85 matches found
K11186236: Linux kernel KVM subsystem vulnerability CVE-2019-6974
Security Advisory Description In the Linux kernel before 4.20.8, kvmioctlcreatedevice in virt/kvm/kvmmain.c mishandles reference counting because of a race condition, leading to a use-after-free. CVE-2019-6974 Impact BIG-IP An attacker may use this vulnerability to cause a vCMP guest to crash,...
F5 Traffix SDC Cross-Site Scripting Vulnerability
The F5 Traffix Signaling Delivery Controller F5 Traffix SDC is a signaling delivery controller from F5, Inc. It is used to provide operators with total connectivity, unlimited scalability and total control. A cross-site scripting vulnerability exists in F5 Traffix SDC, which can be exploited by a...
Vulnerabilities fixed in F5 products
Vulnerabilities have been fixed in products from F5, including BIG-IP and Traffix SDC. The vulnerabilities allow a malicious able to launch attacks that result in the following categories of damage: Cross-Site Request Forgery XSRF. Cross-Site Scripting XSS Denial-of-Service DoS. Manipulation of...
CVE-2022-27880
On F5 Traffix SDC 5.2.x versions prior to 5.2.2 and 5.1.x versions prior to 5.1.35, a stored Cross-Site Scripting XSS vulnerability exists in an undisclosed page of the Traffix SDC Configuration utility that allows an attacker to execute JavaScript in the context of the currently logged-in user...
CVE-2022-27880
On F5 Traffix SDC 5.2.x versions prior to 5.2.2 and 5.1.x versions prior to 5.1.35, a stored Cross-Site Scripting XSS vulnerability exists in an undisclosed page of the Traffix SDC Configuration utility that allows an attacker to execute JavaScript in the context of the currently logged-in user...
Cross site scripting
On F5 Traffix SDC 5.2.x versions prior to 5.2.2 and 5.1.x versions prior to 5.1.35, a stored Cross-Site Template Injection vulnerability exists in an undisclosed page of the Traffix SDC Configuration utility that allows an attacker to execute template language-specific instructions in the context...
Cross site scripting
On F5 Traffix SDC 5.2.x versions prior to 5.2.2 and 5.1.x versions prior to 5.1.35, a stored Cross-Site Scripting XSS vulnerability exists in an undisclosed page of the Traffix SDC Configuration utility that allows an attacker to execute JavaScript in the context of the currently logged-in user...
CVE-2022-27880
CVE-2022-27880 (F5 Traffix SDC) : A stored Cross-Site Scripting (XSS) vulnerability exists in an undisclosed page of the Traffix SDC Configuration utility. Affected versions are 5.2.x prior to 5.2.2 and 5.1.x prior to 5.1.35. An authenticated attacker can store malicious HTML/JavaScript that exec...
CVE-2022-27880
On F5 Traffix SDC 5.2.x versions prior to 5.2.2 and 5.1.x versions prior to 5.1.35, a stored Cross-Site Scripting XSS vulnerability exists in an undisclosed page of the Traffix SDC Configuration utility that allows an attacker to execute JavaScript in the context of the currently logged-in user...
CVE-2022-27662
CVE-2022-27662 affects F5 Traffix SDC: stored Cross-Site Template Injection in the Traffix SDC Configuration utility. Affected versions are 5.2.x prior to 5.2.2 and 5.1.x prior to 5.1.35. The underlying issue enables an attacker to execute template language-specific instructions in the server con...
CVE-2022-27662
On F5 Traffix SDC 5.2.x versions prior to 5.2.2 and 5.1.x versions prior to 5.1.35, a stored Cross-Site Template Injection vulnerability exists in an undisclosed page of the Traffix SDC Configuration utility that allows an attacker to execute template language-specific instructions in the context...
CVE-2022-27662
On F5 Traffix SDC 5.2.x versions prior to 5.2.2 and 5.1.x versions prior to 5.1.35, a stored Cross-Site Template Injection vulnerability exists in an undisclosed page of the Traffix SDC Configuration utility that allows an attacker to execute template language-specific instructions in the context...
F5 Networks BIG-IP : ImageMagick vulnerability (K03512441)
ImageMagick before 7.0.8-50 has an integer overflow vulnerability in the function TIFFSeekCustomStream in coders/tiff.c. CVE-2019-13136 Impact BIG-IP AAM,Edge Gateway, WebAccelerator This issue affects BIG-IP systems only when WAM or AAM is provisioned.If exploited, this vulnerability may result ...
F5 Networks BIG-IP : ImageMagick vulnerability (K20336394)
ImageMagick before 7.0.8-50 has a 'use of uninitialized value' vulnerability in the function ReadCUTImage in coders/cut.c. CVE-2019-13135 Impact BIG-IP AAM,Edge Gateway, and WebAccelerator This issue affects BIG-IP systems only when WAM or AAM is provisioned. If exploited, this vulnerabilitymay...
F5 Networks BIG-IP : BIG-IP MRF Diameter vulnerability (K55812535)
TheTraffic Management Microkernel TMM might stop responding after the total number of diameter connections and pending messages on a single virtual server has reached 32K. CVE-2019-6686 Impact BIG-IP This vulnerability affects only virtual servers associated with the message routing diameter...
F5 Networks BIG-IP : BIG-IP vulnerability (K25607522)
A user can obtain the secretused to encrypt a BIG-IP UCS backup file while sending an SNMP query to the BIG-IP or BIG-IQ system;however, the user cannot access the UCS files. CVE-2019-6688 Impact BIG-IP and BIG-IQ The SNMP user can obtain the secret used to encrypt the BIG-IP UCS backup file...
F5 Networks BIG-IP : Linux SACK Slowness vulnerability (K26618426)
Jonathan Looney discovered that the TCP retransmission queue implementation in tcpfragment in the Linux kernel could be fragmented when handling certain TCP Selective Acknowledgment SACK sequences. A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel...
F5 Networks BIG-IP : Linux SACK Panic vulnerability (K78234183)
Jonathan Looney discovered that the TCPSKBCBskb-tcpgsosegs value was subject to an integer overflow in the Linux kernel when handling TCP Selective Acknowledgments SACKs. A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182,...
F5 Networks BIG-IP : Excess resource consumption due to low MSS values vulnerability (K35421172)
Jonathan Looney discovered that the Linux kernel default MSS is hard-coded to 48 bytes. This allows a remote peer to fragment TCP resend queues significantly more than if a larger MSS were enforced. A remote attacker could use this to cause a denial of service. This has been fixed in stable kerne...
F5 Networks BIG-IP : F5 tmsh vulnerability (K40378764)
"Authenticated users with the ability to upload files via scp, for example can escalate their privileges to allow root shell access from within the TMOS Shell tmsh interface. The tmsh interface allows users to execute a secondary program via tools like sftp or scp . CVE-2019-6642 Impact...