CVE-2019-6602

In BIG-IP 11.5.1-11.5.8 and 11.6.1-11.6.3, the Configuration Utility login page may not follow best security practices when handling a malicious request...

CVE-2019-6602

CVE-2019-6602 affects F5 BIG-IP: the Configuration Utility login page may mishandle a malicious request, yielding an inconsistent HTTP response. Affected versions: BIG-IP 11.5.1–11.5.8 and 11.6.1–11.6.3. Mitigation: upgrade to fix version 11.6.4 (and related 11.5.x path as applicable) per F5 advi...

CVE-2019-6602: Observable Discrepancy

In BIG-IP 11.5.1-11.5.8 and 11.6.1-11.6.3, the Configuration Utility login page may not follow best security practices when handling a malicious request...

CVE-2019-6607: Cross-Site Request Forgery (CSRF)

On BIG-IP ASM 11.5.1-11.5.8, 11.6.1-11.6.3, 12.1.0-12.1.3, 13.0.0-13.1.1.3, and 14.0.0-14.0.0.2, there is a stored cross-site scripting vulnerability in an ASM violation viewed in the Configuration utility. In the worst case, an attacker can store a CSRF which results in code execution as the adm...

PT-2019-18184

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions 11.5.1 through 11.5.8 F5 BIG-IP versions 11.6.1 through 11.6.3 Description The Configuration Utility login page in the affected versions may not follow best security practices when handling a malicious request. Recommendatio...

PT-2019-18189

Name of the Vulnerable Software and Affected Versions F5 BIG-IP ASM versions 11.5.1 through 11.5.8 F5 BIG-IP ASM versions 11.6.1 through 11.6.3 F5 BIG-IP ASM versions 12.1.0 through 12.1.3 F5 BIG-IP ASM versions 13.0.0 through 13.1.1.3 F5 BIG-IP ASM versions 14.0.0 through 14.0.0.2 Description Th...

CVE-2018-12551

When Eclipse Mosquitto version 1.0 to 1.5.5 inclusive is configured to use a password file for authentication, any malformed data in the password file will be treated as valid. This typically means that the malformed data becomes a username and no password. If this occurs, clients can circumvent...

CVE-2018-12551

When Eclipse Mosquitto version 1.0 to 1.5.5 inclusive is configured to use a password file for authentication, any malformed data in the password file will be treated as valid. This typically means that the malformed data becomes a username and no password. If this occurs, clients can circumvent...

Some ASUS Updates Drop Backdoors on PCs in 'Operation ShadowHammer'

A supply-chain attack dubbed “Operation ShadowHammer” has been uncovered, targeting users of the ASUS Live Update Utility with a backdoor injection. The China-backed BARIUM APT is suspected to be at the helm of the project. According to Kaspersky Lab, the campaign ran from June to at least Novemb...

F5 BIG-IP Application Security Manager Cross-Site Request Forgery Vulnerability

F5 BIG-IP Application Security Manager ASM is a Web Application Firewall WAF from F5 USA that provides secure remote access, protects email, and simplifies Web access control while enhancing network and application performance. A cross-site scripting vulnerability exists in the Configuration...

F5 Networks BIG-IP : BIG-IP ASM XSS vulnerability (K14812883)

This is a stored cross-site scripting XSS vulnerability in an ASM violation viewed in the Configuration utility. In the worst case, an attacker can store a CSRF, which results in code execution as the admin user. CVE-2019-6607 The user levels that can store this attack are ASM Administrator,...

F5 Networks BIG-IP : REST Framework vulnerability (K11818407)

The Configuration utility login page may not follow best security practices when handling a malicious request. CVE-2019-6602 Impact BIG-IP The Configuration utility login page returns an inconsistent HTTP response when processing modified requests; this may provide clues to an attacker looking to...

Path traversal

An issue was discovered in BlogEngine.NET through 3.3.6.0. A path traversal and Local File Inclusion vulnerability in PostList.ascx.cs can cause unauthenticated users to load a PostView.ascx component from a potentially untrusted location on the local filesystem. This is especially dangerous if a...

Norsk Hydro Calls Ransomware Attack 'Severe'

Aluminum giant Norsk Hydro has fallen victim to a serious ransomware attack that has forced it to shut down or isolate several plants and send several more into manual mode, the company said on Tuesday morning. Oslo, Norway-based Norsk Hydro, one of the world’s largest makers of aluminum, employs...

CVE-2019-6149

An unquoted search path vulnerability was identified in Lenovo Dynamic Power Reduction Utility prior to version 2.2.2.0 that could allow a malicious user with local access to execute code with administrative privileges...

CVE-2019-6149

An unquoted search path vulnerability was identified in Lenovo Dynamic Power Reduction Utility prior to version 2.2.2.0 that could allow a malicious user with local access to execute code with administrative privileges...

CVE-2019-6714: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in BlogEngine.NET through 3.3.6.0. A path traversal and Local File Inclusion vulnerability in PostList.ascx.cs can cause unauthenticated users to load a PostView.ascx component from a potentially untrusted location on the local filesystem. This is especially dangerous if a...

CVE-2019-6149

The CVE-2019-6149 issue is an unquoted search path vulnerability in Lenovo Dynamic Power Reduction Utility, affecting ThinkPad X1 Carbon (machine types 20KH, 20KG). The underlying root cause is an unquoted search path that could allow a local attacker to execute code with administrative privilege...

PT-2019-17982

Name of the Vulnerable Software and Affected Versions Lenovo Dynamic Power Reduction Utility versions prior to 2.2.2.0 Description An unquoted search path issue was identified that could allow a malicious user with local access to execute code with administrative privileges. Recommendations For...

CVE-2019-6149: Unquoted Search Path or Element

An unquoted search path vulnerability was identified in Lenovo Dynamic Power Reduction Utility prior to version 2.2.2.0 that could allow a malicious user with local access to execute code with administrative privileges...