Produkt Firepass (...) - CVEMAP.ORG

Podatności dla 'Firepass'

2014-12-09

CVE-2014-8730

The SSL profiles component in F5 BIG-IP LTM, APM, and ASM 10.0.0 through 10.2.4 and 11.0.0 through 11.5.1, AAM 11.4.0 through 11.5.1, AFM 11.3.0 through 11.5.1, Analytics 11.0.0 through 11.5.1, Edge Gateway, WebAccelerator, and WOM 10.1.0 through 10.2.4 and 11.0.0 through 11.3.0, PEM 11.3.0 through 11.6.0, and PSM 10.0.0 through 10.2.4 and 11.0.0 through 11.4.1 and BIG-IQ Cloud and Security 4.0.0 through 4.4.0 and Device 4.2.0 through 4.4.0, when using TLS 1.x before TLS 1.2, does not properly check CBC padding bytes when terminating connections, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 (aka POODLE). NOTE: the scope of this identifier is limited to the F5 implementation only. Other vulnerable implementations should receive their own CVE ID, since this is not a vulnerability within the design of TLS 1.x itself.

2014-10-15

CVE-2014-2927

CWE-287

The rsync daemon in F5 BIG-IP 11.6 before 11.6.0, 11.5.1 before HF3, 11.5.0 before HF4, 11.4.1 before HF4, 11.4.0 before HF7, 11.3.0 before HF9, and 11.2.1 before HF11 and Enterprise Manager 3.x before 3.1.1 HF2, when configured in failover mode, does not require authentication, which allows remote attackers to read or write to arbitrary files via a cmi request to the ConfigSync IP address.

2014-02-10

CVE-2013-6024

CWE-200

The Edge Client components in F5 BIG-IP APM 10.x, 11.x, 12.x, 13.x, and 14.x, BIG-IP Edge Gateway 10.x and 11.x, and FirePass 7.0.0 allow attackers to obtain sensitive information from process memory via unspecified vectors.

2013-08-09

CVE-2013-0150

Directory traversal vulnerability in an unspecified signed Java applet in the client-side components in F5 BIG-IP APM 10.1.0 through 10.2.4 and 11.0.0 through 11.3.0, FirePass 6.0.0 through 6.1.0 and 7.0.0, and other products "when APM is provisioned," allows remote attackers to upload and execute arbitrary files via a .. (dot dot) in the filename parameter.

2012-04-05

CVE-2012-2053

CWE-264

The sudoers file in the Linux system configuration in F5 FirePass 6.0.0 through 6.1.0 and 7.0.0 does not require a password for executing commands as root, which allows local users to gain privileges via the sudo program, as demonstrated by the user account that executes PHP scripts, a different vulnerability than CVE-2012-1777.

CVE-2012-1777

CWE-89

SQL injection vulnerability in my.activation.php3 in F5 FirePass 6.0.0 through 6.1.0 and 7.0.0 allows remote attackers to execute arbitrary SQL commands via the state parameter.

2007-01-12

CVE-2007-0195

my.activation.php3 in F5 FirePass 5.4 through 5.5.1 and 6.0 displays different error messages for failed login attempts with a valid username than for those with an invalid username, which allows remote attackers to confirm the validity of an LDAP account.

CVE-2007-0188

F5 FirePass 5.4 through 5.5.1 does not properly enforce host access restrictions when a client uses a single integer (dword) representation of an IP address ("dotless IP address"), which allows remote authenticated users to connect to the FirePass administrator console and certain other network resources.

CVE-2007-0187

F5 FirePass 5.4 through 5.5.2 and 6.0 allows remote attackers to access restricted URLs via (1) a trailing null byte, (2) multiple leading slashes, (3) Unicode encoding, (4) URL-encoded directory traversal or same-directory characters, or (5) upper case letters in the domain name.

>>> Vendor: F5 76 Produkty

Icontrol service manager

Firepass ssl vpn

Big-ip application security manager

Big-ip protocol security manager

Big-ip local traffic manager

Big-ip global traffic manager

Enterprise manager

Application security manager appliance

Big-ip access policy manager

Big-ip edge gateway

Big-ip link controller

Big-ip protocol security module

Big-ip wan optimization manager

Big-ip webaccelerator

Big-ip configuration utility

Big-ip analytics

Big-ip advanced firewall manager

Big-ip application acceleration manager

Big-ip policy enforcement manager

Arx data manager

Big-iq security

Big-ip policy enforcement manager11.5.1

Big-ip enterprise manager

Big-ip domain name system

Big-ip global traffic manager11.2.0

Big-iq application delivery controller

Big-iq centralized management

Big-iq cloud and orchestration

Ssl intercept iapp

Ssl orchestrator

Big-ip fraud protection service

Traffix systems signaling delivery controller

Big-ip access policy manager client

Traffix signaling delivery controller

Big-ip webaccelerator12.1.1

Websafe alert server

Container ingress service

Big-ip controller

Nginx controller

Big-ip advanced web application firewall

Big-ip ddos hybrid defender

Big-ip ssl orchestrator

Big-ip carrier-grade nat

Access policy manager clients

Nginx modsecurity waf

Nginx controller api management

Access for android

Nginx service mesh

Big-ip guided configuration

Copyright 2024, cxsecurity.com