VYPR
← F5, Inc.

Vendor CVEs

F5, Inc.

All CVEs

761 total · sorted by risk
  • CVE-2022-23014Jan 25, 2022
    F5, Inc.
    Big IP
    risk 0.00cvss —epss 0.01

    On versions 16.1.x before 16.1.2 and 15.1.x before 15.1.4.1, when BIG-IP APM portal access is configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support…

  • CVE-2022-23011Jan 25, 2022
    F5, Inc.
    Big IP
    risk 0.00cvss —epss 0.01

    On certain hardware BIG-IP platforms, in version 15.1.x before 15.1.4 and 14.1.x before 14.1.3, virtual servers may stop responding while processing TCP traffic due to an issue in the SYN Cookie Protection feature. Note: Software versions which have reached End of Technical…

  • CVE-2022-23010Jan 25, 2022
    F5, Inc.
    Big IP
    risk 0.00cvss —epss 0.01

    On BIG-IP versions 16.x before 16.1.0, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.4, and all versions of 13.1.x, 12.1.x, and 11.6.x, when a FastL4 profile and an HTTP profile are configured on a virtual server, undisclosed requests can cause an increase in memory resource…

  • CVE-2022-23009Jan 25, 2022
    F5, Inc.
    Big Iq Centralized Management
    risk 0.00cvss —epss 0.01

    On BIG-IQ Centralized Management 8.x before 8.1.0, an authenticated administrative role user on a BIG-IQ managed BIG-IP device can access other BIG-IP devices managed by the same BIG-IQ system. Note: Software versions which have reached End of Technical Support (EoTS) are not…

  • CVE-2021-23054Sep 27, 2021
    F5, Inc.
    Big IP
    risk 0.00cvss —epss 0.01

    On version 16.x before 16.1.0, 15.1.x before 15.1.4, 14.1.x before 14.1.4.4, and all versions of 13.1.x, 12.1.x, and 11.6.x, a reflected cross-site scripting (XSS) vulnerability exists in the resource information page for authenticated users when a full webtop is configured on…

  • CVE-2021-23029Sep 14, 2021
    TR7 Cyber Defense Inc.
    Web Application Firewall
    risk 0.00cvss —epss 0.01

    On version 16.0.x before 16.0.1.2, insufficient permission checks may allow authenticated users with guest privileges to perform Server-Side Request Forgery (SSRF) attacks through F5 Advanced Web Application Firewall (WAF) and the BIG-IP ASM Configuration utility. Note: Software…

  • CVE-2021-23026Sep 14, 2021
    F5, Inc.
    Big IP
    risk 0.00cvss —epss 0.00

    BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4.2, 13.1.x before 13.1.4.1, and all versions of 12.1.x and 11.6.x and all versions of BIG-IQ 8.x, 7.x, and 6.x are vulnerable to cross-site request forgery (CSRF) attacks through iControl SOAP.…

  • CVE-2021-23027Sep 14, 2021
    F5, Inc.
    Big IP
    risk 0.00cvss —epss 0.01

    On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, and 14.1.x before 14.1.4.3, a DOM based cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to execute JavaScript in the context of the…

  • CVE-2021-23025Sep 14, 2021
    F5, Inc.
    Big IP
    risk 0.00cvss —epss 0.02

    On version 15.1.x before 15.1.0.5, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.5, and all versions of 12.1.x and 11.6.x, an authenticated remote command execution vulnerability exists in the BIG-IP Configuration utility. Note: Software versions which have reached End of…

  • CVE-2021-23028Sep 14, 2021
    F5, Inc.
    Big IP
    risk 0.00cvss —epss 0.01

    On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.2, and 13.1.x before 13.1.4, when JSON content profiles are configured for URLs as part of an F5 Advanced Web Application Firewall (WAF)/BIG-IP ASM security policy and applied to a virtual server,…

  • CVE-2021-23030Sep 14, 2021
    F5, Inc.
    Big IP
    risk 0.00cvss —epss 0.01

    On BIG-IP Advanced WAF and BIG-IP ASM version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.3, 13.1.x before 13.1.4.1, and all versions of 12.1.x, when a WebSocket profile is configured on a virtual server, undisclosed requests can cause bd to terminate.…

  • CVE-2021-23036Sep 14, 2021
    F5, Inc.
    Big IP
    risk 0.00cvss —epss 0.01

    On version 16.0.x before 16.0.1.2, when a BIG-IP ASM and DataSafe profile are configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not…

  • CVE-2021-23034Sep 14, 2021
    F5, Inc.
    Big IP
    risk 0.00cvss —epss 0.01

    On BIG-IP version 16.x before 16.1.0 and 15.1.x before 15.1.3.1, when a DNS profile using a DNS cache resolver is configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) process to terminate. Note: Software versions which have…

  • CVE-2021-23032Sep 14, 2021
    F5, Inc.
    Big IP
    risk 0.00cvss —epss 0.01

    On version 16.x before 16.1.0, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.4, and all versions of 13.1.x and 12.1.x, when a BIG-IP DNS system is configured with non-default Wide IP and pool settings, undisclosed DNS responses can cause the Traffic Management Microkernel (TMM)…

  • CVE-2021-23038Sep 14, 2021
    F5, Inc.
    Big IP
    risk 0.00cvss —epss 0.01

    On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.2, 13.1.x before 13.1.4.1, and all versions of 12.1.x, a stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to…

  • CVE-2021-23035Sep 14, 2021
    F5, Inc.
    Big IP
    risk 0.00cvss —epss 0.01

    On BIG-IP 14.1.x before 14.1.4.4, when an HTTP profile is configured on a virtual server, after a specific sequence of packets, chunked responses can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support…

  • CVE-2021-23033Sep 14, 2021
    F5, Inc.
    Big IP
    risk 0.00cvss —epss 0.01

    On BIG-IP Advanced WAF and BIG-IP ASM version 16.x before 16.1.0x, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.3, 13.1.x before 13.1.4.1, and all versions of 12.1.x, when a WebSocket profile is configured on a virtual server, undisclosed requests can cause bd to terminate.…

  • CVE-2021-23039Sep 14, 2021
    F5, Inc.
    Big IP
    risk 0.00cvss —epss 0.01

    On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.2.8, and all versions of 13.1.x and 12.1.x, when IPSec is configured on a BIG-IP system, undisclosed requests from an authorized remote (IPSec) peer, which already has a negotiated Security Association,…

  • CVE-2021-23045Sep 14, 2021
    F5, Inc.
    Big IP
    risk 0.00cvss —epss 0.01

    On BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.3, 13.1.x before 13.1.4.1, and all versions of 12.1.x, when an SCTP profile with multiple paths is configured on a virtual server, undisclosed requests can cause the Traffic Management…

  • CVE-2021-23044Sep 14, 2021
    F5, Inc.
    Big IP
    risk 0.00cvss —epss 0.01

    On BIG-IP version 16.x before 16.1.0, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.2, 13.1.x before 13.1.4.1, and all versions of 12.1.x and 11.6.x, when the Intel QuickAssist Technology (QAT) compression driver is used on affected BIG-IP hardware and BIG-IP Virtual Edition (VE)…

  • CVE-2021-23042Sep 14, 2021
    F5, Inc.
    Big IP
    risk 0.00cvss —epss 0.01

    On BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4, 13.1.x before 13.1.4, and 12.1.x before 12.1.6, when an HTTP profile is configured on a virtual server, undisclosed requests can cause a significant increase in system resource utilization.…

  • CVE-2021-23040Sep 14, 2021
    F5, Inc.
    Big Ip (afm)
    risk 0.00cvss —epss 0.01

    On BIG-IP AFM version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4.2, 13.1.x before 13.1.4.1, and all versions of 12.1.x, a SQL injection vulnerability exists in an undisclosed page of the BIG-IP Configuration utility. This issue is exposed only when BIG-IP…

  • CVE-2021-23043Sep 14, 2021
    F5, Inc.
    Big IP
    risk 0.00cvss —epss 0.02

    On BIG-IP, on all versions of 16.1.x, 16.0.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x, a directory traversal vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to access arbitrary files. Note: Software versions which have…

  • CVE-2021-23041Sep 14, 2021
    F5, Inc.
    Big IP
    risk 0.00cvss —epss 0.01

    On BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4.2, 13.1.x before 13.1.4.1, and all versions of 12.1.x, a DOM based cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an…

  • CVE-2021-23047Sep 14, 2021
    F5, Inc.
    Big IP
    risk 0.00cvss —epss 0.01

    On version 16.x before 16.1.0, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.3, and all versions of 13.1.x, 12.1.x and 11.6.x, when BIG-IP APM performs Online Certificate Status Protocol (OCSP) verification of a certificate that contains Authority Information Access (AIA),…

  • CVE-2021-23049Sep 14, 2021
    F5, Inc.
    Big IP
    risk 0.00cvss —epss 0.01

    On BIG-IP version 16.0.x before 16.0.1.2 and 15.1.x before 15.1.3, when the iRules RESOLVER::summarize command is used on a virtual server, undisclosed requests can cause an increase in Traffic Management Microkernel (TMM) memory utilization resulting in an out-of-memory…

  • CVE-2021-23048Sep 14, 2021
    F5, Inc.
    Big IP
    risk 0.00cvss —epss 0.01

    On BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.3, 13.1.x before 13.1.4.1, and all versions of 12.1.x and 11.6.x, when GPRS Tunneling Protocol (GTP) iRules commands or a GTP profile is configured on a virtual server, undisclosed GTP…

  • CVE-2021-23050Sep 14, 2021
    F5, Inc.
    Big IP
    risk 0.00cvss —epss 0.00

    On BIG-IP Advanced WAF and BIG-IP ASM version 16.0.x before 16.0.1.2 and 15.1.x before 15.1.3 and NGINX App Protect on all versions before 3.5.0, when a cross-site request forgery (CSRF)-enabled policy is configured on a virtual server, an undisclosed HTML response may cause the…

  • CVE-2021-23053Sep 14, 2021
    F5, Inc.
    Big IP
    risk 0.00cvss —epss 0.01

    On version 15.1.x before 15.1.3, 14.1.x before 14.1.3.1, and 13.1.x before 13.1.3.6, when the brute force protection feature of BIG-IP Advanced WAF or BIG-IP ASM is enabled on a virtual server and the virtual server is under brute force attack, the MySQL database may run out of…

  • CVE-2021-23052Sep 14, 2021
    F5, Inc.
    Big IP
    risk 0.00cvss —epss 0.01

    On version 14.1.x before 14.1.4.4 and all versions of 13.1.x, an open redirect vulnerability exists on virtual servers enabled with a BIG-IP APM access policy. This vulnerability allows an unauthenticated malicious user to build an open redirect URI. Note: Software versions…

  • CVE-2021-23051Sep 14, 2021
    F5, Inc.
    Big IP
    risk 0.00cvss —epss 0.01

    On BIG-IP versions 15.1.0.4 through 15.1.3, when the Data Plane Development Kit (DPDK)/Elastic Network Adapter (ENA) driver is used with BIG-IP on Amazon Web Services (AWS) systems, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. This is due…

  • CVE-2021-23022Jun 10, 2021
    F5, Inc.
    Edge Client For Windows
    risk 0.00cvss —epss 0.00

    On version 7.2.1.x before 7.2.1.3 and 7.1.x before 7.1.9.9 Update 1, the BIG-IP Edge Client Windows Installer Service's temporary folder has weak file and folder permissions. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

  • CVE-2021-23023Jun 10, 2021
    F5, Inc.
    Edge Client For Windows
    risk 0.00cvss —epss 0.00

    On version 7.2.1.x before 7.2.1.3 and 7.1.x before 7.1.9.9 Update 1, a DLL hijacking issue exists in cachecleaner.dll included in the BIG-IP Edge Client Windows Installer. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

  • CVE-2021-23024Jun 10, 2021
    F5, Inc.
    Big IP
    risk 0.00cvss —epss 0.05

    On version 8.0.x before 8.0.0.1, and all 6.x and 7.x versions, the BIG-IQ Configuration utility has an authenticated remote command execution vulnerability in undisclosed pages. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

  • CVE-2021-23016May 10, 2021
    F5, Inc.
    Big IP
    risk 0.00cvss —epss 0.01

    On BIG-IP APM versions 15.1.x before 15.1.3, 14.1.x before 14.1.4.1, 13.1.x before 13.1.4, and all versions of 16.0.x, 12.1.x, and 11.6.x, an attacker may be able to bypass APM's internal restrictions and retrieve static content that is hosted within APM by sending specifically…

  • CVE-2021-23015May 10, 2021
    F5, Inc.
    Big IP
    risk 0.00cvss —epss 0.01

    On BIG-IP 15.1.x before 15.1.3, 14.1.x before 14.1.4.2, 13.1.0.8 through 13.1.3.6, and all versions of 16.0.x, when running in Appliance Mode, an authenticated user assigned the 'Administrator' role may be able to bypass Appliance Mode restrictions utilizing undisclosed iControl…

  • CVE-2021-23010May 10, 2021
    F5, Inc.
    Big IP
    risk 0.00cvss —epss 0.01

    On versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.5, and 12.1.x before 12.1.5.3, when the BIG-IP ASM/Advanced WAF system processes WebSocket requests with JSON payloads using the default JSON Content Profile in the ASM…

  • CVE-2021-23009May 10, 2021
    F5, Inc.
    Big IP
    risk 0.00cvss —epss 0.01

    On BIG-IP version 16.0.x before 16.0.1.1 and 15.1.x before 15.1.3, malformed HTTP/2 requests may cause an infinite loop which causes a Denial of Service for Data Plane traffic. TMM takes the configured HA action when the TMM process is aborted. There is no control plane…

  • CVE-2021-23012May 10, 2021
    F5, Inc.
    Big IP
    risk 0.00cvss —epss 0.00

    On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.3, 14.1.x before 14.1.4, and 13.1.x before 13.1.4, lack of input validation for items used in the system support functionality may allow users granted either "Resource Administrator" or "Administrator" roles to…

  • CVE-2021-23013May 10, 2021
    F5, Inc.
    Big IP
    risk 0.00cvss —epss 0.01

    On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.3, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, the Traffic Management Microkernel (TMM) may stop responding when processing Stream Control Transmission Protocol (SCTP) traffic under…

  • CVE-2021-23011May 10, 2021
    F5, Inc.
    Big IP
    risk 0.00cvss —epss 0.01

    On versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.3, 14.1.x before 14.1.4, 13.1.x before 13.1.4, 12.1.x before 12.1.6, and 11.6.x before 11.6.5.3, when the BIG-IP system is buffering packet fragments for reassembly, the Traffic Management Microkernel (TMM) may consume an…

  • CVE-2021-23008May 10, 2021
    F5, Inc.
    Big IP
    risk 0.00cvss —epss 0.01

    On version 15.1.x before 15.1.3, 14.1.x before 14.1.4, 13.1.x before 13.1.4, 12.1.x before 12.1.6, and all versions of 16.0.x and 11.6.x., BIG-IP APM AD (Active Directory) authentication can be bypassed via a spoofed AS-REP (Kerberos Authentication Service Response) response…

  • CVE-2021-22993Mar 31, 2021
    F5, Inc.
    Big IP
    risk 0.00cvss —epss 0.01

    On BIG-IP Advanced WAF and BIG-IP ASM versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, DOM-based XSS on DoS Profile properties page. Note: Software versions which have reached End of Software…

  • CVE-2021-23006Mar 31, 2021
    F5, Inc.
    Big IP
    risk 0.00cvss —epss 0.01

    On all 7.x and 6.x versions (fixed in 8.0.0), undisclosed BIG-IQ pages have a reflected cross-site scripting vulnerability. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.

  • CVE-2021-23007Mar 31, 2021
    F5, Inc.
    Big IP
    risk 0.00cvss —epss 0.02

    On BIG-IP versions 14.1.4 and 16.0.1.1, when the Traffic Management Microkernel (TMM) process handles certain undisclosed traffic, it may start dropping all fragmented IP traffic. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.

  • CVE-2021-23005Mar 31, 2021
    F5, Inc.
    Big IP
    risk 0.00cvss —epss 0.01

    On all 7.x and 6.x versions (fixed in 8.0.0), when using a Quorum device for BIG-IQ high availability (HA) for automatic failover, BIG-IQ does not make use of Transport Layer Security (TLS) with the Corosync protocol. Note: Software versions which have reached End of Software…

  • CVE-2021-23004Mar 31, 2021
    F5, Inc.
    Big IP
    risk 0.00cvss —epss 0.01

    On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, Multipath TCP (MPTCP) forwarding flows may be created on standard virtual servers without MPTCP enabled in the…

  • CVE-2021-23001Mar 31, 2021
    F5, Inc.
    Big IP
    risk 0.00cvss —epss 0.01

    On versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, the upload functionality in BIG-IP Advanced WAF and BIG-IP ASM allows an authenticated user to upload files to the BIG-IP…

  • CVE-2021-22998Mar 31, 2021
    F5, Inc.
    Big IP
    risk 0.00cvss —epss 0.01

    On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, SYN flood protection thresholds are not enforced in secure network address translation (SNAT) listeners. Note:…

  • CVE-2021-22997Mar 31, 2021
    F5, Inc.
    Big IP
    risk 0.00cvss —epss 0.01

    On all 7.x and 6.x versions (fixed in 8.0.0), BIG-IQ HA ElasticSearch service does not implement any form of authentication for the clustering transport services, and all data used by ElasticSearch for transport is unencrypted. Note: Software versions which have reached End of…

Page 10 of 16