CVE-2022-29479

CVE-2022-29479 affects F5 BIG-IP TMM IPv6 stack when ipv6.strictcompliance is enabled. Affected: BIG-IP all modules across multiple versions (e.g., 16.x, 15.x, 14.x, 13.x, 12.x, 11.x) with IPv6 self IPs. Impact: degradation of performance (data-plane issue) that can lead to DoS; no control plane ...

CVE-2022-29474

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, a directory traversal vulnerability exists in iControl SOAP that allows an authenticated attacker with at...

CVE-2022-29474

Summary of CVE-2022-29474 (F5 BIG-IP iControl SOAP directory traversal) Vulnerability: A directory traversal in iControl SOAP allows an authenticated user with at least guest privileges to read wsdl files from the BIG-IP filesystem. Affected products/versions (as cited by multiple sources): BIG-I...

CVE-2022-29473

On F5 BIG-IP 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, when an IPSec ALG profile is configured on a virtual server, undisclosed responses can cause Traffic Management MicrokernelTMM to terminate. Note: Software versions which have...

CVE-2022-29473

CVE-2022-29473 affects F5 BIG-IP IPSec ALG on virtual servers, causing TMM termination (DoS). Affected: BIG-IP 15.1.x before 15.1.5.1; 14.1.x before 14.1.4.6; 13.1.x before 13.1.5. Remediation per K06323049: apply fixes in 16.1.0 (for 16.x), 15.1.5.1 (for 15.x), 14.1.4.5 (for 14.x), or 13.1.5 (fo...

CVE-2022-29263

On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, as well as F5 BIG-IP APM Clients 7.x versions prior to 7.2.1.5, the BIG-IP Edge Client Component...

CVE-2022-29263

CVE-2022-29263 affects F5 BIG-IP APM and BIG-IP APM Clients where the BIG-IP Edge Client Component Installer Service saves temporary files insecurely. The advisory (K33552735) states vulnerable versions include BIG-IP APM 16.1.x before 16.1.2.2, 15.1.x before 15.1.5.1, 14.1.x before 14.1.4.6, 13....

CVE-2022-28859

CVE-2022-28859 affects F5 BIG-IP: during Net HSM installation, the scripts nethsm-safenet-install.sh and nethsm-thales-install.sh expose the Net HSM partition password. Public docs confirm affected versions include 14.1.x prior to 14.1.4.6, 15.1.x prior to 15.1.5.1, and 16.x prior to 16.1.0 (with...

CVE-2022-28859

On F5 BIG-IP 15.1.x versions prior to 15.1.5.1 and 14.1.x versions prior to 14.1.4.6, when installing Net HSM, the scripts nethsm-safenet-install.sh and nethsm-thales-install.sh expose the Net HSM partition password. Note: Software versions which have reached End of Technical Support EoTS are not...

CVE-2022-28714

CVE-2022-28714 – F5 BIG-IP Edge Client DLL hijacking (Windows) Root cause: A DLL hijacking vulnerability in the BIG-IP Edge Client Windows Installer could allow an attacker to load a malicious DLL and gain privilege escalation on vulnerable Windows clients. Affected products/versions (per vendor ...

CVE-2022-28714

On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, as well as F5 BIG-IP APM Clients 7.x versions prior to 7.2.1.5, a DLL Hijacking vulnerability exists in...

CVE-2022-28708

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2 and 15.1.x versions prior to 15.1.5.1, when a BIG-IP DNS resolver-enabled, HTTP-Explicit or SOCKS profile is configured on a virtual server, an undisclosed DNS response can cause the Traffic Management Microkernel TMM process to terminate. Note:...

CVE-2022-28708

CVE-2022-28708 affects F5 BIG-IP in 16.1.x (before 16.1.2.2) and 15.1.x (before 15.1.5.1) when a DNS resolver-enabled, HTTP-Explicit or SOCKS profile is on a virtual server. An undisclosed DNS response can cause the Traffic Management Microkernel (TMM) process to terminate, resulting in functiona...

CVE-2022-28707

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, and 14.1.x versions prior to 14.1.4.6, a stored cross-site scripting XSS vulnerability exists in an undisclosed page of the BIG-IP Configuration utility also referred to as the BIG-IP TMUI that allows an attacker t...

CVE-2022-28707

CVE-2022-28707 is a stored XSS in BIG-IP TMUI (Configuration utility). Affected versions: BIG-IP 16.1.0–16.1.2.2, 15.1.0–15.1.5, 14.1.0–14.1.4.6. The vulnerability allows executing JavaScript in the context of the currently logged-in user via an undisclosed TMUI page. The advisory notes exploitat...

CVE-2022-28706

On F5 BIG-IP 16.1.x versions prior to 16.1.2 and 15.1.x versions prior to 15.1.5.1, when the DNS resolver configuration is used, undisclosed requests can cause the Traffic Management Microkernel TMM to terminate. Note: Software versions which have reached End of Technical Support EoTS are not...

CVE-2022-28706

CVE-2022-28706 affects F5 BIG-IP with DNS resolver enabled. Vulnerability in the DNS resolver can cause the Traffic Management Microkernel (TMM) to terminate, producing a DoS. Affected are BIG-IP 16.1.x before 16.1.2 and 15.1.x before 15.1.5.1 (EoTS exclusions apply). Fixes are provided in the ad...

CVE-2022-28705

The CVE-2022-28705 issue affects F5 BIG-IP platforms with a built-in ePVA acceleration and the pva.fwdaccel BigDB setting, where undisclosed requests to a virtual server using a FastL4 profile with ePVA can cause the Traffic Management Microkernel (TMM) to terminate, leading to DoS. Affected vers...

CVE-2022-28705

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, on platforms with an ePVA and the pva.fwdaccel BigDB variable enabled, undisclosed requests to a virtual server with a FastL4 profile that has...

CVE-2022-28701

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, when the stream profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...