Exploit for HTTP Request Smuggling in F5 Nginx

CVE-2019-20372 This repository is for educational purposes o...

K000136153: cURL vulnerability CVE-2023-23914

Security Advisory Description A cleartext transmission of sensitive information vulnerability exists in curl. CVE-2023-23914 Impact There is no impact; F5 products are not affected by this vulnerability. Security Advisory Status F5 Product Development has evaluated the currently supported release...

K000136109: PHP SQLite vulnerability CVE-2022-31631

Security Advisory Description In PHP versions 8.0. before 8.0.27, 8.1. before 8.1.15, 8.2. before 8.2.2 when using PDO::quote function to quote user-supplied data for SQLite, supplying an overly long string may cause the driver to incorrectly quote the data, which may further lead to SQL injectio...

K000136079: Redis vulnerability CVE-2022-0543

Security Advisory Description It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a Debian-specific Lua sandbox escape, which could result in remote code execution. CVE-2022-0543 Impact There is no impact; F5 products are not affected by this...

K000136011: Apache Tomcat Open Redirect vulnerability CVE-2023-41080

Security Advisory Description URL Redirection to Untrusted Site 'Open Redirect' vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0.0-M1 through 9.0.79 and from 8.5.0 through 8.5.9...

K000135996: Intel RDMA Ethernet Controller vulnerability CVE-2023-25775

Security Advisory Description Improper access control in the IntelR Ethernet Controller RDMA driver for linux before version 1.9.30 may allow an unauthenticated user to potentially enable escalation of privilege via network access. CVE-2023-25775 Impact There is no impact; F5 products are not...

K000135921: Python urllib.parse vulnerability CVE-2023-24329

Security Advisory Description An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters. CVE-2023-24329 Impact F5 products do not ship with Python scripts that utilize the affected Python...

F5 Networks BIG-IP : Python urllib.parse vulnerability (K000135921)

The version of F5 Networks BIG-IP installed on the remote host is prior to 17.1.3 / 17.5.1. It is, therefore, affected by a vulnerability as referenced in the K000135921 advisory. An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by...

F5 Networks BIG-IP : VMware Tools vulnerability (K87046687)

The version of F5 Networks BIG-IP installed on the remote host is prior to 15.1.9 / 16.1.4 / 17.1.0. It is, therefore, affected by a vulnerability as referenced in the K87046687 advisory. VMware Tools 12.0.0, 11.x.y and 10.x.y contains a local privilege escalation vulnerability. A malicious actor...

K000135880: glibc vulnerability CVE-2023-25139

Security Advisory Description sprintf in the GNU C Library glibc 2.37 has a buffer overflow out-of-bounds write in some situations with a correct buffer size. This is unrelated to CWE-676. It may write beyond the bounds of the destination buffer when attempting to write a padded,...

K000135853: Dell BSAFE Micro Edition vulnerability CVE-2020-35168

Security Advisory Description Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Observable Timing Discrepancy Vulnerability. CVE-2020-35168 Impact There is no impact; F5 products are not affected by this vulnerability...

F5 Networks BIG-IP : SCP vulnerability (K04305530)

The version of F5 Networks BIG-IP installed on the remote host is prior to 15.1.10.8 / 16.1.6.1 / 17.1.3.1 / 17.5.1. It is, therefore, affected by a vulnerability as referenced in the K04305530 advisory. scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as...

K000135795: Downfall Attacks CVE-2022-40982

Security Advisory Description Information exposure through microarchitectural state after transient execution in certain vector execution units for some IntelR Processors may allow an authenticated user to potentially enable information disclosure via local access. CVE-2022-40982 Impact Successfu...

F5 BIG-IP (APM) Elevation of Privilege Vulnerability

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing and other functions. F5 BIG-IP APM elevation of privilege vulnerability, which is caused by incorrect verification of cryptographic signatures duri...

F5 BIG-IP Information Disclosure Vulnerability (CNVD-2023-82304)

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing and other functions. An information disclosure vulnerability exists in F5 BIG-IP, which can be exploited by attackers to obtain sensitive informati...

F5 BIG-IP Cross-Site Scripting Vulnerability (CNVD-2023-82301)

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing and other functions. A cross-site scripting vulnerability exists in F5 BIG-IP, which can be exploited by an attacker to steal a victim's cookie-bas...

F5 BIG-IP Data Forgery Issue Vulnerability

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing and other functions. A data forgery issue vulnerability exists in the F5 BIG-IP Edge Client, which stems from the presence of insufficient data...

F5 BIG-IP and BIG-IQ Centralized Management Denial of Service Vulnerability

F5 BIG-IP is an application delivery platform that integrates network traffic management, application security management, load balancing, etc. F5 BIG-IQ Centralized Management is a software-based cloud management solution from F5 USA. The solution supports the deployment of application delivery...

CVE-2023-3470

Specific F5 BIG-IP platforms with Cavium Nitrox FIPS HSM cards generate a deterministic password for the Crypto User account. The predictable nature of the password allows an authenticated user with TMSH access to the BIG-IP system, or anyone with physical access to the FIPS HSM, the information...

Default credentials

Specific F5 BIG-IP platforms with Cavium Nitrox FIPS HSM cards generate a deterministic password for the Crypto User account. The predictable nature of the password allows an authenticated user with TMSH access to the BIG-IP system, or anyone with physical access to the FIPS HSM, the information...