CVE-2020-27722

In BIG-IP APM versions 15.0.0-15.0.1.3, 14.1.0-14.1.3, and 13.1.0-13.1.3.4, under certain conditions, the VDI plugin does not observe plugin flow-control protocol causing excessive resource consumption...

CVE-2020-27727

On BIG-IP version 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.3, and 13.1.0-13.1.3.4, when an authenticated administrative user installs RPMs using the iAppsLX REST installer, the BIG-IP system does not sufficiently validate user input, allowing the user read access to the filesystem...

F5 BIG-IP ASM Denial of Service Vulnerability (CNVD-2020-74859)

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing and other functions. A denial of service vulnerability exists in the F5 BIG-IP ASM product, which can be exploited by an attacker who can trigger a...

F5 BIG-IP Information Disclosure Vulnerability (CNVD-2020-74865)

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing and other functions. An information disclosure vulnerability exists in F5 BIG-IP, which can be exploited by an attacker who can read files via F5...

F5 Networks BIG-IP : Linux kernel vulnerability (K48073202)

The version of F5 Networks BIG-IP installed on the remote host is prior to 11.6.5.3 / 12.1.5.3 / 13.1.3.6 / 14.1.3.1 / 15.1.3. It is, therefore, affected by a vulnerability as referenced in the K48073202 advisory. An issue was discovered in drivers/i2c/i2c-core-smbus.c in the Linux kernel before...

F5 BIG-IP ASM 资源管理错误漏洞

F5 BIG-IP ASM is a Web Application Firewall WAF from F5 USA that provides secure remote access, protects email, and simplifies Web access control while enhancing network and application performance. A denial of service vulnerability exists in F5 BIG-IP ASM, which can be exploited by an attacker t...

F5 BIG-IP AFM Security Vulnerability

F5 BIG-IP AFM is an advanced firewall product from F5 USA for protection against DDos attacks. A security vulnerability exists in F5 BIG-IP AFM, which can be exploited by an attacker to trigger a denial of service via a fatal error triggered by a protocol inspection profile. The following product...

F5 BIG-IP Security Vulnerabilities

F5 BIG-IP is an application delivery platform that integrates network traffic management, application security management, load balancing, and other features from F5 USA. A security vulnerability exists in F5 BIG-IP, which can be exploited by an attacker to create a memory leak that can be...

F5 BIG-IP APM 输入验证错误漏洞

F5 BIG-IP APM is a suite of access and security solutions from F5 USA. The product provides unified access to business-critical applications and networks. An input validation error vulnerability exists in F5 BIG-IP APM, which can be exploited by an attacker to spoof a user and redirect them to a...

F5 Networks BIG-IP : BIG-IP APM XSS vulnerability (K30343902)

A reflected cross-site scripting XSS vulnerability exists in the resource information page for authenticated users when a full webtop is configured on the BIG-IP APM system. CVE-2020-27726 Impact An attacker can craft a malicious URL and send it to an authenticated user to launch a XSSattack. C...

F5 Networks BIG-IP : BIG-IP AFM vulnerability (K60344652)

On the BIG-IP AFM, when a Protocol Inspection Profile is attached to a FastL4 virtual server with the protocol field configured to either Other or All Protocols, the TMM may experience a restart if the profile processes non-TCP traffic. CVE-2020-27714 Impact The affected BIG-IP system may...

F5 Networks BIG-IP : BIG-IP APM open redirect vulnerability (K15310332)

An undisclosed link on the BIG-IP APM virtual server allows a malicious user to build an open redirect URI.CVE-2020-27729 Impact An attacker can create a URL with a specially crafted value and trick BIG-IP APM users into visiting the link. Victims may be redirected to a malicious website by...

F5 Networks BIG-IP : zxfrd vulnerability (K25595031)

zxfrd leaks memory when listing DNS zones. Zones can be listed via TMSH, iControl or SNMP; only users with access to those services can trigger this vulnerability.CVE-2020-27725 Impact The memory leak by the zxfrd processeventually causesthe system to experiencean out-of-memory condition. As a...

F5 Networks BIG-IP : BIG-IP APM network access VPN vulnerability (K04518313)

In BIG-IP APM, on systems running more than one TMM instance, authenticated VPN users may consume excessive resources by sending specially crafted malicious traffic over the tunnel.CVE-2020-27724 Impact This vulnerabilitymay cause the Traffic Management Microkernel TMM to stop responding, leading...

F5 Networks BIG-IP : BIG-IP DNS virtual server vulnerability (K52035247)

In a BIG-IP DNS / BIG-IP LTM GSLB deployment, under certain circumstances, the BIG-IP DNS system may stop using a BIG-IP LTM virtual server for DNS response.CVE-2020-27721 This can occur under the following conditions : You configure connection rate limiting by either source ordestination...

F5 BIG-IP APM 安全漏洞

F5 BIG-IP APM is a suite of access and security solutions from F5 USA. The product provides unified access to business-critical applications and networks. A security vulnerability exists in F5 BIG-IP APM, which can be exploited by an attacker who can trigger a fatal error to trigger a denial via...

F5 BIG-IP 输入验证错误漏洞

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing and other functions. An information disclosure vulnerability exists in F5 BIG-IP, which can be exploited by an attacker who can read files via F5...

F5 Networks BIG-IP : BIG-IP PingAccess vulnerability (K42933418)

A BIG-IP APM virtual server processing PingAccess requestsmay lead to a restart of the Traffic Management Microkernel TMM process. CVE-2020-27723 Impact Traffic processing on the BIG-IP system is disrupted while TMM restarts, leading to a failover event in a high availability HA environment. C...

F5 Networks BIG-IP : XSS vulnerability (K19166530)

A cross-site scripting XSS vulnerability exists in an undisclosed page of the BIG-IP Configuration utility.CVE-2020-27719 Impact An attacker can exploit this vulnerability to run JavaScript in the context of the currently logged-in user. When successfully exploiting this vulnerability in the...

F5 Networks BIG-IP : BIG-IP Configuration utility vulnerability (K25691186)

The version of F5 Networks BIG-IP installed on the remote host is prior to 14.1.3.1 / 15.1.1 / 16.0.0. It is, therefore, affected by a vulnerability as referenced in the K25691186 advisory. - On BIG-IP 15.1.0-15.1.0.5 and 14.1.0-14.1.3, crafted TLS request to the BIG-IP management interface via...