F5 Networks BIG-IP : Advanced WAF/ASM buffer-overflow vulnerability (K52510511)

The version of F5 Networks BIG-IP installed on the remote host is prior to 11.6.5.3 / 12.1.5.3 / 13.1.3.6 / 14.1.4 / 15.1.2.1 / 16.0.1.1 / 16.1.0. It is, therefore, affected by a vulnerability as referenced in the K52510511 advisory. - On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before...

Design/Logic Flaw

On BIG-IP Advanced WAF and ASM version 15.1.x before 15.1.0.2, 15.0.x before 15.0.1.4, 14.1.x before 14.1.2.5, 13.1.x before 13.1.3.4, 12.1.x before 12.1.5.2, and 11.6.x before 11.6.5.2, when receiving a unauthenticated client request with a maliciously crafted URI, a BIG-IP Advanced WAF or ASM...

Code injection

On BIG-IP Advanced WAF and ASM version 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.6, and all 12.1.x versions, when the BIG-IP ASM system processes WebSocket requests with JSON payloads, an unusually large number of parameters can cause excessive CPU...

CVE-2021-22984: URL Redirection to Untrusted Site

On BIG-IP Advanced WAF and ASM version 15.1.x before 15.1.0.2, 15.0.x before 15.0.1.4, 14.1.x before 14.1.2.5, 13.1.x before 13.1.3.4, 12.1.x before 12.1.5.2, and 11.6.x before 11.6.5.2, when receiving a unauthenticated client request with a maliciously crafted URI, a BIG-IP Advanced WAF or ASM...

CVE-2021-22976: Undefined Security Weakness

On BIG-IP Advanced WAF and ASM version 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.6, and all 12.1.x versions, when the BIG-IP ASM system processes WebSocket requests with JSON payloads, an unusually large number of parameters can cause excessive CPU...

PT-2021-15309

Name of the Vulnerable Software and Affected Versions BIG-IP Advanced WAF and ASM versions 12.1.x BIG-IP Advanced WAF and ASM versions 13.1.x before 13.1.3.6 BIG-IP Advanced WAF and ASM versions 14.1.x before 14.1.3.1 BIG-IP Advanced WAF and ASM versions 15.1.x before 15.1.2 BIG-IP Advanced WAF a...

PT-2021-15317

Name of the Vulnerable Software and Affected Versions BIG-IP Advanced WAF and ASM versions 15.1.x through 15.1.0.1 BIG-IP Advanced WAF and ASM versions 15.0.x through 15.0.1.3 BIG-IP Advanced WAF and ASM versions 14.1.x through 14.1.2.4 BIG-IP Advanced WAF and ASM versions 13.1.x through 13.1.3.3...

Improper access control

On BIG-IP ASM & Advanced WAF versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.3, under certain conditions, Analytics, Visibility, and Reporting daemon AVRD may generate a core file and restart on the BIG-IP system when processing requests sent from mobile devices...

CVE-2020-27728

CVE-2020-27728 affects BIG-IP ASM/Advanced WAF AVRD under certain conditions when handling mobile-originated requests. Affects versions 16.0.0–16.0.0.1, 15.1.0–15.1.0.5, and 14.1.0–14.1.3. The AVRD process may generate a core file and restart the BIG-IP system, potentially enabling a DoS from mob...

CVE-2020-27718

When a BIG-IP ASM or Advanced WAF system running version 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, or 11.6.1-11.6.5.2 processes requests with JSON payload, an unusually large number of parameters can cause excessive CPU usage in the BIG-IP ASM bd process...

CVE-2020-27718

CVE-2020-27718 affects F5 BIG-IP ASM/Advanced WAF where processing JSON requests with many parameters can cause the bd process to spike CPU usage. Affected versions span BIG-IP ASM 11.6.1–11.6.5.2, 12.1.0–12.1.5.2, 13.1.0–13.1.3.4, 14.1.0–14.1.3, 15.1.0–15.1.0.5, and 16.0.0–16.0.0.1. The issue ca...

CVE-2020-27728: Undefined Security Weakness

On BIG-IP ASM & Advanced WAF versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.3, under certain conditions, Analytics, Visibility, and Reporting daemon AVRD may generate a core file and restart on the BIG-IP system when processing requests sent from mobile devices...

CVE-2020-27718: Undefined Security Weakness

When a BIG-IP ASM or Advanced WAF system running version 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, or 11.6.1-11.6.5.2 processes requests with JSON payload, an unusually large number of parameters can cause excessive CPU usage in the BIG-IP ASM bd process...

PT-2020-16790

Name of the Vulnerable Software and Affected Versions BIG-IP ASM & Advanced WAF versions 14.1.0 through 14.1.3 BIG-IP ASM & Advanced WAF versions 15.1.0 through 15.1.0.5 BIG-IP ASM & Advanced WAF versions 16.0.0 through 16.0.0.1 Description The Analytics, Visibility, and Reporting daemon AVRD may...

PT-2020-16780

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions 11.6.1 through 11.6.5.2 F5 BIG-IP versions 12.1.0 through 12.1.5.2 F5 BIG-IP versions 13.1.0 through 13.1.3.4 F5 BIG-IP versions 14.1.0 through 14.1.3 F5 BIG-IP versions 15.1.0 through 15.1.0.5 F5 BIG-IP versions 16.0.0...

F5 Networks BIG-IP : BIG-IP AVRD vulnerability (K45143221)

The version of F5 Networks BIG-IP installed on the remote host is prior to 14.1.3.1 / 15.1.1 / 16.0.1 / 16.1.0. It is, therefore, affected by a vulnerability as referenced in the K45143221 advisory. - On BIG-IP ASM & Advanced WAF versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.3, under...

CVE-2020-5946

In BIG-IP Advanced WAF and FPS versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.2.7, under some circumstances, certain format client-side alerts sent to the BIG-IP virtual server configured with DataSafe may cause the Traffic Management Microkernel TMM to restart, resulting in a...

Format string

In BIG-IP Advanced WAF and FPS versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.2.7, under some circumstances, certain format client-side alerts sent to the BIG-IP virtual server configured with DataSafe may cause the Traffic Management Microkernel TMM to restart, resulting in a...

CVE-2020-5946

In BIG-IP Advanced WAF and FPS versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.2.7, under some circumstances, certain format client-side alerts sent to the BIG-IP virtual server configured with DataSafe may cause the Traffic Management Microkernel TMM to restart, resulting in a...

CVE-2020-5946

Summary: CVE-2020-5946 affects F5 BIG-IP products with DataSafe-enabled virtual servers, where certain format client-side alerts can cause the Traffic Management Microkernel (TMM) to restart, leading to a DoS. Affected versions: BIG-IP Advanced WAF and FPS 16.0.0–16.0.0.1, 15.1.0–15.1.0.5, and 14...