CVE-2020-5940

In versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.2.3, a stored cross-site scripting XSS vulnerability exists in an undisclosed page of the BIG-IP Traffic Management User Interface TMUI, also known as the BIG-IP Configuration utility...

CVE-2020-5946

In BIG-IP Advanced WAF and FPS versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.2.7, under some circumstances, certain format client-side alerts sent to the BIG-IP virtual server configured with DataSafe may cause the Traffic Management Microkernel TMM to restart, resulting in a...

Design/Logic Flaw

In BIG-IQ 7.1.0, accessing the DoS Summary events and DNS Overview pages in the BIG-IQ system interface returns an error message due to disabled Grafana reverse proxy in web service configuration. F5 has done further review of this vulnerability and has re-classified it as a defect. CVE-2020-5944...

CVE-2020-5945

In BIG-IP versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.2.7, undisclosed TMUI page contains a stored cross site scripting vulnerability XSS. The issue allows a minor privilege escalation for resource admin to escalate to full admin...

CVE-2020-5943

In versions 14.1.0-14.1.0.1 and 14.1.2.5-14.1.2.7, when a BIG-IP object is created or listed through the REST interface, the protected fields are obfuscated in the REST response, not protected via a SecureVault cryptogram as TMSH does. One example of protected fields is the GTM monitor password...

CVE-2020-5944

CVE-2020-5944 affects BIG-IQ 7.1.0 where access to DoS Summary and DNS Overview pages returns an error due to a disabled Grafana reverse proxy in web service configuration. The issue has been re-classified by F5 as a defect and is not assigned to other F5 vulnerabilities; CVSS metrics are provide...

F5 BIG-IP APM Denial of Service Vulnerability (CNVD-2020-63956)

F5 BIG-IP APM is a suite of access and security solutions from F5 USA. The product provides unified access to business-critical applications and networks. A security vulnerability exists in F5 BIG-IP APM, which can be exploited by an attacker to trigger a denial of service by triggering a fatal...

F5 BIG-IP VE Resource Management Error Vulnerability

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing and other functions. A resource management error vulnerability exists in the F5 BIG-IP VE product that stems from being enabled on vSphere SR-IOV,...

F5 BIG-IP Cross-Site Scripting Vulnerability (CNVD-2020-74868)

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing and other functions. The F5 BIG-IP product suffers from a cross-site scripting vulnerability that originates from an authenticated attacker being...

F5 Networks BIG-IP : F5 TMUI XSS vulnerability (K21540525)

Undisclosed TMUI page contains a stored cross site scripting vulnerability XSS. The issue allows a minor privilege escalation for resource admin to escalate to full admin. CVE-2020-5945 Impact A malicious, authenticated user with Resource Administrator privileges may be able to exploit this...

F5 Networks BIG-IP : BIG-IP TMUI vulnerability (K43310520)

A stored cross-site scripting XSS vulnerability exists in an undisclosed page of the BIG-IP Traffic Management User Interface TMUI, also known as the BIG-IP Configuration utility. CVE-2020-5940 Impact An authenticated attacker may be able to store JavaScript, whichis executed when another...

F5 Networks BIG-IP : BIG-IP Diameter vulnerability (K82530456)

When processing Capabilities-Exchange-Answer CEA packets withcertain attributes from the Policy and Charging Rules Function PCRF server, the Traffic Management Microkernel TMM may generate a core file and restart.CVE-2020-5942 Impact This vulnerability affects only virtualservers configured with...

F5 Networks BIG-IP : F5 iRules 'RESOLV::lookup' command vulnerability (K03125360)

Usingthe RESOLV::lookup command within an iRule may cause the Traffic Management Microkernel TMM to generate a core file and restart. This issue occurs when data exceeding the maximum limit of a host name passesto the RESOLV::lookup command. CVE-2020-5941 Impact The BIG-IP system may temporarily...

F5 Networks BIG-IP : BIG-IP VE network interface vulnerability (K75111593)

The version of F5 Networks BIG-IP installed on the remote host is prior to 13.1.3.5 / 14.1.2.7 / 15.1.0.4 / 16.0.1. It is, therefore, affected by a vulnerability as referenced in the K75111593 advisory. - In versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.3, 15.0.0-15.0.1.3, 14.1.0-14.1.2.6, and...

F5 BIG-IP HTTP Response Handling Denial of Service Vulnerability

F5 BIG-IP is an application delivery platform that integrates network traffic management, application security management, and load balancing. A security vulnerability exists in the F5 BIG-IP HTTP response processing, which can be exploited by remote attackers to submit a special request that can...

F5 BIG-IP SSL Communication Handling Denial of Service Vulnerability

F5 BIG-IP is an application delivery platform that integrates network traffic management, application security management, and load balancing. A security vulnerability exists in the processing of F5 BIG-IP SSL communications, which can be exploited by remote attackers to submit a special request...

CVE-2020-5934

On BIG-IP APM 15.1.0-15.1.0.5, 14.1.0-14.1.2.3, and 13.1.0-13.1.3.3, when multiple HTTP requests from the same client to configured SAML Single Logout SLO URL are passing through a TCP Keep-Alive connection, traffic to TMM can be disrupted...

CVE-2020-5933

On versions 15.1.0-15.1.0.5, 14.1.0-14.1.2.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, when a BIG-IP system that has a virtual server configured with an HTTP compression profile processes compressed HTTP message payloads that require deflation, a Slowloris-style attack can trigger a...

CVE-2020-5935

On BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, FPS, GTM, Link Controller, PEM versions 15.1.0-15.1.0.5, 14.1.0-14.1.2.3, and 13.1.0-13.1.3.3, when handling MQTT traffic through a BIG-IP virtual server associated with an MQTT profile and an iRule performing manipulations on that traffic, TMM m...

CVE-2020-5938

On BIG-IP 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, when negotiating IPSec tunnels with configured, authenticated peers, the peer may negotiate a different key length than the BIG-IP configuration would otherwise allow...