CVE-2024-24989

CVE-2024-24989 affects NGINX Plus and NGINX Open Source when configured with the HTTP/3 QUIC module. The underlying issue is in the HTTP/3 QUIC module, which can cause NGINX worker processes to terminate, yielding a denial-of-service condition. The vulnerability is tied to the HTTP/3 QUIC module ...

CVE-2024-21763

CVE-2024-21763 affects BIG-IP AFM (part of BIG-IP) where when DoS or a DoS profile is configured with NXDOMAIN attack vectors and bad-actor detection, undisclosed queries can trigger a crash of the Traffic Management Microkernel (TMM), causing a DoS condition. The primary published details indica...

CVE-2024-21789

CVE-2024-21789 affects BIG-IP Advanced WAF/ASM; when a security policy is applied on a virtual server, undisclosed requests can cause a memory resource utilization spike, potentially degrading performance. Impact: DoS-like degradation without control plane exposure (data plane issue). Remediation...

CVE-2024-23308

CVE-2024-23308 affects BIG-IP Advanced WAF/ASM: when a policy with a Request Body Handling option is attached to a virtual server, certain requests can trigger a NULL dereference in the BD process, causing DoS by remote unauthenticated access. Impact is Denial of Service to traffic handling (data...

CVE-2024-23603

CVE-2024-23603 is an SQL injection in the BIG-IP Configuration utility, specifically in the BIG-IP Advanced WAF/ASM Configuration utility. A highly privileged authenticated attacker can exploit it to execute malicious SQL statements. Affected: BIG-IP Advanced WAF/ASM; vulnerable in 17.1.0 and 16....

CVE-2024-23314

CVE-2024-23314 affects BIG-IP and BIG-IP Next SPK when HTTP/2 is configured. Undisclosed responses can cause TMM to terminate, leading to DoS on the data plane. Remediations per F5 advisory K000137675: BIG-IP fixed in 17.1.1 (all modules); BIG-IP Next SPK fixed in 1.8.1. Confirm your branch/versi...

CVE-2024-24775

CVE-2024-24775 affects BIG-IP (all modules). When a virtual server is configured with VLAN group and an SNAT listener, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate, resulting in a DoS on the BIG-IP system. The issue is documented in F5 advisories; fixes are ...

CVE-2024-23306

CVE-2024-23306 affects BIG-IP Next CNF. An authenticated attacker with enough privileges can access undisclosed sensitive files, impacting confidentiality and integrity (CVSSv3 7.1). Vulnerable: BIG-IP Next CNF 1.1.0–1.1.1. Fix available in 1.2.0 per F5 advisory K000137886. Recommend upgrading to...

CVE-2024-21771

CVE-2024-21771 affects BIG-IP AFM where the IPS engine may spend excessive time matching traffic against signatures for unspecified traffic patterns, causing TMM to restart and traffic disruption. Public documents confirm impacted product is BIG-IP AFM with IPS/VPN features enabled under Protocol...

CVE-2024-21849

CVE-2024-21849 affects BIG-IP with Advanced WAF/ASM configured and a Websockets profile on a virtual server. The underlying issue is that undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate, leading to a DoS condition. The vulnerability is documented as affecting B...

CVE-2024-23607

CVE-2024-23607 affects F5OS QKView utility. An authenticated attacker can traverse directories to read files outside the QKView directory. Vulnerable: F5OS-QKView in F5OS-A (1.3.0–1.3.2) and F5OS-C (1.3.0–1.5.1) branches; fixed in F5OS-A 1.4.0 and F5OS-C 1.6.0 per K000132800/K000138353. CVSSv3 ba...

CVE-2024-21782

CVE-2024-21782 affects BIG-IP and BIG-IQ where Resource Administrators or Certificate Managers with scp access but no bash access can run arbitrary commands via a crafted command string. It stems from an incomplete fix for CVE-2020-5873. F5 documents that vulnerable BIG-IP/BIG-IQ versions include...

CVE-2024-22389

CVE-2024-22389 affects BIG-IP in HA deployments where updating an iControl REST API token fails to sync to the peer, a control-plane issue impacting confidentiality, integrity, and availability (CVSS v3.1 base 7.2). Affected releases and fixes: BIG-IP (all modules) vulnerable in 17.1.0; fix intro...

Design/Logic Flaw

Certain DNSSEC aspects of the DNS protocol in RFC 4033, 4034, 4035, 6840, and related RFCs allow remote attackers to cause a denial of service CPU consumption via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG...

CVE-2023-5122

Grafana is an open-source platform for monitoring and observability. The CSV datasource plugin is a Grafana Labs maintained plugin for Grafana that allows for retrieving and processing CSV data from a remote endpoint configured by an administrator. If this plugin was configured to send requests t...

Sql injection

Task Manager App v1.0 was discovered to contain a SQL injection vulnerability via the projectID parameter at /TaskManager/EditProject.php...

Sql injection

Employee Managment System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /delete.php...

Cross site scripting

A cross-site scripting XSS vulnerability in Simple Admin Panel App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Category Name parameter under the Add Category function...

Cross site scripting

A cross-site scripting XSS vulnerability in Task Manager App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Project Name parameter /TaskManager/Projects.php...

Cross site scripting

Barangay Population Monitoring System v1.0 was discovered to contain a cross-site scripting XSS vulnerability in the Add Resident function at /barangay-population-monitoring-system/masterlist.php. This vulnerabiity allows attackers to execute arbitrary web scripts or HTML via a crafted payload...