VYPR

Big IP

by F5, Inc.

CVEs (626)

  • CVE-2018-5520MedMay 2, 2018
    F5, Inc.
    Big IP
    risk 0.29cvss 4.4epss 0.01

    On an F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.3.1, or 11.2.1-11.6.3.1 system configured in Appliance mode, the TMOS Shell (tmsh) may allow an administrative user to use the dig utility to gain unauthorized access to file system resources.

  • CVE-2018-5515MedMay 2, 2018
    F5, Inc.
    Big IP
    risk 0.29cvss 4.4epss 0.03

    On F5 BIG-IP 13.0.0-13.1.0.5, using RADIUS authentication responses from a RADIUS server with IPv6 addresses may cause TMM to crash, leading to a failover event.

  • CVE-2018-15310MedSep 13, 2018
    F5, Inc.
    Big IP
    risk 0.28cvss 4.3epss 0.01

    A vulnerability in BIG-IP APM portal access 11.5.1-11.5.7, 11.6.0-11.6.3, and 12.1.0-12.1.3 discloses the BIG-IP software version in rewritten pages.

  • CVE-2015-8021MedApr 12, 2016
    F5, Inc.
    Big IP
    risk 0.28cvss 4.3epss 0.01

    Incomplete blacklist vulnerability in the Configuration utility in F5 BIG-IP LTM, Analytics, APM, ASM, GTM, Link Controller, and PSM 11.x before 11.2.1 HF11, 11.3.x, 11.4.0 before HF8, and 11.4.1 before HF6; BIG-IP AAM 11.4.0 before HF8 and 11.4.1 before HF6; BIG-IP AFM and PEM…

  • CVE-2018-5538LowJul 25, 2018
    F5, Inc.
    Big IP
    risk 0.24cvss 3.7epss 0.01

    On F5 BIG-IP DNS 13.1.0-13.1.0.7, 12.1.3-12.1.3.5, DNS Express / DNS Zones accept NOTIFY messages on the management interface from source IP addresses not listed in the 'Allow NOTIFY From' configuration parameter when the db variable "dnsexpress.notifyport" is set to any value…

  • CVE-2021-22991KEVMar 31, 2021
    F5, Inc.
    Big IP
    risk 0.18cvss —epss 0.61

    On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, undisclosed requests to a virtual server may be incorrectly handled by the Traffic Management Microkernel (TMM) URI normalization, which…

  • CVE-2023-46748KEVOct 26, 2023
    F5, Inc.
    Big IP
    risk 0.12cvss —epss 0.04

    An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an authenticated attacker with network access to the Configuration utility through the BIG-IP management port and/or self IP addresses to execute arbitrary system commands. …

  • CVE-2022-41800Dec 7, 2022
    F5, Inc.
    Big IP
    risk 0.10cvss —epss 0.62

    In all versions of BIG-IP, when running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, utilizing an undisclosed iControl REST endpoint. A successful exploit can allow the attacker to cross a security…

  • CVE-2022-41622Dec 7, 2022
    F5, Inc.
    Big IP
    risk 0.08cvss —epss 0.88

    In all versions,  BIG-IP and BIG-IQ are vulnerable to cross-site request forgery (CSRF) attacks through iControl SOAP.   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

  • CVE-2015-3628Dec 7, 2015
    F5, Inc.
    Big IP
    risk 0.08cvss —epss 0.68

    The iControl API in F5 BIG-IP LTM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.3.0 before 11.5.3 HF2 and 11.6.0 before 11.6.0 HF6, BIG-IP AAM 11.4.0 before 11.5.3 HF2 and 11.6.0 before 11.6.0 HF6, BIG-IP Edge Gateway, WebAccelerator, and WOM 11.3.0, BIG-IP GTM 11.3.0…

  • CVE-2012-1493Jul 9, 2012
    F5, Inc.
    Big IP
    risk 0.08cvss —epss 0.63

    F5 BIG-IP appliances 9.x before 9.4.8-HF5, 10.x before 10.2.4, 11.0.x before 11.0.0-HF2, and 11.1.x before 11.1.0-HF3, and Enterprise Manager before 2.1.0-HF2, 2.2.x before 2.2.0-HF1, and 2.3.x before 2.3.0-HF3, use a single SSH private key across different customers'…

  • CVE-2014-2928May 12, 2014
    F5, Inc.
    Big IP
    risk 0.06cvss —epss 0.39

    The iControl API in F5 BIG-IP LTM, APM, ASM, GTM, Link Controller, and PSM 10.0.0 through 10.2.4 and 11.0.0 through 11.5.1, BIG-IP AAM 11.4.0 through 11.5.1, BIG-IP AFM and PEM 11.3.0 through 11.5.1, BIG-IP Analytics 11.0.0 through 11.5.1, BIG-IP Edge Gateway, WebAccelerator,…

  • CVE-2025-20029Feb 5, 2025
    F5, Inc.
    Big IP
    risk 0.05cvss —epss 0.08

    Command injection vulnerability exists in iControl REST and BIG-IP TMOS Shell (tmsh) save command, which may allow an authenticated attacker to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

  • CVE-2023-23552Feb 1, 2023
    F5, Inc.
    Big IP
    risk 0.05cvss —epss 0.02

    On versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.0 before 15.1.8, 14.1.x before 14.1.5.3, and all versions of 13.1.x, when a BIG-IP Advanced WAF or BIG-IP ASM security policy is configured on a virtual server, undisclosed requests can cause an increase in memory…

  • CVE-2015-4040Sep 17, 2015
    F5, Inc.
    Big IP
    risk 0.04cvss —epss 0.07

    Directory traversal vulnerability in the configuration utility in F5 BIG-IP before 12.0.0 and Enterprise Manager 3.0.0 through 3.1.1 allows remote authenticated users to access arbitrary files in the web root via unspecified vectors.

  • CVE-2014-2927Oct 15, 2014
    F5, Inc.
    Big IP
    risk 0.04cvss —epss 0.08

    The rsync daemon in F5 BIG-IP 11.6 before 11.6.0, 11.5.1 before HF3, 11.5.0 before HF4, 11.4.1 before HF4, 11.4.0 before HF7, 11.3.0 before HF9, and 11.2.1 before HF11 and Enterprise Manager 3.x before 3.1.1 HF2, when configured in failover mode, does not require authentication,…

  • CVE-2012-2997Jan 21, 2014
    F5, Inc.
    Big IP
    risk 0.04cvss —epss 0.06

    XML External Entity (XXE) vulnerability in sam/admin/vpe2/public/php/server.php in F5 BIG-IP 10.0.0 through 10.2.4 and 11.0.0 through 11.2.1 allows remote authenticated users to read arbitrary files via a crafted XML file.

  • CVE-2014-8727Nov 17, 2014
    F5, Inc.
    Big IP
    risk 0.03cvss —epss 0.01

    Multiple directory traversal vulnerabilities in F5 BIG-IP before 10.2.2 allow local users with the "Resource Administrator" or "Administrator" role to enumerate and delete arbitrary files via a .. (dot dot) in the name parameter to (1) tmui/Control/jspmap/tmui/system/archive/prop…

  • CVE-2008-7032Aug 24, 2009
    F5, Inc.
    Big IP
    risk 0.03cvss —epss 0.02

    Web Management Console Cross-site request forgery (CSRF) vulnerability in the web management console in F5 BIG-IP 9.4.3 allows remote attackers to hijack the authentication of administrators for requests that create new administrators and execute shell commands, as demonstrated…

  • CVE-2008-0265Jan 15, 2008
    F5, Inc.
    Big IP
    risk 0.03cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in the Search function in the web management interface in F5 BIG-IP 9.4.3 allow remote attackers to inject arbitrary web script or HTML via the SearchString parameter to (1) list_system.jsp, (2) list_pktfilter.jsp, (3)…

Page 7 of 32