538 matches found
Server side request forgery (ssrf)
In BIG-IP 11.5.1-11.5.8 and 11.6.1-11.6.3, the Configuration Utility login page may not follow best security practices when handling a malicious request...
CVE-2019-6607
On BIG-IP ASM 11.5.1-11.5.8, 11.6.1-11.6.3, 12.1.0-12.1.3, 13.0.0-13.1.1.3, and 14.0.0-14.0.0.2, there is a stored cross-site scripting vulnerability in an ASM violation viewed in the Configuration utility. In the worst case, an attacker can store a CSRF which results in code execution as the adm...
Cross site scripting
On BIG-IP ASM 11.5.1-11.5.8, 11.6.1-11.6.3, 12.1.0-12.1.3, 13.0.0-13.1.1.3, and 14.0.0-14.0.0.2, there is a stored cross-site scripting vulnerability in an ASM violation viewed in the Configuration utility. In the worst case, an attacker can store a CSRF which results in code execution as the adm...
CVE-2019-6607
On BIG-IP ASM 11.5.1-11.5.8, 11.6.1-11.6.3, 12.1.0-12.1.3, 13.0.0-13.1.1.3, and 14.0.0-14.0.0.2, there is a stored cross-site scripting vulnerability in an ASM violation viewed in the Configuration utility. In the worst case, an attacker can store a CSRF which results in code execution as the adm...
CVE-2019-6602
CVE-2019-6602 affects F5 BIG-IP: the Configuration Utility login page may mishandle a malicious request, yielding an inconsistent HTTP response. Affected versions: BIG-IP 11.5.1–11.5.8 and 11.6.1–11.6.3. Mitigation: upgrade to fix version 11.6.4 (and related 11.5.x path as applicable) per F5 advi...
CVE-2019-6602
In BIG-IP 11.5.1-11.5.8 and 11.6.1-11.6.3, the Configuration Utility login page may not follow best security practices when handling a malicious request...
F5 BIG-IP Application Security Manager Cross-Site Request Forgery Vulnerability
F5 BIG-IP Application Security Manager ASM is a Web Application Firewall WAF from F5 USA that provides secure remote access, protects email, and simplifies Web access control while enhancing network and application performance. A cross-site scripting vulnerability exists in the Configuration...
F5 Networks BIG-IP : BIG-IP ASM XSS vulnerability (K14812883)
This is a stored cross-site scripting XSS vulnerability in an ASM violation viewed in the Configuration utility. In the worst case, an attacker can store a CSRF, which results in code execution as the admin user. CVE-2019-6607 The user levels that can store this attack are ASM Administrator,...
F5 Networks BIG-IP : REST Framework vulnerability (K11818407)
The Configuration utility login page may not follow best security practices when handling a malicious request. CVE-2019-6602 Impact BIG-IP The Configuration utility login page returns an inconsistent HTTP response when processing modified requests; this may provide clues to an attacker looking to...
F5 Networks BIG-IP : BIG-IP Configuration utility vulnerability (K46401178)
Improper escaping of values in an undisclosed page of the BIG-IP Configuration utilitymay result in an improper handling on the JSON response when it is injected by a malicious script through a remotecross-site scripting XSS attack. CVE-2019-6599 Impact BIG-IP andEnterprise Manager This...
F5 Networks BIG-IP : BIG-IP Configuration utility vulnerability (K23734425)
When remote authentication is enabled for administrative users and all external users are granted the guest role, unsanitized values can be reflected to the client via the login page. This can lead to a cross-site scripting attack against unauthenticated clients. CVE-2019-6600 Impact BIG-IP This...
F5 Networks BIG-IP : BIG-IP Configuration utility vulnerability (K44603900)
Malformed requests to the Traffic Management User Interface TMUI, also referred to as the BIG-IP Configuration utility,may lead to disruption of TMUI services. This attack requires an authenticated user with any role other than the No Access role. The No Access user role cannot login and does not...
F5 Networks BIG-IP : Reflected XSS vulnerability in an undisclosed Configuration utility page (K41704442)
A reflected Cross-Site Scripting XSS vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to execute JavaScript in the context of the current logged-in user. CVE-2018-15315 Impact BIG-IP A remote unauthenticated attacker could potentially exploit...
F5 Networks BIG-IP : SQL injection vulnerability (K39428424)
The SQL injection vulnerability in the Configuration utility is related to the BIG-IP AFM system.CVE-2017-0304 Impact An attacker can exploit this vulnerabilityregardless of the BIG-IP AFM provisioning configuration; however, exploiting this vulnerability does not impact traffic processing or the...
F5 Networks BIG-IP : BIG-IP Configuration utility vulnerability (K50254952)
When authenticated administrative users run commands in the Traffic Management User Interface TMUI, also referred to as the BIG-IP Configuration utility, restrictions on allowed commands may not be enforced. CVE-2018-5523 Impact BIG-IP and Enterprise Manager This vulnerability allowsa privilege...
F5 Networks BIG-IP : XSS vulnerability in undisclosed TMUI page (K04524282)
A reflected Cross-Site Scripting XSS vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to execute JavaScript in the context of the current logged-in user. CVE-2018-15314 Impact BIG-IP A remote unauthenticated attacker could potentially exploit...
F5 Networks BIG-IP : BIG-IP Configuration utility vulnerability (K00363258)
A local file vulnerability exists in the BIG-IP Configuration utility that exposes files containing F5-provided data only, and do not include configuration data, proxied traffic, or other potentially sensitive customer data. CVE-2018-5525 Impact Authenticated users may be able to retrieve files...
F5 BIG-IP Cross-Site Scripting Vulnerability (CNVD-2019-01909)
F5 BIG-IP is an all-in-one network device from F5 USA that integrates network traffic management, application security management, load balancing and other functions. A cross-site scripting vulnerability exists in the Configuration utility page in F5 BIG-IP versions 13.0.0-13.1.1.1 and...
CVE-2018-15312
On F5 BIG-IP 13.0.0-13.1.1.1 and 12.1.0-12.1.3.6, a reflected Cross-Site Scripting XSS vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an authenticated user to execute JavaScript for the currently logged-in user...