F5 Networks BIG-IP : BIG-IP AFM vulnerability (K60344652)

On the BIG-IP AFM, when a Protocol Inspection Profile is attached to a FastL4 virtual server with the protocol field configured to either Other or All Protocols, the TMM may experience a restart if the profile processes non-TCP traffic. CVE-2020-27714 Impact The affected BIG-IP system may...

F5 Networks BIG-IP : BIG-IP APM XSS vulnerability (K30343902)

A reflected cross-site scripting XSS vulnerability exists in the resource information page for authenticated users when a full webtop is configured on the BIG-IP APM system. CVE-2020-27726 Impact An attacker can craft a malicious URL and send it to an authenticated user to launch a XSSattack. C...

F5 Networks BIG-IP : BIG-IP APM open redirect vulnerability (K15310332)

An undisclosed link on the BIG-IP APM virtual server allows a malicious user to build an open redirect URI.CVE-2020-27729 Impact An attacker can create a URL with a specially crafted value and trick BIG-IP APM users into visiting the link. Victims may be redirected to a malicious website by...

F5 Networks BIG-IP : BIG-IP DNS virtual server vulnerability (K52035247)

In a BIG-IP DNS / BIG-IP LTM GSLB deployment, under certain circumstances, the BIG-IP DNS system may stop using a BIG-IP LTM virtual server for DNS response.CVE-2020-27721 This can occur under the following conditions : You configure connection rate limiting by either source ordestination...

F5 Networks BIG-IP : BIG-IP APM network access VPN vulnerability (K04518313)

In BIG-IP APM, on systems running more than one TMM instance, authenticated VPN users may consume excessive resources by sending specially crafted malicious traffic over the tunnel.CVE-2020-27724 Impact This vulnerabilitymay cause the Traffic Management Microkernel TMM to stop responding, leading...

F5 Networks BIG-IP : BIG-IP Configuration utility vulnerability (K25691186)

The version of F5 Networks BIG-IP installed on the remote host is prior to 14.1.3.1 / 15.1.1 / 16.0.0. It is, therefore, affected by a vulnerability as referenced in the K25691186 advisory. - On BIG-IP 15.1.0-15.1.0.5 and 14.1.0-14.1.3, crafted TLS request to the BIG-IP management interface via...

F5 Networks BIG-IP : iAppsLX REST vulnerability (K50343630)

When an authenticated administrative user installs RPMs using the iAppsLX REST installer, the BIG-IP system does not sufficiently validate user input, allowing the user read access to the filesystem.CVE-2020-27727 Impact An attacker can exploit this vulnerability as an authenticated administrativ...

F5 Networks BIG-IP : BIG-IP APM VDI plugin vulnerability (K73657294)

Under certain conditions, the VDI plugin does not observe plugin flow-control protocol causing excessive resource consumption.CVE-2020-27722 Impact This affects only a BIG-IP APM virtual server configured with a Virtual Desktop InfrastructureVDI profile. Your BIG-IP system affected by this...

F5 Networks BIG-IP : BIG-IP PingAccess vulnerability (K42933418)

A BIG-IP APM virtual server processing PingAccess requestsmay lead to a restart of the Traffic Management Microkernel TMM process. CVE-2020-27723 Impact Traffic processing on the BIG-IP system is disrupted while TMM restarts, leading to a failover event in a high availability HA environment. C...

F5 Networks BIG-IP : XSS vulnerability (K19166530)

A cross-site scripting XSS vulnerability exists in an undisclosed page of the BIG-IP Configuration utility.CVE-2020-27719 Impact An attacker can exploit this vulnerability to run JavaScript in the context of the currently logged-in user. When successfully exploiting this vulnerability in the...

F5 Networks BIG-IP : BIG-IP AVRD vulnerability (K45143221)

The version of F5 Networks BIG-IP installed on the remote host is prior to 14.1.3.1 / 15.1.1 / 16.0.1 / 16.1.0. It is, therefore, affected by a vulnerability as referenced in the K45143221 advisory. - On BIG-IP ASM & Advanced WAF versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.3, under...

F5 Networks BIG-IP : BIG-IP ASM vulnerability (K58102101)

When the BIG-IP ASM system processes requests with JSON payload, an unusually large number of parameters can cause excessive CPU usage in the BIG-IP ASM bd process. CVE-2020-27718 Impact When this vulnerability is exploited, the BIG-IP ASM system may take longer than usual to process these...

F5 Networks BIG-IP : BIG-IP APM vulnerability (K51574311)

When a BIG-IP APM virtual server processes traffic of an undisclosed nature, the Traffic Management Microkernel TMM stops responding and restarts.CVE-2020-27716 Impact Traffic processing is disrupted while TMM restarts. If the affected BIG-IP system is configured as part of a device group, the...

F5 Networks BIG-IP : F5 TMM vulnerability (K05204103)

An early syncookie leaks forwarding flows if the virtual server has Clustered Multiprocessing CMPdisabled and the BIG-IP AFM module is provisioned.CVE-2020-5950 Impact The BIG-IP system resources may be excessively consumed and potentially leadto a failover event.Traffic processing is disrupted...

F5 Networks BIG-IP : F5 TMUI XSS vulnerability (K42696541)

Undisclosed endpoints in iControl REST allow for a reflected XSS attack, which could lead to a complete compromise of the BIG-IP system if the victim user is granted the admin role. CVE-2020-5948 Impact An attacker may exploit this vulnerability usinga crafted URL to a reflected cross-site...

F5 Networks BIG-IP : BIG-IP LTM vulnerability (K20984059)

Certain traffic pattern sent to a virtual server configured with an FTP profilecan cause the FTP channel to break. CVE-2020-5949 Impact FTP traffic is disrupted. FTP clients are unable to connect to the FTP server and commands issued to the FTP server stall or fail. C Tenable Network Security, In...

F5 Networks BIG-IP : TMM vulnerability (K37960100)

In certain configurations, when a BIG-IP AFM HTTP security profile is applied to a virtual server and the BIG-IP system receives a request with specific characteristics, the connection is reset and theTraffic Management Microkernel TMM leaks memory. CVE-2020-27713 Impact Connections to the BIG-IP...

F5 Networks BIG-IP : SNMP vulnerability (K45212738)

net-snmp before 5.8.1.pre1 has a double free in usmfreeusmStateReference in snmplib/snmpusm.c via an SNMPv3 GetBulk request. NOTE: this affects net-snmp packages shipped to end users by multiple Linux distributions, but might not affect an upstream release. CVE-2019-20892 Impact When exploited,...

F5 Networks BIG-IP : BIG-IP Edge Client for Windows vulnerability (K15478554)

The BIG-IP Edge Client Windows Installer Service's temporary folder has weak file and folder permissions, and allows execution of signed .exe and MSI files. CVE-2020-5896 Impact This vulnerability can be exploited to allow an unprivileged user to gain privilege escalation on the client Windows...

F5 Networks BIG-IP : BIG-IP virtual server TCP sequence numbers vulnerability (K64571774)

On specific BIG-IP platforms, attackersmay be able to obtain TCP sequence numbers from the BIG-IP system that can be reused in future connections with the same source and destination port and IP numbers.CVE-2020-5947 Impact Attackers may be able to spoof TCP packets to be used by a future...