CVE-2019-6636: Improper Neutralization of Input During Web Page Generation

On BIG-IP AFM, ASM 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, and 11.5.1-11.6.4, a stored cross-site scripting vulnerability in AFM feed list. In the worst case, an attacker can store a CSRF which results in code execution as the admin user. The level of user role which can...

CVE-2019-6639: Improper Neutralization of Input During Web Page Generation

On BIG-IP AFM, PEM 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.1-11.5.8, an undisclosed TMUI pages for AFM and PEM Subscriber management are vulnerable to a stored cross-site scripting XSS issue. This is a control plane issue only and is not...

F5 Networks BIG-IP : BIG-IP AFM and PEM TMUI XSS vulnerability (K61002104)

Undisclosed TMUI pages for AFM and PEM Subscriber management are vulnerable to a stored cross-site scripting XSS issue. This is a control plane issue only and is not accessible from the data plane. The attack requires a malicious resource administrator to store the XSS. CVE-2019-6639 Impact A...

CVE-2019-6609

CVE-2019-6609 affects BIG-IP on iSeries (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator) where the secureKeyCapable attribute is not set. This prevents Secure Vault from using F5 hardware support to protect the unit key, causing the unit key ...

F5 Networks BIG-IP : SQL injection vulnerability (K39428424)

The SQL injection vulnerability in the Configuration utility is related to the BIG-IP AFM system.CVE-2017-0304 Impact An attacker can exploit this vulnerabilityregardless of the BIG-IP AFM provisioning configuration; however, exploiting this vulnerability does not impact traffic processing or the...

F5 Networks BIG-IP : BIG-IP AFM vulnerability (K20682450)

X509 certificate verification was not correctly implementedin the early access 'user id' feature in the BIG-IP Advanced Firewall Manager, and thus did not properly validate the remote server's identity on certain versions of BIG-IP. CVE-2017-6142 Impact In affected BIG-IP AFM versions, the system...

F5 Networks BIG-IP : BIG-IP ASM and BIG-IP AFM/BIG-IP Analytics vulnerability (K23520761)

On F5 BIG-IP 13.1.0 - 13.1.0.3, when ASM and one or more of these modules AFM/AVR are provisioned, the Traffic Management Microkernel TMM may restart while processing DNS requests when thevirtual server is configured with a DNS profile and the Protocol setting is set to TCP . CVE-2018-5505 Note :...

F5 BIG-IP AFM Cross-Site Scripting Vulnerability (CNVD-2019-01910)

F5 BIG-IP AFM is an advanced firewall product from F5 USA for protection against DDos attacks. A cross-site scripting vulnerability exists in the TMUI page in F5 BIG-IP AFM versions 13.0.0 through 13.1.1.1 and 12.1.0 through 12.1.3.6, which can be exploited by a remote attacker to inject arbitrar...

Cross site scripting

On F5 BIG-IP AFM 13.0.0-13.1.1.1 and 12.1.0-12.1.3.6, there is a Reflected Cross Site Scripting vulnerability in undisclosed TMUI page...

Cross site scripting

On F5 BIG-IP AFM 13.0.0-13.1.1.1 and 12.1.0-12.1.3.6, there is a Reflected Cross Site Scripting vulnerability in undisclosed TMUI page...

CVE-2018-15314

On F5 BIG-IP AFM 13.0.0-13.1.1.1 and 12.1.0-12.1.3.6, there is a Reflected Cross Site Scripting vulnerability in undisclosed TMUI page...

CVE-2018-15314

On F5 BIG-IP AFM 13.0.0-13.1.1.1 and 12.1.0-12.1.3.6, there is a Reflected Cross Site Scripting vulnerability in undisclosed TMUI page...

CVE-2018-15313

The CVE-2018-15313 issue is a reflected Cross-Site Scripting vulnerability in the BIG-IP AFM TMUI page. Affected versions include BIG-IP AFM 13.0.0–13.1.1 and 12.1.0–12.1.3.6. Remediation per F5 advisory: upgrade to 13.1.1.2 (for 13.x) or 12.1.3.7 (for 12.x). Modeled products beyond these version...

CVE-2018-15313

On F5 BIG-IP AFM 13.0.0-13.1.1.1 and 12.1.0-12.1.3.6, there is a Reflected Cross Site Scripting vulnerability in undisclosed TMUI page...

CVE-2018-15314

CVE-2018-15314 is a reflected XSS in a TMUI page of BIG-IP. Affected are BIG-IP AFM versions 13.0.0–13.1.1.1 and 12.1.0–12.1.3.6. The vulnerability allows a remote attacker to craft a URL that, when visited by an authenticated user, executes JavaScript in that user’s browser. The F5 advisory list...

CVE-2018-15314: Improper Neutralization of Input During Web Page Generation

On F5 BIG-IP AFM 13.0.0-13.1.1.1 and 12.1.0-12.1.3.6, there is a Reflected Cross Site Scripting vulnerability in undisclosed TMUI page...

CVE-2018-15313: Improper Neutralization of Input During Web Page Generation

On F5 BIG-IP AFM 13.0.0-13.1.1.1 and 12.1.0-12.1.3.6, there is a Reflected Cross Site Scripting vulnerability in undisclosed TMUI page...

UBUNTU-CVE-2018-8036

In Apache PDFBox 1.8.0 to 1.8.14 and 2.0.0RC1 to 2.0.10, a carefully crafted or fuzzed file can trigger an infinite loop which leads to an out of memory exception in Apache PDFBox's AFMParser...

Denial Of Service (DoS)

Apache PDFBox is vulnerable to denial of service DoS attacks. A malicious user can pass an AFM file to the application to cause an out-of-memory exception that can crash the application...

Design/Logic Flaw

In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and WebSafe software version 13.0.0 and 12.0.0 - 12.1.2, undisclosed traffic patterns sent to BIG-IP virtual servers, with the TCP Fast Open and Tail Loss Probe options enabled in the associated TCP profile, may cause...