VYPR

Big IP

by F5, Inc.

CVEs (591)

  • CVE-2022-1388CriKEVMay 5, 2022
    F5, Inc.
    Big IP
    risk 0.93cvss 9.8epss 1.00

    On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. Note: Software versions which…

  • CVE-2021-22986CriKEVMar 31, 2021
    F5, Inc.
    BIG-IQ
    risk 0.93cvss 9.8epss 1.00

    On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3 amd BIG-IQ 7.1.0.x before 7.1.0.3 and 7.0.0.x before 7.0.0.2, the iControl REST interface has an unauthenticated remote command execution…

  • CVE-2020-5902CriKEVJul 1, 2020
    F5, Inc.
    Big IP
    risk 0.93cvss 9.8epss 1.00

    In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages.

  • CVE-2023-46747CriKEVOct 26, 2023
    F5, Inc.
    Big IP
    risk 0.92cvss 9.8epss 0.97

    Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands.  Note: Software versions which have reached End of…

  • CVE-2021-22991CriKEVMar 31, 2021
    F5, Inc.
    Big IP
    risk 0.81cvss 9.8epss 0.61

    On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, undisclosed requests to a virtual server may be incorrectly handled by the Traffic Management Microkernel (TMM) URI normalization, which…

  • CVE-2023-46748HigKEVOct 26, 2023
    F5, Inc.
    Big IP
    risk 0.70cvss 8.8epss 0.04

    An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an authenticated attacker with network access to the Configuration utility through the BIG-IP management port and/or self IP addresses to execute arbitrary system commands. …

  • CVE-2021-22992CriMar 31, 2021
    F5, Inc.
    Big IP
    risk 0.70cvss 9.8epss 0.73

    On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, a malicious HTTP response to an Advanced WAF/BIG-IP ASM virtual server with Login Page configured in its policy…

  • CVE-2022-41622HigDec 7, 2022
    F5, Inc.
    BIG-IQ
    risk 0.67cvss 8.8epss 0.88

    In all versions,  BIG-IP and BIG-IQ are vulnerable to cross-site request forgery (CSRF) attacks through iControl SOAP.   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

  • CVE-2023-41373CriOct 10, 2023
    F5, Inc.
    Big IP
    risk 0.65cvss 9.9epss 0.02

    A directory traversal vulnerability exists in the BIG-IP Configuration Utility that may allow an authenticated attacker to execute commands on the BIG-IP system. For BIG-IP system running in Appliance mode, a successful exploit can allow the attacker to cross a security…

  • CVE-2022-41800HigDec 7, 2022
    F5, Inc.
    Big IP
    risk 0.65cvss 8.7epss 0.66

    In all versions of BIG-IP, when running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, utilizing an undisclosed iControl REST endpoint. A successful exploit can allow the attacker to cross a security…

  • CVE-2021-22987CriMar 31, 2021
    F5, Inc.
    Big IP
    risk 0.65cvss 9.9epss 0.14

    On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3 when running in Appliance mode, the Traffic Management User Interface (TMUI), also referred to as the Configuration…

  • CVE-2019-6675CriNov 26, 2019
    F5, Inc.
    Big IP
    risk 0.64cvss 9.8epss 0.01

    BIG-IP configurations using Active Directory, LDAP, or Client Certificate LDAP for management authentication with multiple servers are exposed to a vulnerability which allows an authentication bypass. This can result in a complete compromise of the system. This issue only…

  • CVE-2019-6609CriApr 15, 2019
    F5, Inc.
    Big IP
    risk 0.64cvss 9.8epss 0.01

    Platform dependent weakness. This issue only impacts iSeries platforms. On these platforms, in BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator) versions 14.0.0-14.1.0.1, 13.0.0-13.1.1.3, and 12.1.1 HF2-12.1.4, the…

  • CVE-2018-5506CriApr 13, 2018
    F5, Inc.
    Big IP
    risk 0.64cvss 9.8epss 0.01

    In F5 BIG-IP 13.0.0, 12.1.0-12.1.2, 11.6.1, 11.5.1-11.5.5, or 11.2.1 the Apache modules apache_auth_token_mod and mod_auth_f5_auth_token.cpp allow possible unauthenticated bruteforce on the em_server_ip authorization parameter to obtain which SSL client certificates used for…

  • CVE-2017-6131CriMay 23, 2017
    F5, Inc.
    Big IP
    risk 0.64cvss 9.8epss 0.01

    In some circumstances, an F5 BIG-IP version 12.0.0 to 12.1.2 and 13.0.0 Azure cloud instance may contain a default administrative password which could be used to remotely log into the BIG-IP system. The impacted administrative account is the Azure instance administrative user…

  • CVE-2016-5745CriOct 5, 2016
    F5, Inc.
    Big IP
    risk 0.64cvss 9.8epss 0.05

    F5 BIG-IP LTM systems 11.x before 11.2.1 HF16, 11.3.x, 11.4.x before 11.4.1 HF11, 11.5.0, 11.5.1 before HF11, 11.5.2, 11.5.3, 11.5.4 before HF2, 11.6.0 before HF8, 11.6.1 before HF1, 12.0.0 before HF4, and 12.1.0 before HF2 allow remote attackers to modify or extract system…

  • CVE-2016-5700CriOct 3, 2016
    F5, Inc.
    Big IP
    risk 0.64cvss 9.8epss 0.06

    Virtual servers in F5 BIG-IP systems 11.5.0, 11.5.1 before HF11, 11.5.2, 11.5.3, 11.5.4 before HF2, 11.6.0 before HF8, 11.6.1 before HF1, 12.0.0 before HF4, and 12.1.0 before HF2, when configured with the HTTP Explicit Proxy functionality or SOCKS profile, allow remote attackers…

  • CVE-2016-5022CriSep 7, 2016
    F5, Inc.
    Big IP
    risk 0.64cvss 9.8epss 0.03

    F5 BIG-IP LTM, Analytics, APM, ASM, and Link Controller 11.2.x before 11.2.1 HF16, 11.3.x, 11.4.x, 11.5.x before 11.5.4 HF2, 11.6.x before 11.6.1 HF1, and 12.x before 12.0.0 HF3; BIG-IP AAM, AFM, and PEM 11.4.x, 11.5.x before 11.5.4 HF2, 11.6.x before 11.6.1 HF1, and 12.x before…

  • CVE-2015-8611CriJan 12, 2016
    F5, Inc.
    Big IP
    risk 0.64cvss 9.8epss 0.03

    BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, and PEM 12.0.0 before HF1 on the 2000, 4000, 5000, 7000, and 10000 platforms do not properly sync passwords with the Always-On Management (AOM) subsystem, which might allow remote attackers to obtain login access…

  • CVE-2015-8098CriJan 12, 2016
    F5, Inc.
    Big IP
    risk 0.64cvss 9.8epss 0.05

    F5 BIG-IP APM 11.4.1 before 11.4.1 HF9, 11.5.x before 11.5.3, and 11.6.0 before 11.6.0 HF4 allow remote attackers to cause a denial of service or execute arbitrary code via unspecified vectors related to processing a Citrix Remote Desktop connection through a virtual server…

Page 1 of 30