K33440533: BIG-IP ASM Bot Defense open redirection vulnerability CVE-2021-22984

Security Advisory Description When receiving a unauthenticated client request with a maliciously crafted URI, a BIG-IP Advanced WAF or ASM virtual server configured with a DoS profile with Proactive Bot Defense versions prior to 14.1.0, or a Bot Defense profile versions 14.1.0 and later, may...

K25160703: BIG-IP AFM vulnerability CVE-2020-5920

Security Advisory Description A vulnerability in the BIG-IP AFM Configuration utility may allow any authenticated BIG-IP user to perform a read-only blind SQL injection attack. CVE-2020-5920 Impact An attacker may be able to extract table name enumeration and user account names. All other data...

K17407: Datastor kernel vulnerability CVE-2015-7394

Security Advisory Description The datastor kernel module in F5 BIG-IP Analytics, APM, ASM, Link Controller, and LTM 11.1.0 before 12.0.0, BIG-IP AAM 11.4.0 before 12.0.0, BIG-IP AFM, PEM 11.3.0 before 12.0.0, BIG-IP Edge Gateway, WebAccelerator, and WOM 11.1.0 through 11.3.0, BIG-IP GTM 11.1.0...

K10248311: The apmd process logs clear the text password in an iRule when in debug mode

Security Advisory Description This issue occurs when all of the following conditions are met: You have licensed and provisioned the BIG-IP APM module. You have configured the apmd process to log at the debug level. You have configured the BIG-IP APM virtual server to run an access policy using an...

K07702240: BIG-IP Resource Administrator vulnerability CVE-2019-6618

Security Advisory Description Users with the Resource Administrator role can modify sensitive portions of the file system if provided Advanced Shell access, such as editing /etc/passwd. This allows modifications to user objects and is contrary to our definition for the Resource Administrator role...

K52171282: BIG-IP APM client for Linux and macOS vulnerability CVE-2018-5529

Security Advisory Description The svpn component of the F5 BIG-IP APM client prior to version 7.1.7 for Linux and Mac OS X runs as a privileged process and can allow an unprivileged user to assume super-user privileges on the local client host. A malicious local unprivileged user may gain knowled...

K55873574: BIG-IP ASM Configuration utility vulnerability CVE-2020-5927

Security Advisory Description BIG-IP ASM Configuration utility stored cross-site scripting. CVE-2020-5927 Impact An attacker may exploit this vulnerability by redirecting users to a malicious page. Security Advisory Status F5 Product Development has assigned ID 888489 BIG-IP to this vulnerability...

K40843345: BIG-IP ASM Configuration utility vulnerability CVE-2020-5928

Security Advisory Description An attacker may use the BIG-IP ASM Configuration utility cross-site request forgery CSRF protection token multiple times. CVE-2020-5928 Impact When the token is stolen, an attacker may be able to send POST requests to the affected BIG-IP ASM system to modify the...

K58102101: BIG-IP ASM vulnerability CVE-2020-27718

Security Advisory Description When the BIG-IP ASM system processes requests with JSON payload, an unusually large number of parameters can cause excessive CPU usage in the BIG-IP ASM bd process. CVE-2020-27718 Impact When this vulnerability is exploited, the BIG-IP ASM system may take longer than...

K75111593: BIG-IP VE network interface vulnerability CVE-2020-5939

Security Advisory Description BIG-IP Virtual Edition VE systems on VMware, with an Intel-based 85299 Network Interface Controller NIC card and Single Root I/O Virtualization SR-IOV enabled on vSphere, may fail and leave the Traffic Management Microkernel TMM in a state where it cannot transmit...

K21042153: XSS vulnerability in undisclosed TMUI page CVE-2018-15313

Security Advisory Description A reflected Cross-Site Scripting XSS vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to execute JavaScript in the context of the current logged-in user. CVE-2018-15313 Impact BIG-IP A remote unauthenticated...

K37661551: Unbound DNS Cache vulnerabilities CVE-2020-12662 and CVE-2020-12663

Security Advisory Description CVE-2020-12662 Unbound before 1.10.1 has Insufficient Control of Network Message Volume, aka an "NXNSAttack" issue. This is triggered by random subdomains in the NSDNAME in NS records. CVE-2020-12663 Unbound before 1.10.1 has an infinite loop via malformed DNS answer...

K19361245: BIG-IP TMM vulnerability CVE-2017-6158

Security Advisory Description The Traffic Management Microkernel TMM has a vulnerability related to the handling of invalid IP addresses. CVE-2017-6158 This issue is exposed only when all of the following conditions are met: You have disabled the Auto Last Hop setting at the Virtual Server, VLAN,...

K65372933: BIG-IP HTTP/2 vulnerability CVE-2020-5875

Security Advisory Description Under certain conditions, the Traffic Management Microkernel TMM may generate a core file and restart while processing SSL traffic with an HTTP/2 full proxy. CVE-2020-5875 Impact If you have enabled HTTP/2, Message Routing Framework MRF, and SSL, a certain request...

K65355492: Apache vulnerability CVE-2018-5506

Security Advisory Description Apache modules apacheauthtokenmod and modauthf5authtoken.cpp allow possible unauthenticated bruteforce on the emserverip authorization parameter to obtain which SSL client certificates used for mutual authentication between BIG-IQ or Enterprise Manager EM and managed...

K43449212: PHP vulnerability CVE-2016-5096

Security Advisory Description Integer overflow in the fread function in ext/standard/file.c in PHP before 5.5.36 and 5.6.x before 5.6.22 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large integer in the second argument. CVE-2016-5096 Impact...

K60344652: BIG-IP AFM vulnerability CVE-2020-27714

Security Advisory Description On the BIG-IP AFM, when a Protocol Inspection Profile is attached to a FastL4 virtual server with the protocol field configured to either Other or All Protocols, the TMM may experience a restart if the profile processes non-TCP traffic. CVE-2020-27714 Impact The...

K57111075: TMM vulnerability CVE-2022-23021

Security Advisory Description When any of the following configurations are configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel TMM to terminate: HTTP redirect rule in an LTM policy, BIG-IP APM Access Profile, and Explicit HTTP Proxy in HTTP Profile...

K29282483: BIG-IP APM CTU vulnerability CVE-2021-22980

Security Advisory Description An untrusted search path vulnerability in the BIG-IP APM Client Troubleshooting Utility CTU for Windows can allow an attacker to load a malicious DLL library from its current directory. User interaction is required to exploit this vulnerability because the victim mus...

K25551452: Alpine Linux Docker image vulnerability CVE-2019-5021

Security Advisory Description Versions of the Official Alpine Linux Docker images since v3.3 contain a NULL password for the root user. This vulnerability appears to be the result of a regression introduced in December of 2015. Due to the nature of this issue, systems deployed using affected...