management Audit Log XSS Product: F5 BIG-IP http://www.f5.com/products/big-ip/ The F5 BIG-IP web management interface contains a persistent cross-site scripting vulnerability in the audit log facility. Log entries are output raw, without being HTML-encoded first. This allows an...

SOL8508 - Cross-site scripting vulnerability in installControl.php3 page

A cross-site scripting XSS vulnerability exists in the FirePass installControl.php3 page, which is accessible prior to authentication. The installControl.php3 page fails to fully sanitize URL input before the web page content is sent to the browser. It is possible for an attacker to create web...

F5 BIG-IP Web Management Console XSS

F5 BIG-IP Web Management Console XSS Product: F5 BIG-IP http://www.f5.com/products/big-ip/ The F5 BIG-IP web management interface contains a potentially persistent cross-site scripting vulnerability in the "Console" feature. Output from executed console commands is wrapped in textarea intentional...

F5 BIG-IP 9.4.3 - Web Management Interface Console HTML Injection

F5 BIG-IP 9.4.3 - Web Management Interface Console HTML Injection source: https://www.securityfocus.com/bid/28151/info F5 BIG-IP Web Management Interface is prone to a HTML-injection vulnerability because the web management interface fails to properly sanitize user-supplied input. An attacker may...

F5 BIG-IP 9.4.3 - Web Management Interface Console HTML Injection

source: https://www.securityfocus.com/bid/28151/info F5 BIG-IP Web Management Interface is prone to a HTML-injection vulnerability because the web management interface fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the brows...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in F5 FirePass 4100 SSL VPN 5.4.1 through 5.5.2 and 6.0 through 6.0.1, when pre-logon sequences are enabled, allow remote attackers to inject arbitrary web script or HTML via the query string to 1 my.activation.php3 and 2 my.logon.php3...

CVE-2007-6704

Multiple cross-site scripting XSS vulnerabilities in F5 FirePass 4100 SSL VPN 5.4.1 through 5.5.2 and 6.0 through 6.0.1, when pre-logon sequences are enabled, allow remote attackers to inject arbitrary web script or HTML via the query string to 1 my.activation.php3 and 2 my.logon.php3...

CVE-2007-6704

Multiple cross-site scripting XSS vulnerabilities in F5 FirePass 4100 SSL VPN 5.4.1 through 5.5.2 and 6.0 through 6.0.1, when pre-logon sequences are enabled, allow remote attackers to inject arbitrary web script or HTML via the query string to 1 my.activation.php3 and 2 my.logon.php3...

CVE-2007-6704

Multiple cross-site scripting XSS vulnerabilities in F5 FirePass 4100 SSL VPN 5.4.1 through 5.5.2 and 6.0 through 6.0.1, when pre-logon sequences are enabled, allow remote attackers to inject arbitrary web script or HTML via the query string to 1 my.activation.php3 and 2 my.logon.php3...

CVE-2007-6704

CVE-2007-6704 is a cross-site scripting vulnerability affecting F5 FirePass SSL VPN 4100/5.x and 6.0.x when pre-logon sequences are enabled. The issue allows remote attackers to inject script via the query string to my.activation.php3 or my.logon.php3. FirePass 6.0.2 fixes the issue; hotfixes HF-...

F5 BIG-IP Web Management Console CSRF (with example)

F5 BIG-IP Web Management Console CSRF Product: F5 BIG-IP http://www.f5.com/products/big-ip/ By design the F5 BIG-IP web management interface allows a logged-in user with Resource Manager or Administrator privileges to execute an arbitrary bigpipe shell command through the web "Console" feature. I...

F5 BIG-IP Web Management Version Detection

Binary data 4370.prm...

F5 BIG-IP Web Management Multiple XSS

The F5 BIG-IP web management interface on the remote host is susceptible to cross-site scripting attacks. %NASLMINLEVEL 70300 bigipwebxss.nasl Notes: - Some pages are way bigger than 8K and BIG-IP does not use Content-Length. The script uses custom httpsendrecvlength to retrieve the entire page...

F5 BIG-IP Web Management Interface Detection

An F5 BIG-IP web management interface is running on this port. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid30215; scriptversion"1.16"; scriptsetattributeattribute:"pluginmodificationdate", value:"2023/05/24"; scriptnameenglish:"F5 BIG-IP Web Management Interface...

F5 BIG-IP 9.4.3 - Web Management Interface Cross-Site Request Forgery

F5 BIG-IP 9.4.3 - Web Management Interface Cross-Site Request Forgery source: https://www.securityfocus.com/bid/27720/info F5 BIG-IP is prone to a cross-site request-forgery vulnerability. Exploiting this issue may allow a remote attacker to execute arbitrary actions on an affected device. F5...

f5big-xsrf.txt

F5 BIG-IP Web Management Console CSRF Product: F5 BIG-IP http://www.f5.com/products/big-ip/ By design the F5 BIG-IP web management interface allows a logged-in user with Resource Manager or Administrator privileges to execute an arbitrary bigpipe shell command through the web "Console" feature. I...

F5 BIG-IP Web Management Interface Version

An F5 BIG-IP web management interface is running on this port, and Nessus has determined its software version. Note. HTTP credentials are required to retrieve version information. TRUSTED...