13912 matches found
CVE-2024-23805
Undisclosed requests can cause the Traffic Management Microkernel TMM to terminate. For the Application Visibility and Reporting module, this may occur when the HTTP Analytics profile with URLs enabled under Collected Entities is configured on a virtual server and the DB variables...
CVE-2024-21789
When a BIG-IP ASM/Advanced WAF security policy is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...
CVE-2024-21849
When an Advanced WAF/ASM security policy and a Websockets profile are configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel TMM process to terminate. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...
PT-2024-19057
Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions affected versions not specified Description When a BIG-IP ASM/Advanced WAF security policy is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Recommendations At the...
F5 BIG-IP Security Vulnerabilities
F5 BIG-IP is an application delivery platform that integrates network traffic management, application security management, and load balancing from F5 USA. A security vulnerability exists in F5 BIG-IP that originates when configuring BIG-IP ASM/Advanced WAF security policy on a virtual server, whe...
PT-2024-19042 · F5 · Big-Ip Afm
Name of the Vulnerable Software and Affected Versions: BIG-IP AFM affected versions not specified Description: When BIG-IP AFM Device DoS or DoS profile is configured with NXDOMAIN attack vector and bad actor detection, undisclosed queries can cause the Traffic Management Microkernel TMM to...
F5 BIG-IP Security Vulnerabilities
F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, and load balancing. A security vulnerability exists in F5 BIG-IP that stems from undisclosed traffic that could cause the Traffic Management Microkernel TMM proce...
F5 BIG-IP AFM Security Vulnerability
F5 BIG-IP AFM is an advanced firewall product for protection against DDos attacks from F5 USA. A security vulnerability exists in the F5 BIG-IP AFM that stems from the fact that for unspecified traffic patterns, the BIG-IP AFM IPS engine may take an excessive amount of time to match traffic to...
PT-2024-19045 · F5 · Big-Ip Afm
Name of the Vulnerable Software and Affected Versions: BIG-IP AFM affected versions not specified Description: The BIG-IP AFM IPS engine may spend an excessive amount of time matching unspecified traffic patterns against signatures, resulting in Traffic Management Microkernel TMM restarting and...
First Microsoft Patch Tuesday zero-day of 2024 disclosed as part of group of 75 vulnerabilities
Microsoft followed up one of the lightest recent Patch Tuesdays in January with a large release of vulnerabilities on Tuesday, although still far from numbers seen in the past. In all, Februarys security update from Microsoft includes 75 vulnerabilities, three of which are considered critical...
Mitsubishi Electric MELSEC iQ-R Series Safety CPU and SIL2 Process CPU (Update A)
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 6.5 ATTENTION : Exploitable remotely/low attack complexity Vendor : Mitsubishi Electric Equipment : MELSEC iQ-R Series Safety CPU and SIL2 Process CPU Vulnerability : Incorrect Privilege Assignment 2. RISK EVALUATION Successful exploitation of this...
Siemens RUGGEDCOM APE1808
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories CERT Services | Services |...
kernel: netfilter: nf_conntrack_irc message handling issue
A flaw was found in the Linux kernel in nfconntrackirc where the message handling can be confused and it incorrectly matches on the message. An attacker could exploit this vulnerability to bypass firewall when users are using unencrypted IRC with nfconntrackirc configured...
CVE-2024-1037
The CVE-2024-1037 entry concerns All-In-One Security (AIOS) for WordPress, affecting versions up to 5.2.5. The vulnerability is a Reflected Cross-Site Scripting via the tab parameter caused by insufficient input sanitization and output escaping, enabling unauthenticated attackers to inject web sc...
Multiple out-of-bounds write vulnerabilities in Canon Office/Small Office Multifunction Printers and Laser Printers
Overview Office/Small Office Multifunction Printers and Laser Printers provided by Canon Inc. contain multiple out-of-bounds write vulnerabilities CWE-787, CVE-2023-6229, CVE-2023-6230, CVE-2023-6231, CVE-2023-6232, CVE-2023-6233, CVE-2023-6234, CVE-2024-0244. Canon Inc. reported these...
Cisco Expressway Series 跨站请求伪造漏洞
Cisco Expressway Series is a software for accessing devices outside the firewall from Cisco USA. A cross-site request forgery vulnerability exists in Cisco Expressway Series, which can be exploited by an attacker to modify sensitive information or perform unauthorized operations...
WordPress All In One WP Security & Firewall Plugin <= 5.2.5 is vulnerable to Cross Site Scripting (XSS)
Software All In One WP Security & Firewall Type Plugin Vulnerable versions = 5.2.5 Fixed in 5.2.6 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-1037 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 4309b2ee38ec Credits stealthcopter...
The vulnerability of the ModSecurity security module for protecting web applications arises from insufficient validation of input data. This allows attackers to bypass the WAF rules.
The vulnerability of the ModSecurity security module for protecting web applications exists due to insufficient validation of input data when processing URL addresses. Exploiting this vulnerability can allow a malicious actor to bypass WAF rules...
Security Bulletin: IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) may be vulnerable to HTTP request smuggling (CVE-2023-46589)
Summary Due to the use of Apache Tomcat, IBM DevOps Deploy / IBM UrbanCode Deploy UCD is vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP trailer headers. By sending a specially crafted HTTPS trailer header, an attacker could exploit this vulnerability to poison the we...