CVE-2018-5517: Improper Input Validation

On F5 BIG-IP 13.1.0-13.1.0.5, malformed TCP packets sent to a self IP address or a FastL4 virtual server may cause an interruption of service. The control plane is not exposed to this issue. This issue impacts the data plane virtual servers and self IPs...

DPDK Memory Disclosure Vulnerability

DPDK is a set of open source drivers for fast packet processing. A security vulnerability exists in the vhost-user interface in versions of DPDK prior to 18.02.1. An attacker can exploit this vulnerability to disclose vhost-user backend process memory...

UBUNTU-CVE-2018-1059

The DPDK vhost-user interface does not check to verify that all the requested guest physical range is mapped and contiguous when performing Guest Physical Addresses to Host Virtual Addresses translations. This may lead to a malicious guest exposing vhost-user backend process memory. All versions...

Suspected 'Big Bitcoin Heist' Mastermind Fled to Sweden On Icelandic PM's Plane

Remember the "Big bitcoin heist " we reported last month when a group of thieves stole around 600 powerful bitcoin mining devices from Icelandic data centers? Icelandic Police had arrested 11 suspects as part of the investigation, one of which has escaped from prison and fled to Sweden on a...

CVE-2017-6155

On F5 BIG-IP 13.0.0, 12.0.0-12.1.3.1, 11.6.0-11.6.2, 11.4.1-11.5.5, or 11.2.1, malformed SPDY or HTTP/2 requests may result in a disruption of service to TMM. Data plane is only exposed when a SPDY or HTTP/2 profile is attached to a virtual server. There is no control plane exposure...

CVE-2017-6148

Responses to SOCKS proxy requests made through F5 BIG-IP version 13.0.0, 12.0.0-12.1.3.1, 11.6.1-11.6.2, or 11.5.1-11.5.5 may cause a disruption of services provided by TMM. The data plane is impacted and exposed only when a SOCKS proxy profile is attached to a Virtual Server. The control plane i...

Design/Logic Flaw

Responses to SOCKS proxy requests made through F5 BIG-IP version 13.0.0, 12.0.0-12.1.3.1, 11.6.1-11.6.2, or 11.5.1-11.5.5 may cause a disruption of services provided by TMM. The data plane is impacted and exposed only when a SOCKS proxy profile is attached to a Virtual Server. The control plane i...

CVE-2017-6155

On F5 BIG-IP 13.0.0, 12.0.0-12.1.3.1, 11.6.0-11.6.2, 11.4.1-11.5.5, or 11.2.1, malformed SPDY or HTTP/2 requests may result in a disruption of service to TMM. Data plane is only exposed when a SPDY or HTTP/2 profile is attached to a virtual server. There is no control plane exposure...

Design/Logic Flaw

On F5 BIG-IP 13.0.0, 12.0.0-12.1.3.1, 11.6.0-11.6.2, 11.4.1-11.5.5, or 11.2.1, malformed SPDY or HTTP/2 requests may result in a disruption of service to TMM. Data plane is only exposed when a SPDY or HTTP/2 profile is attached to a virtual server. There is no control plane exposure...

CVE-2017-6155

On F5 BIG-IP 13.0.0, 12.0.0-12.1.3.1, 11.6.0-11.6.2, 11.4.1-11.5.5, or 11.2.1, malformed SPDY or HTTP/2 requests may result in a disruption of service to TMM. Data plane is only exposed when a SPDY or HTTP/2 profile is attached to a virtual server. There is no control plane exposure...

CVE-2017-6155

The CVE-2017-6155 issue affects F5 BIG-IP TMM in versions with SPDY or HTTP/2 profiles (BIG-IP 11.2.x, 11.4.1–11.5.5, 11.6.0–11.6.2, 12.0.0–12.1.3.1, 13.0.0). Malformed SPDY/HTTP/2 requests can disrupt service on TMM when such profiles are attached; no control-plane exposure is reported. Impact i...

CVE-2017-6148

The CVE-2017-6148 issue affects F5 BIG-IP systems where a SOCKS proxy profile attached to a Virtual Server can disrupt TMM operations. Affected releases include BIG-IP 13.0.0 and 13.x; 12.x (12.0.0–12.1.3.1; 12.1.3.2 is the fix), and 11.x (11.5.1–11.5.5; 11.6.1–11.6.2; 11.6.3 is the fix). The vul...

PT-2018-8302

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions 11.2.1 F5 BIG-IP versions 11.4.1 through 11.5.5 F5 BIG-IP versions 11.6.0 through 11.6.2 F5 BIG-IP versions 12.0.0 through 12.1.3.1 F5 BIG-IP version 13.0.0 Description The issue arises from malformed SPDY or HTTP/2 requests...

PT-2018-8296

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions 11.5.1 through 11.5.5 F5 BIG-IP versions 11.6.1 through 11.6.2 F5 BIG-IP versions 12.0.0 through 12.1.3.1 F5 BIG-IP version 13.0.0 Description The issue affects the data plane when a SOCKS proxy profile is attached to a...

CVE-2017-6148: Improper Input Validation

Responses to SOCKS proxy requests made through F5 BIG-IP version 13.0.0, 12.0.0-12.1.3.1, 11.6.1-11.6.2, or 11.5.1-11.5.5 may cause a disruption of services provided by TMM. The data plane is impacted and exposed only when a SOCKS proxy profile is attached to a Virtual Server. The control plane i...

CVE-2018-5502

On F5 BIG-IP versions 13.0.0 - 13.1.0.3, attackers may be able to disrupt services on the BIG-IP system with maliciously crafted client certificate. This vulnerability affects virtual servers associated with Client SSL profile which enables the use of client certificate authentication. Client...

CVE-2018-5509

On F5 BIG-IP versions 13.0.0 or 12.1.0 - 12.1.3.1, when a specifically configured virtual server receives traffic of an undisclosed nature, TMM will crash and take the configured failover action, potentially causing a denial of service. The configuration which exposes this issue is not common and...

CVE-2018-5509

On F5 BIG-IP versions 13.0.0 or 12.1.0 - 12.1.3.1, when a specifically configured virtual server receives traffic of an undisclosed nature, TMM will crash and take the configured failover action, potentially causing a denial of service. The configuration which exposes this issue is not common and...

Arista Networks EOS Control Plane Packet Handling DoS (SA0025)

The version of Arista Networks EOS running on the remote device is affected by a denial of service vulnerability due to an unspecified flaw when handling certain packets sent to the control plane. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to cause the...

Cross site scripting

Invoice Plane version 1.5.4 and earlier contains a Cross Site Scripting XSS vulnerability in Client's details that can result in execution of javascript code . This vulnerability appears to have been fixed in 1.5.5 and later...