f5 nginx controller vulnerabilities and exploits

(subscribe to this query)

9.8

CVSSv3

On F5 BIG-IP 16.1.x versions before 16.1.2.2, 15.1.x versions before 15.1.5.1, 14.1.x versions before 14.1.4.6, 13.1.x versions before 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. Note: Software versions which have reac...

F5 Big-ip Access Policy Manager F5 Big-ip Advanced Firewall Manager F5 Big-ip Analytics F5 Big-ip Application Acceleration Manager F5 Big-ip Application Security Manager F5 Big-ip Domain Name System F5 Big-ip Fraud Protection Service F5 Big-ip Global Traffic Manager F5 Big-ip Link Controller F5 Big-ip Local Traffic Manager F5 Big-ip Policy Enforcement Manager

82 Github repositories4 Articles

9.8

CVSSv3

In versions 3.0.0-3.9.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller Agent does not use absolute paths when calling system utilities.

F5 Nginx Controller F5 Nginx Controller 1.0.1 Netapp Cloud Backup -

9.6

CVSSv3

In NGINX Controller 3.3.0-3.4.0, undisclosed API endpoints may allow for a reflected Cross Site Scripting (XSS) attack. If the victim user is logged in as admin this could result in a complete compromise of the system.

F5 Nginx Controller

8.8

CVSSv3

In versions 3.0.0-3.4.0, 2.0.0-2.9.0, and 1.0.1, there is insufficient cross-site request forgery (CSRF) protections for the NGINX Controller user interface.

F5 Nginx Controller 1.0.1 F5 Nginx Controller

8.6

CVSSv3

In NGINX Controller versions before 3.2.0, an unauthenticated attacker with network access to the Controller API can create unprivileged user accounts. The user which is created is only able to upload a new license to the system but cannot view or modify any other components of t...

F5 Nginx Controller 1.0.1 F5 Nginx Controller Netapp Cloud Backup -

8.1

CVSSv3

On versions 3.0.0-3.3.0, the NGINX Controller webserver does not invalidate the server-side session token after users log out.

F5 Nginx Controller

8.1

CVSSv3

In versions before 3.3.0, the NGINX Controller Agent installer script 'install.sh' uses HTTP instead of HTTPS to check and install packages

F5 Nginx Controller F5 Nginx Controller 1.0.1 Netapp Cloud Backup -

7.8

CVSSv3

NGINX Open Source prior to 1.23.2 and 1.22.1, NGINX Open Source Subscription prior to R2 P1 and R1 P1, and NGINX Plus prior to R27 P1 and R26 P1 have a vulnerability in the module ngx_http_mp4_module that might allow a local malicious user to corrupt NGINX worker memory, resultin...

F5 Nginx Ingress Controller F5 Nginx F5 Nginx 1.23.1 F5 Nginx 1.23.0 F5 Nginx R2 F5 Nginx R1 Fedoraproject Fedora 35 Fedoraproject Fedora 36 Fedoraproject Fedora 37 Debian Debian Linux 10.0 Debian Debian Linux 11.0

1 Github repository

7.8

CVSSv3

The NGINX Controller 2.0.0 thru 2.9.0 and 3.x prior to 3.15.0 Administrator password may be exposed in the systemd.txt file that is included in the NGINX support package.

F5 Nginx Controller

7.8

CVSSv3

In NGINX Controller 3.0.0-3.4.0, recovery code required to change a user's password is transmitted and stored in the database in plain text, which allows an attacker who can intercept the database connection or have read access to the database, to request a password reset us...

F5 Nginx Controller

Get Started

1 2 3 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook