Lucene search
+L

6691 matches found

F5 Networks
F5 Networks
•added 2015/07/01 12:00 a.m.•54 views

SOL16840 - SSH vulnerability CVE-1999-1085

OpenSSH supports the use of the SSH1 protocol; however, it is not enabled in default configurations. SSH1 can only be enabled by manually editing the OpenSSH configuration file. Note: As of February 17, 2015, AskF5 Security Advisory articles include the Severity value. Security Advisory articles...

5CVSS0.6AI score0.03211EPSS
SaveExploits0References6
F5 Networks
F5 Networks
•added 2015/07/01 12:00 a.m.•54 views

SOL16859 - SUSE coreutils vulnerabilities CVE-2013-0221, CVE-2013-0222, and CVE-2013-0223

Vulnerability Recommended Actions If the previous table lists a version in the Versions known to be not vulnerable column, you can eliminate this vulnerability by upgrading to the listed version. If the listed version is older than the version you are currently running, or if the table does not...

4.3CVSS1.9AI score0.07238EPSS
SaveExploits3References5
F5 Networks
F5 Networks
•added 2015/04/03 12:00 a.m.•54 views

SOL16355 - Multiple MySQL vulnerabilities

Vulnerability Recommended Actions If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in the Versions known to be not vulnerable column. If the table lists only an older version than what you are...

7.5CVSS3.3AI score0.10066EPSS
SaveExploits0References4
F5 Networks
F5 Networks
•added 2015/04/03 12:00 a.m.•54 views

SOL16318 - OpenSSL vulnerability CVE-2015-0287

Recommended Action If the previous table lists a version in the Versions known to be not vulnerable column, you can eliminate this vulnerability by upgrading to the listed version. If the listed version is older than the version you are currently running, or if the table does not list any version...

5CVSS1.2AI score0.0837EPSS
SaveExploits0References3
F5 Networks
F5 Networks
•added 2015/04/02 12:00 a.m.•54 views

SOL16341 - Linux kernel Controller Area Network (CAN) vulnerability CVE-2010-2959

Recommended Action If the previous table lists a version in the Versions known to be not vulnerable column, you can eliminate this vulnerability by upgrading to the listed version. If the listed version is older than the version you are currently running, or if the table does not list any version...

7.2CVSS2.1AI score0.03746EPSS
SaveExploits6References2
F5 Networks
F5 Networks
•added 2014/12/18 12:00 a.m.•54 views

SOL15920 - Apache vulnerability CVE-2011-0419

Recommended Action If the previous table lists a version in the Versions known to be not vulnerable column, you can eliminate this vulnerability by upgrading to the listed version. If the table does not list any version in the column, then no upgrade candidate currently exists. BIG-IP and...

4.3CVSS2.3AI score0.30406EPSS
SaveExploits5References9
F5 Networks
F5 Networks
•added 2014/11/27 12:00 a.m.•54 views

SOL15875 - cURL vulnerability CVE-2013-1944

Recommended action If the previous table lists a version in the Versions known to be not vulnerable column, you can eliminate this vulnerability by upgrading to the listed version. If the table does not list any version in the column, then no upgrade candidate currently exists. To mitigate this...

5CVSS2.1AI score0.04336EPSS
SaveExploits1References5
F5 Networks
F5 Networks
•added 2014/09/05 12:00 a.m.•54 views

SOL15566 - Kerberos vulnerability CVE-2014-4345

Vulnerability Recommended Actions If the previous table lists a version in the Versions known to be not vulnerable column, you can eliminate this vulnerability by upgrading to the listed version. If the table does not list any version in the column, then no upgrade candidate currently exists...

8.5CVSS2AI score0.08085EPSS
SaveExploits0References4
F5 Networks
F5 Networks
•added 2014/07/17 12:00 a.m.•54 views

SOL15429 - Apache Tomcat vulnerability CVE-2014-0119

Recommended Action If the previous table lists a version in the Versions known to be not vulnerable column, you can eliminate this vulnerability by upgrading to the listed version. If the table does not list any version in the column, or does not list a version that is higher than the version you...

4.3CVSS0.6AI score0.07616EPSS
SaveExploits0References4
F5 Networks
F5 Networks
•added 2014/04/17 12:00 a.m.•54 views

SOL15172 - BIND vulnerability CVE-2010-3762

F5 Product Development has determined that these BIG-IP and Enterprise Manager versions use a vulnerable version of BIND. However, the vulnerable code is not used by default on these BIG-IP or Enterprise Manager systems. These products are only vulnerable if BIND was manually configured...

4.3CVSS2.9AI score0.08086EPSS
SaveExploits0References8
F5 Networks
F5 Networks
•added 2013/02/21 12:00 a.m.•54 views

SOL14236 - OpenSSL vulnerability CVE-2012-2686

Recommended action None Supplemental Information Common Vulnerabilities and Exposures CVE-2012-2686 Note: This link takes you to a resource outside of AskF5, and it is possible that the documents may be removed without our knowledge. SOL9970: Subscribing to email notifications regarding F5 produc...

5CVSS7.4AI score0.39593EPSS
SaveExploits2References5
F5 Networks
F5 Networks
•added 2009/02/24 12:00 a.m.•54 views

SOL9754 - BIND 9 vulnerability CVE-2009-0025

BIND does not properly check the return value from the OpenSSL DSAverify function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature. Information about this advisory is available at the following location: Note: The previous link takes y...

7.5CVSS7.3AI score0.0686EPSS
SaveExploits1
F5 Networks
F5 Networks
•added 2008/09/01 12:00 a.m.•54 views

SOL9110 - Apache Tomcat information disclosure vulnerability - CVE-2008-2370

Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attacks and read arbitrary files through a...

5CVSS7.3AI score0.52716EPSS
SaveExploits2
F5 Networks
F5 Networks
•added 2007/05/16 12:00 a.m.•54 views

SOL5278 - Apache mod_ssl SSLVerifyClient bypass - CAN-2005-2700

Apache modssl SSLVerifyClient bypass vulnerability CAN-2005-2700. Information about this advisory is available at the following location:...

10CVSS1.2AI score0.30576EPSS
SaveExploits0
F5 Networks
F5 Networks
•added 2007/05/16 12:00 a.m.•54 views

SOL2355 - Timing attacks on RSA private keys - CAN-2003-0147

Information about this advisory can be found at the following location: Note: This link takes you to a resource outside of AskF5, and it is possible that the information may be removed without our knowledge...

5CVSS2.8AI score0.06393EPSS
SaveExploits0
F5 Networks
F5 Networks
•added 2025/03/20 8:24 p.m.•53 views

K000150484: Apache Tomcat vulnerability CVE-2025-24813

Security Advisory Description Path Equivalence: 'file . Name' Internal Dot leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through...

10CVSS10AI score0.99927EPSS
SaveExploits51Affected Software1
F5 Networks
F5 Networks
•added 2024/12/19 11:43 p.m.•53 views

K000149074: ZeroMQ vulnerabilities CVE-2014-9721 and CVE-2021-20236

Security Advisory Description CVE-2014-9721 libzmq before 4.0.6 and 4.1.x before 4.1.1 allows remote attackers to conduct downgrade attacks and bypass ZMTP v3 protocol security mechanisms via a ZMTP v2 or earlier header. CVE-2021-20236 A flaw was found in the ZeroMQ server in versions before 4.3....

9.8CVSS8.7AI score0.02511EPSS
SaveExploits0
F5 Networks
F5 Networks
•added 2024/10/16 7:20 a.m.•53 views

K000141470: Apache Tomcat vulnerabilities CVE-2024-23672 and CVE-2024-24549

Security Advisory Description CVE-2024-23672 Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption.This issue affects Apache Tomcat: from 11.0.0-M1 through...

7.5CVSS7.7AI score0.23072EPSS
SaveExploits1
F5 Networks
F5 Networks
•added 2024/09/17 9:59 p.m.•53 views

K000141099: Curl vulnerability CVE-2024-8096

Security Advisory Description When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine. If the returned...

6.5CVSS7.4AI score0.00729EPSS
SaveExploits1
F5 Networks
F5 Networks
•added 2024/09/02 8:43 a.m.•53 views

K000140910: MySQL Server vulnerability CVE-2024-21177

Security Advisory Description Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.37 and prior and 8.4.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple...

6.5CVSS6.3AI score0.0076EPSS
SaveExploits0
F5 Networks
F5 Networks
•added 2024/08/19 12:28 a.m.•53 views

K000140735: Oracle MySQL vulnerabilities CVE-2024-21160, CVE-2024-21162, and CVE-2024-21173

Security Advisory Description Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to...

4.9CVSS5.2AI score0.0085EPSS
SaveExploits0
F5 Networks
F5 Networks
•added 2024/06/05 4:13 p.m.•53 views

K000139917: Libxml2 vulnerability CVE-2022-40303

Security Advisory Description An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XMLPARSEHUGE parser option enabled, several integer counters can overflow. This results in an attempt to access an array at a negative 2GB offset, typically leading ...

7.5CVSS6.7AI score0.22791EPSS
SaveExploits2
F5 Networks
F5 Networks
•added 2024/05/16 3:14 a.m.•53 views

K000139637: Expat vulnerability CVE-2024-28757

Security Advisory Description libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers created via XMLExternalEntityParserCreate. CVE-2024-28757 Impact An attacker may be able to use an XML Entity Expansion attack, consuming all system resources...

7.5CVSS7.2AI score0.02006EPSS
SaveExploits1Affected Software12
F5 Networks
F5 Networks
•added 2024/05/10 1:34 p.m.•53 views

K000139579: Node.js vulneraility CVE-2024-21891

Security Advisory Description Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions, which can be overwitten with user-defined implementations leading to filesystem permission model bypass through path traversal attack. This vulnerability affects...

8.8CVSS7AI score0.01245EPSS
SaveExploits0
F5 Networks
F5 Networks
•added 2024/05/10 1:29 p.m.•53 views

K000139578: Node.js vulnerability CVE-2024-21896

Security Advisory Description The permission model protects itself against path traversal attacks by calling path.resolve on any paths given by the user. If the path is to be treated as a Buffer, the implementation uses Buffer.from to obtain a Buffer from the result of path.resolve. By...

9.8CVSS6.9AI score0.01262EPSS
SaveExploits0
F5 Networks
F5 Networks
•added 2024/05/10 8:34 a.m.•53 views

K000139570: UNIX CPIO vulnerability CVE-2023-7216

Security Advisory Description A path traversal vulnerability was found in the CPIO utility. This issue could allow a remote unauthenticated attacker to trick a user into opening a specially crafted archive. During the extraction process, the archiver could follow symlinks outside of the intended...

5.3CVSS5.5AI score0.00899EPSS
SaveExploits1
F5 Networks
F5 Networks
•added 2024/05/08 1:15 p.m.•53 views

K000138636: BIG-IP Configuration utility XSS vulnerability CVE-2024-31156

Security Advisory Description A stored cross-site scripting XSS vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user. CVE-2024-31156 Impact An authenticated attacker may exploit thi...

8CVSS5.5AI score0.00582EPSS
SaveExploits0Affected Software12
F5 Networks
F5 Networks
•added 2024/05/08 12:51 p.m.•53 views

K000138733: BIG-IP Next Central Manager SQL Injection vulnerability CVE-2024-26026

Security Advisory Description An SQL injection vulnerability exists in the BIG-IP Next Central Manager API URI. CVE-2024-26026 Impact An unauthenticated attacker can exploit this vulnerability to execute malicious SQL statements through the BIG-IP Next Central Manager API URI. This vulnerability...

7.5CVSS9.9AI score0.07163EPSS
SaveExploits0
F5 Networks
F5 Networks
•added 2024/04/30 7:07 a.m.•53 views

K000139446: Oracle Java vulnerability CVE-2024-21005

Security Advisory Description Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JavaFX. Supported versions that are affected are Oracle Java SE: 8u401; Oracle GraalVM Enterprise Edition: 20.3.13 and 21.3.9. Difficult to exploit vulnerabili...

3.1CVSS5.8AI score0.00853EPSS
SaveExploits0
F5 Networks
F5 Networks
•added 2024/04/10 2:47 p.m.•53 views

K000139225: nghttp2 vulnerability CVE-2024-28182

Security Advisory Description nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync. This causes...

5.3CVSS7.5AI score0.8496EPSS
SaveExploits1
F5 Networks
F5 Networks
•added 2024/02/23 7:29 p.m.•53 views

K000138704: Multiple MySQL vulnerabilities

Security Advisory Description CVE-2024-20964 Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Security: Privileges. Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Difficult to exploit vulnerability allows low privileged attacker with...

5.3CVSS4.2AI score0.01096EPSS
SaveExploits0
F5 Networks
F5 Networks
•added 2024/02/16 10:06 p.m.•53 views

K000138640: Perl vulnerability CVE-2023-47038

Security Advisory Description A vulnerability was found in perl. This issue occurs when a crafted regular expression is compiled by perl, which can allow an attacker controlled byte buffer overflow in a heap allocated buffer. CVE-2023-47038 Impact This vulnerability could allow a local...

7.8CVSS7.2AI score0.00814EPSS
SaveExploits0Affected Software8
F5 Networks
F5 Networks
•added 2024/02/14 1:14 p.m.•53 views

K32544615: BIG-IP iControl REST API vulnerability CVE-2024-22389

Security Advisory Description When BIG-IP is deployed in high availability HA and an iControl REST API token is updated, the change does not sync to the peer device. CVE-2024-22389 Impact This vulnerability may allow a high privileged remote authenticated attacker to use deleted or updated API...

7.2CVSS6.9AI score0.00497EPSS
SaveExploits0Affected Software12
F5 Networks
F5 Networks
•added 2023/04/28 7:58 a.m.•53 views

K000133699: Oracle WebLogic Server vulnerabilities CVE-2023-21964, CVE-2023-21979, and CVE-2023-21996

Security Advisory Description CVE-2023-21964 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with netwo...

7.5CVSS7.6AI score0.00842EPSS
SaveExploits0
F5 Networks
F5 Networks
•added 2023/04/27 4:23 p.m.•53 views

K000133686: protobuf-java vulnerability CVE-2021-22569

Security Advisory Description An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects...

7.5CVSS6.5AI score0.01669EPSS
SaveExploits1
F5 Networks
F5 Networks
•added 2023/03/13 4:46 p.m.•53 views

K000132946: OpenSSL vulnerability CVE-2023-0215

Security Advisory Description The public API function BIOnewNDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by end user applications. The...

7.5CVSS7AI score0.04494EPSS
SaveExploits0Affected Software16
F5 Networks
F5 Networks
•added 2023/02/21 8:02 p.m.•53 views

K75532331: iRulesLX debug NodeJS vulnerability CVE-2019-6644

Security Advisory Description Similar to the issue identified in CVE-2018-12120, the BIG-IP system will bind a debug nodejs process to all interfaces when invoked. This may expose the process to unauthorized users if the plugin is left in debug mode and the port is accessible. CVE-2019-6644 Impac...

9.4CVSS8.1AI score0.01404EPSS
SaveExploits0Affected Software13
F5 Networks
F5 Networks
•added 2023/02/21 8:02 p.m.•53 views

K25607522: BIG-IP vulnerability CVE-2019-6688

Security Advisory Description A user can obtain the secret used to encrypt a BIG-IP UCS backup file while sending an SNMP query to the BIG-IP or BIG-IQ system; however, the user cannot access the UCS files. CVE-2019-6688 Impact BIG-IP and BIG-IQ The SNMP user can obtain the secret used to encrypt...

4.3CVSS5AI score0.00697EPSS
SaveExploits0Affected Software14
F5 Networks
F5 Networks
•added 2023/02/21 8:02 p.m.•53 views

K93960557: Linux kernel vulnerability CVE-2018-5953

Security Advisory Description The swiotlbprintinfo function in lib/swiotlb.c in the Linux kernel through 4.14.14 allows local users to obtain sensitive address information by reading dmesg data from a "software IO TLB" printk call. CVE-2018-5953 Impact There is no impact; F5 products are not...

5.5CVSS5.7AI score0.00401EPSS
SaveExploits0
F5 Networks
F5 Networks
•added 2023/02/21 8:02 p.m.•53 views

K91245485: RSA-CRT key leak vulnerability CVE-2015-5738

Security Advisory Description The RSA-CRT implementation in the Cavium Software Development Kit SDK 2.x, when used on OCTEON II CN6xxx Hardware on Linux to support TLS with Perfect Forward Secrecy PFS, makes it easier for remote attackers to obtain private RSA keys by conducting a Lenstra...

7.5CVSS4.6AI score0.02425EPSS
SaveExploits0Affected Software1
F5 Networks
F5 Networks
•added 2023/02/21 8:02 p.m.•53 views

K42027747: BIG-IP SNMP vulnerability CVE-2018-15328

Security Advisory Description The passphrases for SNMPv3 users and trap destinations that are used for authentication and privacy are not handled by the BIG-IP system Secure Vault feature; they are written in the clear to the various configuration files. CVE-2018-15328 Note : The BIG-IP system...

7.5CVSS7AI score0.02306EPSS
SaveExploits0
F5 Networks
F5 Networks
•added 2023/02/21 8:02 p.m.•53 views

K22206205: Intel vulnerabilities CVE-2020-0548 CVE-2020-0549

Security Advisory Description CVE-2020-0548 Cleanup errors in some data cache evictions for some IntelR Processors may allow an authenticated user to potentially enable information disclosure via local access. CVE-2020-0549 Cleanup errors in some IntelR Processors may allow an authenticated user ...

5.5CVSS5.9AI score0.00564EPSS
SaveExploits0
F5 Networks
F5 Networks
•added 2023/02/21 8:02 p.m.•53 views

K15423: GNU Libtasn1 vulnerabilities CVE-2014-3467 and CVE-2014-3468

Security Advisory Description GNU Libtasn1 has been cited with the following vulnerabilities, which may be exploitable on some F5 products: CVE-2014-3467 Multiple unspecified vulnerabilities in the DER decoder in GNU Libtasn1 before 3.6, as used in GnutTLS, allow remote attackers to cause a denia...

7.5CVSS6.8AI score0.068EPSS
SaveExploits0Affected Software1
F5 Networks
F5 Networks
•added 2023/02/21 8:02 p.m.•53 views

K22505850: BIG-IP and BIG-IQ iControl REST vulnerability CVE-2022-41770

Security Advisory Description An authenticated iControl REST user can cause an increase in memory resource utilization, through undisclosed requests. CVE-2022-41770 Impact BIG-IP and BIG-IQ System performance degradation can occur until the process is either forced to restart or manually restarte...

6.5CVSS6.4AI score0.00635EPSS
SaveExploits0Affected Software14
F5 Networks
F5 Networks
•added 2023/02/21 8:00 p.m.•53 views

K40564589: PHP vulnerability CVE-2016-7126

Security Advisory Description The imagetruecolortopalette function in ext/gd/gd.c in PHP before 5.6.25 and 7.x before 7.0.10 does not properly validate the number of colors, which allows remote attackers to cause a denial of service selectcolors allocation error and out-of-bounds write or possibl...

9.8CVSS9.2AI score0.08819EPSS
SaveExploits1Affected Software7
F5 Networks
F5 Networks
•added 2023/02/21 8:00 p.m.•53 views

K20001553: Libgcrypt vulnerability CVE-2018-0495

Security Advisory Description Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigated through the use of blinding during the signing process in the gcryeccecdsasign function in cipher/ecc-ecdsa.c, aka the Return Of the...

4.7CVSS5.6AI score0.00887EPSS
SaveExploits1Affected Software1
F5 Networks
F5 Networks
•added 2023/02/21 7:57 p.m.•53 views

K05535399: Linux kernel vulnerability CVE-2017-17855

Security Advisory Description kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service memory corruption or possibly have unspecified other impact by leveraging improper use of pointers in place of scalars. CVE-2017-17855 Impact There is no impact; ...

7.8CVSS6.8AI score0.00418EPSS
SaveExploits0
F5 Networks
F5 Networks
•added 2023/02/21 7:57 p.m.•53 views

K26310765: HTTP/2 profile vulnerability CVE-2022-23012

Security Advisory Description When the HTTP/2 profile is configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel TMM to terminate. CVE-2022-23012 Impact Traffic is disrupted while the TMM process restarts. This vulnerability allows a remote unauthenticate...

7.5CVSS7.5AI score0.0092EPSS
SaveExploits0Affected Software13
F5 Networks
F5 Networks
•added 2023/02/21 7:57 p.m.•53 views

K63525027: Memcached vulnerability CVE-2018-1000115

Security Advisory Description Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume Network Amplification, CWE-406 vulnerability in the UDP support of the memcached server that can result in denial of service via network flood traffic amplification of 1:50,000 has bee...

7.5CVSS6.7AI score0.88114EPSS
SaveExploits5
F5 Networks
F5 Networks
•added 2023/02/21 7:56 p.m.•53 views

K40264570: Java SE vulnerabilities CVE-2019-2987, CVE-2019-2988, and CVE-2019-2992

Security Advisory Description CVE-2019-2987 Vulnerability in the Java SE product of Oracle Java SE component: 2D. Supported versions that are affected are Java SE: 11.0.4 and 13. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to...

4.3CVSS5AI score0.03467EPSS
SaveExploits0
Total number of security vulnerabilities5000