CVE-2021-22993

On BIG-IP Advanced WAF and BIG-IP ASM versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, DOM-based XSS on DoS Profile properties page. Note: Software versions which have reached End of Software Development EoSD are no...

CVE-2021-22993

CVE-2021-22993 affects BIG-IP Advanced WAF and BIG-IP ASM. The vulnerability is a DOM-based XSS on the DoS Profile properties page in affected versions: 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3. The root cause is DOM-...

CVE-2021-22990

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, on systems with Advanced WAF or BIG-IP ASM provisioned, the Traffic Management User Interface TMUI, also referred to as the...

Design/Logic Flaw

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, on systems with Advanced WAF or BIG-IP ASM provisioned, the Traffic Management User Interface TMUI, also referred to as the...

Buffer overflow

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, a malicious HTTP response to an Advanced WAF/BIG-IP ASM virtual server with Login Page configured in its policy may trigger a buffer...

CVE-2021-22989

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, when running in Appliance mode with Advanced WAF or BIG-IP ASM provisioned, the TMUI, also referred to as the Configuration utility,...

CVE-2021-22992

The CVE-2021-22992 vulnerability affects BIG-IP Advanced WAF/ASM: a crafted HTTP response sent to a virtual server with a Login Page can trigger a buffer overflow, enabling denial-of-service and, in certain cases, remote code execution leading to full system compromise. Affected versions include ...

CVE-2021-22990

CVE-2021-22990 affects BIG-IP TMUI (Configuration utility) when Advanced WAF/ASM is provisioned. It is an authenticated remote command execution vulnerability in undisclosed TMUI pages that can be exploited by highly privileged, network-accessible users via the management port or self IPs. Fixed ...

PT-2021-15319

Name of the Vulnerable Software and Affected Versions BIG-IP versions 16.0.x before 16.0.1.1 BIG-IP versions 15.1.x before 15.1.2.1 BIG-IP versions 14.1.x before 14.1.4 BIG-IP versions 13.1.x before 13.1.3.6 BIG-IP versions 12.1.x before 12.1.5.3 BIG-IP versions 11.6.x before 11.6.5.3 Description...

PT-2021-15328

Name of the Vulnerable Software and Affected Versions BIG-IP Advanced WAF and BIG-IP ASM versions 11.6.x before 11.6.5.3 BIG-IP Advanced WAF and BIG-IP ASM versions 12.1.x before 12.1.5.3 BIG-IP Advanced WAF and BIG-IP ASM versions 13.1.x before 13.1.3.6 BIG-IP Advanced WAF and BIG-IP ASM version...

CVE-2021-22993: Improper Neutralization of Input During Web Page Generation

On BIG-IP Advanced WAF and BIG-IP ASM versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, DOM-based XSS on DoS Profile properties page. Note: Software versions which have reached End of Software Development EoSD are no...

CVE-2021-23001: Unrestricted Upload of File with Dangerous Type

On versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, the upload functionality in BIG-IP Advanced WAF and BIG-IP ASM allows an authenticated user to upload files to the BIG-IP system using a ca...

CVE-2021-22989: Undefined Security Weakness

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, when running in Appliance mode with Advanced WAF or BIG-IP ASM provisioned, the TMUI, also referred to as the Configuration utility,...

CVE-2021-22992: Buffer Copy without Checking Size of Input

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, a malicious HTTP response to an Advanced WAF/BIG-IP ASM virtual server with Login Page configured in its policy may trigger a buffer...

CVE-2021-22990: Undefined Security Weakness

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, on systems with Advanced WAF or BIG-IP ASM provisioned, the Traffic Management User Interface TMUI, also referred to as the...

PT-2021-15320

Name of the Vulnerable Software and Affected Versions BIG-IP Advanced WAF and BIG-IP ASM versions 16.0.x through 16.0.1.0 BIG-IP Advanced WAF and BIG-IP ASM versions 15.1.x through 15.1.1 BIG-IP Advanced WAF and BIG-IP ASM versions 14.1.x through 14.1.2 BIG-IP Advanced WAF and BIG-IP ASM versions...

PT-2021-2408

Name of the Vulnerable Software and Affected Versions: BIG-IP versions 16.0.x through 16.0.1.1 BIG-IP versions 15.1.x through 15.1.2.1 BIG-IP versions 14.1.x through 14.1.4 BIG-IP versions 13.1.x through 13.1.3.6 BIG-IP versions 12.1.x through 12.1.5.3 BIG-IP versions 11.6.x through 11.6.5.3...

PT-2021-2407

Name of the Vulnerable Software and Affected Versions: BIG-IP versions 16.0.x through 16.0.1.1 BIG-IP versions 15.1.x through 15.1.2.1 BIG-IP versions 14.1.x through 14.1.4 BIG-IP versions 13.1.x through 13.1.3.6 BIG-IP versions 12.1.x through 12.1.5.3 BIG-IP versions 11.6.x through 11.6.5.3...

F5 Networks BIG-IP : BIG-IP Advanced WAF and ASM iControl REST vulnerability (K06440657)

The version of F5 Networks BIG-IP installed on the remote host is prior to 11.6.5.3 / 12.1.5.3 / 13.1.3.6 / 14.1.4 / 15.1.2.1 / 16.0.1.1 / 16.1.0. It is, therefore, affected by a vulnerability as referenced in the K06440657 advisory. - On versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1,...

F5 Networks BIG-IP : BIG-IP Advanced WAF and ASM XSS vulnerability (K55237223)

The version of F5 Networks BIG-IP installed on the remote host is prior to 12.1.5.3 / 13.1.3.6 / 14.1.3.1 / 15.1.2 / 16.0.1.1 / 16.1.0. It is, therefore, affected by a vulnerability as referenced in the K55237223 advisory. - On BIG-IP Advanced WAF and BIG-IP ASM versions 16.0.x before 16.0.1.1,...