F5 Networks BIG-IP : BIG-IP APM Edge Client proxy vulnerability (K30525503)

The version of F5 Networks BIG-IP installed on the remote host is prior to 13.1.5 / 14.1.4.5 / 15.1.5.1 / 16.1.2.2. It is, therefore, affected by a vulnerability as referenced in the K30525503 advisory. - In all versions before 7.2.1.4, when proxy settings are configured in the network access...

Malicious code in gd-apm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cdb0c6775c03fb9327f05303d6bcc013bc19e762778b6d1f7eea89ada7bd49f4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3303 Malicious code in gd-apm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cdb0c6775c03fb9327f05303d6bcc013bc19e762778b6d1f7eea89ada7bd49f4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in elastic-apm-rum (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f3134e83247b4ff3e676cf0dd4b3378ca1bf9f4ff0adfee2583b6745d70adaca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2683 Malicious code in elastic-apm-rum (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f3134e83247b4ff3e676cf0dd4b3378ca1bf9f4ff0adfee2583b6745d70adaca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1055 Malicious code in apm-synthtrace (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 501f87c261d9652eac673b3a97c22007a4d65d77b7511efef4882fa25a86b153 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in apm-synthtrace (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 501f87c261d9652eac673b3a97c22007a4d65d77b7511efef4882fa25a86b153 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

apm-agent-utils (>=1.0.3 <=1.3.0), enochecker (>=0.0.5 <=0.0.9) +1 more potentially affected by CVE-2019-7617 via elastic-apm (>=4.2.2 <=5.10.1)

elastic-apm PYPI version =4.2.2, =1.0.3, =0.0.5, =0.0.14, =0.0.24.post2 Source cves: CVE-2019-7617 Source advisory: OSV:GHSA-22JH-6GX8-F944...

Elastic APM agent for Python client CGI proxy redirection flaw

When the Elastic APM agent for Python versions before 5.1.0 is run as a CGI script, there is a variable name clash flaw if a remote attacker can control the proxy header. This could result in an attacker redirecting collected APM data to a proxy of their choosing...

GHSA-22JH-6GX8-F944 Elastic APM agent for Python client CGI proxy redirection flaw

When the Elastic APM agent for Python versions before 5.1.0 is run as a CGI script, there is a variable name clash flaw if a remote attacker can control the proxy header. This could result in an attacker redirecting collected APM data to a proxy of their choosing...

Elastic APM agent for Ruby vulnerable to Improper Certificate Validation

A TLS certificate validation flaw was found in Elastic APM agent for Ruby versions before 2.9.0. When specifying a trusted server CA certificate via the servercacert setting, the Ruby agent would not properly verify the certificate returned by the APM server. This could result in a man in the...

GHSA-35J2-P8FH-X966 Elastic APM agent for Ruby vulnerable to Improper Certificate Validation

A TLS certificate validation flaw was found in Elastic APM agent for Ruby versions before 2.9.0. When specifying a trusted server CA certificate via the servercacert setting, the Ruby agent would not properly verify the certificate returned by the APM server. This could result in a man in the...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation. When specifying a trusted server CA certificate via the servercacert setting, the Ruby agent will not properly verify the certificate returned by the APM server. Remediation Upgrade elastic-apm to version 2.9....

Elastic APM agent for Ruby vulnerable to Improper Certificate Validation

A TLS certificate validation flaw was found in Elastic APM agent for Ruby versions before 2.9.0. When specifying a trusted server CA certificate via the servercacert setting, the Ruby agent would not properly verify the certificate returned by the APM server. This could result in a man in the...

F5 BIG-IP APM Edge Client for Windows has an unspecified vulnerability

F5 BIG-IP APM Edge Client for Windows is a client-side access control authentication access client application from F5. A security vulnerability exists in F5 BIG-IP APM Edge Client for Windows, which can be exploited by attackers to obtain privilege escalation on client Windows systems...

F5 BIG-IP APM Resource Management Error Vulnerability (CNVD-2022-74964)

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. A resource management error vulnerability exists in F5 BIG-IP APM, which can be exploited by attackers to cause service...

F5 BIG-IP APM log information disclosure vulnerability

F5 BIG-IP APM and F5 BIG-IP APM Clients are both products of F5, Inc. F5 BIG-IP APM Clients is a suite of APM client software. F5 BIG-IP APM is vulnerable to log information disclosure, which can be exploited by attackers to view sensitive information related to APM sessions...

F5 BIG-IP APM Cross-Site Scripting Vulnerability (CNVD-2022-77527)

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. A cross-site scripting vulnerability exists in F5 BIG-IP APM, which can be exploited by attackers to execute JavaScript in th...

F5 BIG-IP code issue vulnerability (CNVD-2022-77521)

F5 BIG-IP APM Edge Client for Windows is a client-side access control authentication access client application from F5. F5 BIG-IP has a code issue vulnerability that can be exploited by attackers to gain privilege escalation on client Windows systems using a malicious dynamic link library DLL...

CVE-2022-29491

On F5 BIG-IP LTM, Advanced WAF, ASM, or APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5, 14.1.x versions prior to 14.1.4.6, and all versions of 13.1.x, 12.1.x, and 11.6.x, when a virtual server is configured with HTTP, TCP on one side client/server, and DTLS on the other...