CVE-2021-23048

On BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.3, 13.1.x before 13.1.4.1, and all versions of 12.1.x and 11.6.x, when GPRS Tunneling Protocol GTP iRules commands or a GTP profile is configured on a virtual server, undisclosed GTP messages can cause the...

Cross site request forgery (csrf)

On BIG-IP Advanced WAF and BIG-IP ASM version 16.0.x before 16.0.1.2 and 15.1.x before 15.1.3 and NGINX App Protect on all versions before 3.5.0, when a cross-site request forgery CSRF-enabled policy is configured on a virtual server, an undisclosed HTML response may cause the bd process to...

Design/Logic Flaw

On BIG-IP versions 15.1.0.4 through 15.1.3, when the Data Plane Development Kit DPDK/Elastic Network Adapter ENA driver is used with BIG-IP on Amazon Web Services AWS systems, undisclosed requests can cause the Traffic Management Microkernel TMM to terminate. This is due to an incomplete fix for...

CVE-2021-23049

On BIG-IP version 16.0.x before 16.0.1.2 and 15.1.x before 15.1.3, when the iRules RESOLVER::summarize command is used on a virtual server, undisclosed requests can cause an increase in Traffic Management Microkernel TMM memory utilization resulting in an out-of-memory condition and a...

CVE-2021-23049

CVE-2021-23049 affects F5 BIG-IP: memory leak in TMM caused by undisclosed requests when the iRules RESOLVER::summarize command runs on a virtual server. The issue increases TMM memory usage, potentially leading to an out-of-memory condition and DoS. Affected versions are BIG-IP 16.0.x before 16....

CVE-2021-23048

On BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.3, 13.1.x before 13.1.4.1, and all versions of 12.1.x and 11.6.x, when GPRS Tunneling Protocol GTP iRules commands or a GTP profile is configured on a virtual server, undisclosed GTP messages can cause the...

CVE-2021-23048

CVE-2021-23048 is a TMM GTP vulnerability in BIG-IP. When a GTP iRules command or GTP profile is configured on a virtual server, undisclosed GTP messages can cause TMM to terminate, potentially causing DoS by restarting the TMM. Connected advisories confirm affected product/version ranges and exp...

CVE-2021-23050

CVE-2021-23050 affects BIG-IP Advanced WAF and BIG-IP ASM (and related NGINX App Protect) when a CSRF-enabled policy on a virtual server is configured. The vulnerability can cause the bd process to terminate due to an undisclosed HTML response, leading to DoS as described in vendor advisories. Af...

CVE-2021-23050

On BIG-IP Advanced WAF and BIG-IP ASM version 16.0.x before 16.0.1.2 and 15.1.x before 15.1.3 and NGINX App Protect on all versions before 3.5.0, when a cross-site request forgery CSRF-enabled policy is configured on a virtual server, an undisclosed HTML response may cause the bd process to...

CVE-2021-23053

On version 15.1.x before 15.1.3, 14.1.x before 14.1.3.1, and 13.1.x before 13.1.3.6, when the brute force protection feature of BIG-IP Advanced WAF or BIG-IP ASM is enabled on a virtual server and the virtual server is under brute force attack, the MySQL database may run out of disk space due to...

CVE-2021-23053

Summary (CVE-2021-23053): The vulnerability affects BIG-IP with Advanced WAF/ASM brute-force protection enabled on a virtual server. Under a brute-force attack, the MySQL database may exhaust disk space due to the absence of a row limit on undisclosed tables. Affected versions: BIG-IP 15.1.x befo...

CVE-2021-23052

On version 14.1.x before 14.1.4.4 and all versions of 13.1.x, an open redirect vulnerability exists on virtual servers enabled with a BIG-IP APM access policy. This vulnerability allows an unauthenticated malicious user to build an open redirect URI. Note: Software versions which have reached End...

CVE-2021-23052

CVE-2021-23052 affects BIG-IP APM: open redirect vulnerability on virtual servers with APM policy in BIG-IP versions 14.1.x before 14.1.4.4 and all 13.1.x. Unauthenticated attackers can craft a redirect URI. Official advisories confirm vulnerable branches and provide fixes: upgrade 14.x to 14.1.4...

CVE-2021-23051

On BIG-IP versions 15.1.0.4 through 15.1.3, when the Data Plane Development Kit DPDK/Elastic Network Adapter ENA driver is used with BIG-IP on Amazon Web Services AWS systems, undisclosed requests can cause the Traffic Management Microkernel TMM to terminate. This is due to an incomplete fix for...

CVE-2021-23051

CVE-2021-23051 affects BIG-IP on AWS when using the DPDK/ENA driver. The issue arises from an incomplete fix for CVE-2020-5862 and can cause the Traffic Management Microkernel (TMM) to terminate due to undisclosed requests, resulting in a DoS of the BIG-IP system. Affected versions: BIG-IP 15.1.0...

Apple releases emergency update: Patch, but don’t panic

Spyware developed by the company NSO Group is back in the news today after Apple released an emergency fix for iPhones, iPads, Macs, and Apple Watches. The update fixes a vulnerability silently exploited by software called Pegasus, which is often used in high-level surveillance campaigns by...

PT-2021-15376 · F5 · Big-Ip

Name of the Vulnerable Software and Affected Versions: BIG-IP versions 13.1.x through 13.1.3.6 BIG-IP versions 14.1.x through 14.1.3.1 BIG-IP versions 15.1.x through 15.1.3 Description: When the brute force protection feature of BIG-IP Advanced WAF or BIG-IP ASM is enabled on a virtual server and...

About the security content of macOS Big Sur 11.6

About the security content of macOS Big Sur 11.6 This document describes the security content of macOS Big Sur 11.6. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases...

PT-2021-18907 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to Big Sur 11.6 macOS Catalina versions prior to Security Update 2021-005 Description: A logic issue was addressed with improved state management, allowing a remote attacker to potentially leak memory. Recommendations: Fo...

CVE-2021-30719

A local user may be able to cause unexpected system termination or read kernel memory. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-003 Catalina. An out-of-bounds read issue was addressed by removing the vulnerable code...