K000130496: Overview of F5 vulnerabilities (February 2023)

Security Advisory Description On February 1, 2023, F5 announced the following security issues. This document is intended to serve as an overview of these vulnerabilities and security exposures to help determine the impact to your F5 devices. You can find the details of each issue in the associate...

K000130415: iControl SOAP vulnerability CVE-2023-22374

Security Advisory Description A format string vulnerability exists in iControl SOAP that allows an authenticated attacker to crash the iControl SOAP CGI process or, potentially execute arbitrary code. In appliance mode BIG-IP, a successful exploit of this vulnerability can allow the attacker to...

F5 iControl SOAP elevation of privilege vulnerability

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. An elevation of privilege vulnerability exists in F5 iControl SOAP, which can be exploited by an authenticated attacker to...

F5 BIG-IP 格式化字符串错误漏洞

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. An elevation of privilege vulnerability exists in F5 iControl SOAP, which can be exploited by an authenticated attacker to...

PT-2023-2725 · NetGear · Netgear Rax30

Name of the Vulnerable Software and Affected Versions: NETGEAR RAX30 affected versions not specified Description: This issue allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR RAX30 routers. The flaw exists within the soap serverd binary, where the...

PT-2023-2729 · NetGear · Netgear Rax40 +4

Name of the Vulnerable Software and Affected Versions: NETGEAR RAX30 versions affected versions not specified NETGEAR RAX35 versions affected versions not specified NETGEAR RAX38 versions affected versions not specified NETGEAR RAX40 versions affected versions not specified NETGEAR RAXE300 versio...

PT-2023-2724 · NetGear · Netgear Rax30

Name of the Vulnerable Software and Affected Versions: NETGEAR RAX30 affected versions not specified Description: This issue allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR RAX30. Authentication is not required to exploit this issue. The specific...

Linksys WRT54GL Denial of Service Vulnerability

The Linksys WRT54GL is a wireless router from Linksys USA. A denial of service vulnerability exists in Linksys WRT54GL Wireless-G Broadband Router version 4.30.18.006 and prior versions, which stems from the presence of a null pointer dereference in the soapaction function in the upnp binary. An...

CVE-2022-43972

A null pointer dereference vulnerability exists in Linksys WRT54GL Wireless-G Broadband Router with firmware = 4.30.18.006. A null pointer dereference in the soapaction function within the upnp binary can be triggered by an unauthenticated attacker via a malicious POST request invoking the...

Linksys WRT54GL 代码问题漏洞

The Linksys WRT54GL is a wireless router from Linksys USA. A denial of service vulnerability exists in Linksys WRT54GL Wireless-G Broadband Router version 4.30.18.006 and prior versions, which stems from the presence of a null pointer dereference in the soapaction function in the upnp binary. An...

K97843387: Overview of F5 vulnerabilities (November 2022)

Security Advisory Description On November 16, 2022, F5 announced the following issues. This document is intended to serve as an overview of these issues to help determine the impact to your F5 devices. You can find the details of each issue in the associated articles. Distributed Cloud and Manage...

K94221585: iControl SOAP vulnerability CVE-2022-41622

Security Advisory Description BIG-IP and BIG-IQ are vulnerable to cross-site request forgery CSRF attacks through iControl SOAP. CVE-2022-41622 Impact An attacker may trick users who have at least resource administrator role privilege and are authenticated through basic authentication in iControl...

CVE-2022-41622

In all versions, BIG-IP and BIG-IQ are vulnerable to cross-site request forgery CSRF attacks through iControl SOAP. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

Cross site request forgery (csrf)

In all versions, BIG-IP and BIG-IQ are vulnerable to cross-site request forgery CSRF attacks through iControl SOAP. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2022-41622 iControl SOAP vulnerability

In all versions, BIG-IP and BIG-IQ are vulnerable to cross-site request forgery CSRF attacks through iControl SOAP. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2022-41622 iControl SOAP vulnerability

In all versions, BIG-IP and BIG-IQ are vulnerable to cross-site request forgery CSRF attacks through iControl SOAP. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2022-41622

CVE-2022-41622 is a cross-site request forgery (CSRF) vulnerability in iControl SOAP affecting BIG-IP and BIG-IQ. An authenticated user with resource administrator privileges can trick the user into performing actions on the control plane. Affected versions include BIG-IP (17.x up to 17.0.0.2; 16...

Spring WS Samples upgraded for Spring Boot 3.0!

With the recent announcement of Spring Boot 3.0 going GA, some of you may be interested in upgrading your Spring Web Services-based applications to take full advantage of this. The Spring WS team has upgraded our set of sample apps to help you carry that out. The main branch now tracks the versio...

The vulnerability of the iControl SOAP interface for access control and remote authentication in BIG-IP and server software, BIG-IQ Centralized Management, allows a perpetrator to execute arbitrary commands with elevated privileges.

The vulnerability of the iControl SOAP interface for access control and remote authentication in BIG-IP and server software, BIG-IQ Centralized Management, is related to the manipulation of inter-site requests. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands...

SUSE SLES12: apache2-mod_php74 / php74 / php74-bcmath / php74-bz2 / etc (SUSE-SU-2022:4068-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4068-1 advisory. - Version update to 7.4.33: - CVE-2022-31630: Fixed out-of-bounds read due to insufficient input validation in imageloadfont...