K000148482: Sudo vulnerability CVE-2019-19234

Security Advisory Description In Sudo through 1.8.29, the fact that a user has been blocked e.g., by using the ! character in the shadow file instead of a password hash is not considered, allowing an attacker who has access to a Runas ALL sudoer account to impersonate any blocked user. NOTE: The...

F5 Networks BIG-IP : Linux kernel vulnerability (K000148479)

The version of F5 Networks BIG-IP installed on the remote host is prior to 15.1.10.8 / 16.1.6 / 17.1.2.2 / 17.5.0. It is, therefore, affected by a vulnerability as referenced in the K000148479 advisory. In the Linux kernel, the following vulnerability has been resolved: tcp: do not accept ACK of...

K000148349: Spring Framework vulnerability CVE-2024-38819

Security Advisory Description Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process i...

F5 Networks BIG-IP : Diffie-Hellman key exchange protocol vulnerability (K000148343)

The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the K000148343 advisory. Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Nginx

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Nginx Vulnerability Details CVEID:CVE-2024-7646 DESCRIPTION: Kubernetes ingress-nginx could allow a remote authenticated attacker to execute arbitrary commands on the system, caused by an annotation validatio...

K000148278: Spring framework CVE-2024-38820 vulnerability

Security Advisory Description The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase has some Locale dependent exceptions that could potentially result in fields not protected as expected. CVE-2024-38820 Impact There is no impact; F5...

F5 Networks BIG-IP : Python tarfile vulnerability (K000148252)

The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the K000148252 advisory. There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking...

F5 Networks BIG-IP : libarchive vulnerability (K000148259)

The version of F5 Networks BIG-IP installed on the remote host is prior to 17.1.3 / 17.5.1.2. It is, therefore, affected by multiple vulnerabilities as referenced in the K000148259 advisory. CVE-2016-10350The archivereadformatcabreadheader function in archivereadsupportformatcab.c in libarchive...

F5 Networks BIG-IP : libarchive vulnerability (K000148256)

The version of F5 Networks BIG-IP installed on the remote host is prior to 16.1.6 / 17.1.2.2 / 17.5.0. It is, therefore, affected by a vulnerability as referenced in the K000148256 advisory. libarchive version commit 9693801580c0cf7c70e862d305270a16b52826a7 onwards release v3.2.0 onwards contains...

F5 Networks BIG-IP : libarchive vulnerabilities (K000148255)

The version of F5 Networks BIG-IP installed on the remote host is prior to 16.1.6 / 17.1.2.2. It is, therefore, affected by multiple vulnerabilities as referenced in the K000148255 advisory. CVE-2019-1000020libarchive version commit 5a98dcf8a86364b3c2c469c85b93647dfb139961 onwards version v2.8.0...

K000148242: Qt vulnerability CVE-2017-10904

Security Advisory Description Qt for Android prior to 5.9.0 allows remote attackers to execute arbitrary OS commands via unspecified vectors. CVE-2017-10904 Impact There is no impact; F5 products are not affected by this vulnerability. Security Advisory Status F5 Product Development has evaluated...

K000148239: Intel FPGA vulnerability CVE-2024-25576

Security Advisory Description improper access control in firmware for some IntelR FPGA products before version 24.1 may allow a privileged user to enable escalation of privilege via local access. CVE-2024-25576 Impact There is no impact; F5 products are not affected by this vulnerability. Securit...

K000145125: Curl vulnerability CVE-2024-6197

Security Advisory Description libcurl's ASN1 parser has this utf8asn1str function used for parsing an ASN.1 UTF-8 string. Itcan detect an invalid field and return error. Unfortunately, when doing so it also invokes free on a 4 byte localstack buffer. Most modern malloc implementations detect this...

K000141507: Intel CPU vulnerability CVE-2023-41833

Security Advisory Description A race condition in UEFI firmware for some IntelR processors may allow a privileged user to potentially enable escalation of privilege via local access. CVE-2023-41833 Impact There is no impact; F5 products are not affected by this vulnerability. Security Advisory...

K000141506: glibc vulnerability CVE-2024-33602

Security Advisory Description nscd: netgroup cache assumes NSS callback uses in-buffer strings The Name Service Cache Daemon's nscd netgroup cache can corrupt memory when the NSS callback does not store all strings in the provided buffer. The flaw was introduced in glibc 2.15 when the cache was...

CVE-2024-47139

A stored XSS in BIG-IQ is present on an undisclosed page of the BIG-IQ Configuration utility that can be exploited by an Administrator to run JavaScript in the user’s context. Connected sources specify affected targets as BIG-IQ Centralized Management (BIG-IQ UI) and BIG-IP BIG-IQ components, wit...

K000141302: Quarterly Security Notification (October 2024)

Security Advisory Description On October 16, 2024, F5 announced the following security issues. This document is intended to serve as an overview of these vulnerabilities to help determine the impact to your F5 devices. You can find the details of each issue in the associated articles. You can wat...

F5 Networks BIG-IP : BIG-IP monitors vulnerability (K000140061)

The version of F5 Networks BIG-IP installed on the remote host is prior to 15.1.10.5 / 16.1.5 / 17.1.1.4. It is, therefore, affected by a vulnerability as referenced in the K000140061 advisory. BIG-IP monitor functionality may allow an authenticated attacker with at least Manager role privileges ...

F5 Networks BIG-IP : Angular JS vulnerabilities (K000141459)

The version of F5 Networks BIG-IP installed on the remote host is prior to 17.1.3 / 17.5.1.1. It is, therefore, affected by multiple vulnerabilities as referenced in the K000141459 advisory. CVE-2019-14863There is a vulnerability in all angular versions before 1.5.0-beta.0, where after escaping t...

F5 Networks BIG-IP : Angular JS vulnerabilities (K000141463)

The version of F5 Networks BIG-IP installed on the remote host is prior to 17.1.3 / 17.5.1.1. It is, therefore, affected by multiple vulnerabilities as referenced in the K000141463 advisory. CVE-2019-10768In AngularJS before 1.7.9 the function merge could be tricked into adding or modifying...