NLIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Kwetsbaarheden verholpen in F5 BIG-IP
Advisory ansehen veröffentlicht 2025-02-07
F5 heeft kwetsbaarheden verholpen in BIG-IP.
01
beschreibt (27)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2025-24497US | — | — | ||
When URL categorization is configured on a virtual server, undisclosed requests can cause TMM to terminate. Note: Software versions which have reached End of Technical Support (Eo… | ||||
| CVE-2025-24326US | — | — | ||
When BIG-IP Advanced WAF/ASM Behavioral DoS (BADoS) TLS Signatures feature is configured, undisclosed traffic can case an increase in memory resource utilization.
Note: Softwa… | ||||
| CVE-2025-24320US | — | — | ||
A stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the… | ||||
| CVE-2025-24319US | medium6.5 | — | ||
When BIG-IP Next Central Manager is running, undisclosed requests to the BIG-IP Next Central Manager API can cause the BIG-IP Next Central Manager Node's Kubernetes service to term… | ||||
| CVE-2025-24312US | — | — | ||
When BIG-IP AFM is provisioned with IPS module enabled and protocol inspection profile is configured on a virtual server or firewall rule or policy, undisclosed traffic can cause a… | ||||
| CVE-2025-23419US | —OT erhöht | Exploit | ||
When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on… | ||||
| CVE-2025-23415US | low3.1OT erhöht | — | ||
An insufficient verification of data authenticity vulnerability exists in BIG-IP APM Access Policy endpoint inspection that may allow an attacker to bypass endpoint inspection chec… | ||||
| CVE-2025-23413US | — | — | ||
When users log in through the webUI or API using local authentication, BIG-IP Next Central Manager may log sensitive information in the pgaudit log files.
Note: Software version… | ||||
| CVE-2025-23412US | — | — | ||
When BIG-IP APM Access Profile is configured on a virtual server, undisclosed request can cause TMM to terminate.
Note: Software versions which have reached End of Technical… | ||||
| CVE-2025-23239US | high8.7 | — | ||
When running in Appliance mode, and logged into a highly-privileged role, an authenticated remote command injection vulnerability exists in an undisclosed iControl REST endpoint. A… | ||||
| CVE-2025-22891US | — | — | ||
When BIG-IP PEM Control Plane listener Virtual Server is configured with Diameter Endpoint profile, undisclosed traffic can cause the Virtual Server to stop processing new client c… | ||||
| CVE-2025-22846US | — | — | ||
When SIP Session and Router ALG profiles are configured on a Message Routing type virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminat… | ||||
| CVE-2025-21091US | — | — | ||
When SNMP v1 or v2c are disabled on the BIG-IP, undisclosed requests can cause an increase in memory resource utilization.
Note: Software versions which have reached End of Te… | ||||
| CVE-2025-21087US | — | — | ||
When Client or Server SSL profiles are configured on a Virtual Server, or DNSSEC signing operations are in use, undisclosed traffic can cause an increase in memory and CPU resource… | ||||
| CVE-2025-20058US | — | — | ||
When a BIG-IP message routing profile is configured on a virtual server, undisclosed traffic can cause an increase in memory resource utilization. Note: Software versions which hav… | ||||
| CVE-2025-20045US | — | — | ||
When SIP session Application Level Gateway mode (ALG) profile with Passthru Mode enabled and SIP router ALG profile are configured on a Message Routing type virtual server, undiscl… | ||||
| CVE-2025-20029US | — | Exploit | ||
Command injection vulnerability exists in iControl REST and BIG-IP TMOS Shell (tmsh) save command, which may allow an authenticated attacker to execute arbitrary system commands.… | ||||
| CVE-2024-56337US | — | — | ||
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33,… | ||||
| CVE-2024-38660US | — | — | ||
Protection mechanism failure in the SPP for some Intel(R) Xeon(R) processor family (E-Core) may allow an authenticated user to potentially enable escalation of privilege via local… | ||||
| CVE-2024-36242US | — | — | ||
Protection mechanism failure in the SPP for some Intel(R) Processors may allow an authenticated user to potentially enable escalation of privilege via local access. | ||||
20 von 27 angezeigt
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Reference - cveprojectv5; nvdexternal
- Reference - cveprojectv5; nvdexternal
- Reference - cveprojectv5; nvdexternal
- Reference - cveprojectv5; nvdexternal
- Reference - cveprojectv5; nvdexternal
- Reference - cveprojectv5; nvdexternal
- Reference - cveprojectv5; nvdexternal
- Reference - cveprojectv5; nvdexternal
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan