F5 Networks BIG-IP : BIG-IP Configuration utility vulnerability (K20222812)

When authenticated administrative users run commands in the Traffic Management User Interface TMUI, also referred to as the BIG-IP Configuration utility, restrictions on allowed commands may not be enforced. CVE-2018-15327 Impact BIG-IP and Enterprise Manager This vulnerability allowsa privilege...

F5 Networks BIG-IP : BIG-IP APM portal access vulnerability (K52206731)

TMM may restart when processing a specially crafted request withAPM portal access. CVE-2018-15324 Impact A remote attacker may be able to cause a traffic disruption or cause the BIG-IP system to fail over to a peer device in the device group if configured for high availabilityHA. C Tenable Networ...

F5 Networks BIG-IP : BIG-IP TMM vulnerability (K19361245)

The version of F5 Networks BIG-IP installed on the remote host is prior to 11.5.6 / 11.6.2 / 12.1.3 / 13.0.0. It is, therefore, affected by a vulnerability as referenced in the K19361245 advisory. - In F5 BIG-IP 12.0.0-12.1.2, 11.6.0-11.6.1, 11.5.1-11.5.5, or 11.2.1 there is a vulnerability in TM...

F5 Networks BIG-IP : TLS vulnerability (K02714910)

In some circumstances, the Traffic Management Microkernel TMM does not properly handle certain malformed TLS1.2 records, which allows remote attackers to cause a denial-of-service DoS or possible remote command execution on the BIG-IP system. CVE-2017-6164 Impact A remote attacker may be able cau...

F5 Networks BIG-IP : BIG-IP ASM data processing vulnerability (K38243073)

The version of F5 Networks BIG-IP installed on the remote host is prior to 11.6.3 / 12.1.3.2 / 13.1.0. It is, therefore, affected by a vulnerability as referenced in the K38243073 advisory. - On F5 BIG-IP systems running 13.0.0, 12.1.0 - 12.1.3.1, or 11.6.1 - 11.6.2, the BIG-IP ASM bd daemon may...

F5 Networks BIG-IP : Apache vulnerability (K65355492)

Apache modules apacheauthtokenmod and modauthf5authtoken.cpp allow possible unauthenticated bruteforce on the emserverip authorization parameter to obtain which SSL client certificates used for mutual authentication between BIG-IQ or Enterprise Manager EM and managed BIG-IP devices. CVE-2018-5506...

F5 Networks BIG-IP : BADoS vulnerability (K62201098)

Under certain conditions, Behavioral DoS BADoS protection may fail during an attack. CVE-2018-5526 Impact BADoS protection does not function as intended. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from F5 Networks BIG-IP Solution...

F5 Networks BIG-IP : Linux kernel vulnerability (K80440915)

The mm subsystem in the Linux kernel through 4.10.10 does not properly enforce the CONFIGSTRICTDEVMEM protection mechanism, which allows local users to read or write to kernel memory locations in the first megabyte and bypass slab-allocation access restrictions via an application that opens the...

F5 Networks BIG-IP : XSS vulnerability in undisclosed TMUI page (K21042153)

A reflected Cross-Site Scripting XSS vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to execute JavaScript in the context of the current logged-in user.CVE-2018-15313 Impact BIG-IP A remote unauthenticated attacker could potentially exploit...

F5 Networks BIG-IP : XSS vulnerability in undisclosed TMUI page (K04524282)

A reflected Cross-Site Scripting XSS vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to execute JavaScript in the context of the current logged-in user. CVE-2018-15314 Impact BIG-IP A remote unauthenticated attacker could potentially exploit...

F5 Networks BIG-IP : BIG-IP APM client for Linux and macOS vulnerability (K52171282)

The version of F5 Networks BIG-IP installed on the remote host is prior to 11.5.9 / 11.6.3.3 / 12.1.3.7 / 13.1.1.2 / 14.0.0 / 14.1.0. It is, therefore, affected by a vulnerability as referenced in the K52171282 advisory. - The svpn component of the F5 BIG-IP APM client prior to version 7.1.7 for...

F5 Networks BIG-IP : BIG-IP tmsh vulnerability (K01067037)

When BIG-IP is licensed for Appliance mode, Admin and Resource administrator roles can by-pass BIG-IP Appliance mode restrictions to overwrite critical system files. CVE-2018-15321 Attackers with ahigh-privilege level can overwrite critical system files, which in turnbypasses security controls...

F5 Networks BIG-IP : GeoIP vulnerability (K23124150)

Carefully crafted URLs can be used to reflect arbitrary content into GeoIP lookup responses, potentially exposing clients to XSS. CVE-2018-5521 Impact BIG-IP Clients accessing the affected system may be exposed to cross-site scripting XSS attacks. This vulnerability does not affect data plane...

F5 Networks BIG-IP : Reflected XSS vulnerability in an undisclosed Configuration utility page (K41704442)

A reflected Cross-Site Scripting XSS vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to execute JavaScript in the context of the current logged-in user. CVE-2018-15315 Impact BIG-IP A remote unauthenticated attacker could potentially exploit...

F5 Networks BIG-IP : BIG-IP Configuration utility vulnerability (K50254952)

When authenticated administrative users run commands in the Traffic Management User Interface TMUI, also referred to as the BIG-IP Configuration utility, restrictions on allowed commands may not be enforced. CVE-2018-5523 Impact BIG-IP and Enterprise Manager This vulnerability allowsa privilege...

F5 Networks BIG-IP : TMM vulnerability (K72442354)

Undisclosed traffic patterns may lead to denial of service conditions for the BIG-IP system. The configuration which exposes this condition is the BIG-IP self IP address which is part of a VLAN group and has the Port Lockdown setting configured with anything other than 'allow-all'. CVE-2018-15320...

F5 Networks BIG-IP : TMM with LRO vulnerability (K07550539)

When Large Receive Offload LRO is enabled, undisclosed traffic patterns may cause TMM to restart. LRO has been available since 11.4.0 but is not enabled by default until13.1.0 for all platformsand 12.0.0 for Virtual Edition. CVE-2018-15311 Impact An attacker may be able to disrupt traffic or caus...

F5 Networks BIG-IP : DHCP client vulnerability (K08306700)

An out-of-bound memory access flaw was found in the way dhclient processed a DHCP response packet. A malicious DHCP server could potentially use this flaw to crash dhclient processes running on DHCP client machines via a crafted DHCP response packet. CVE-2018-5732 Impact An attacker can cause a...

F5 Networks BIG-IP : IP Intelligence Feed List vulnerability (K11464209)

The version of F5 Networks BIG-IP installed on the remote host is prior to 11.5.6 / 11.6.3 / 12.1.2 HF1 / 13.0.0. It is, therefore, affected by a vulnerability as referenced in the K11464209 advisory. - X509 certificate verification was not correctly implemented in the IP Intelligence Subscriptio...

F5 Networks BIG-IP : BIG-IP APM Portal Access vulnerability (K54358225)

In F5 BIG-IP APM software versions 11.5.0, 11.5.1, 11.5.2, 11.5.3, 11.5.4, 11.6.0, 11.6.1, 12.0.0, 12.1.0, 12.1.1 and 12.1.2 BIG-IP APM portal access requests do not return the intended resources in some cases. This may allow access to internal BIG-IP APM resources, however the application...