F5 Networks BIG-IP : jQuery vulnerability (K02453220)

The version of F5 Networks BIG-IP installed on the remote host is prior to 17.1.3.1 / 17.5.1.4. It is, therefore, affected by a vulnerability as referenced in the K02453220 advisory. In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after...

F5 Networks BIG-IP : glibc vulnerability (K35040315)

The version of F5 Networks BIG-IP installed on the remote host is prior to 16.0.0. It is, therefore, affected by a vulnerability as referenced in the K35040315 advisory. - In the GNU C Library aka glibc or libc6 through 2.28, the getaddrinfo function would successfully parse a string that contain...

F5 Networks BIG-IP : BIG-IP APM Appliance mode vulnerability (K34893234)

The version of F5 Networks BIG-IP installed on the remote host is prior to 15.1.4 / 16.1.1 / 17.0.0. It is, therefore, affected by a vulnerability as referenced in the K34893234 advisory. - In BIG-IP Versions 16.1.x before 16.1.1 and 15.1.x before 15.1.4, when running in Appliance mode, an...

F5 Networks BIG-IP : Python vulnerability (K11068141)

The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the K11068141 advisory. - The HTTP clients in the 1 httplib, 2 urllib, 3 urllib2, and 4 xmlrpclib libraries in CPython aka Python 2.x before...

Exploit for Missing Authentication for Critical Function in F5 Big-Ip_Access_Policy_Manager

Vulnerability Details fofa： title="BIG-IP" || i...

Exploit for Missing Authentication for Critical Function in F5 Big-Ip_Access_Policy_Manager

Vulnerability Details fofa： title="BIG-IP" || i...

Alert: F5 Warns of Active Attacks Exploiting BIG-IP Vulnerability

F5 is warning of active abuse of a critical security flaw in BIG-IP less than a week after its public disclosure, resulting in the execution of arbitrary system commands as part of an exploit chain. Tracked as CVE-2023-46747 CVSS score: 9.8, the vulnerability allows an unauthenticated attacker wi...

F5 BIG-IP Remote Code Execution Vulnerability (CNVD-2023-82300)

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, and remote access policy management. F5 BIG-IP suffers from a remote code execution vulnerability caused by a configuration utility authentication bypass flaw. An...

Patch now! BIG-IP Configuration utility is vulnerable for an authentication bypass

Tech company F5 has warned customers about a critical authentication bypass vulnerability impacting its BIG-IP product line that could result in unauthenticated remote code execution. F5 provides services focused on security, reliability, and performance. BIG-IP is a collection of hardware...

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2023-46747 F5 BIG-IP Authentication Bypass Vulnerability CVE-2023-46748 F5 BIG-IP SQL Injection Vulnerability These types of vulnerabilities are frequent attack...

F5 BIG-IP Configuration Utility SQL Injection Vulnerability

F5 BIG-IP Configuration utility contains an SQL injection vulnerability that may allow an authenticated attacker with network access through the BIG-IP management port and/or self IP addresses to execute system commands. This vulnerability can be used in conjunction with CVE-2023-46747...

VulnCheck KEV: CVE-2023-46747

F5 BIG-IP Configuration utility contains an authentication bypass using an alternate path or channel vulnerability due to undisclosed requests that may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute system...

F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability

F5 BIG-IP Configuration utility contains an authentication bypass using an alternate path or channel vulnerability due to undisclosed requests that may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute system...

Exploit for Missing Authentication for Critical Function in F5 Big-Ip_Access_Policy_Manager

CVE-2023-46747-POC F5 BIG-IP unauthenticated remote code execu...

VulnCheck KEV: CVE-2023-46748

F5 BIG-IP Configuration utility contains an SQL injection vulnerability that may allow an authenticated attacker with network access through the BIG-IP management port and/or self IP addresses to execute system commands. This vulnerability can be used in conjunction with CVE-2023-46747...

Imperva Customers are Protected Against the Latest F5 BIG-IP Vulnerability

Imperva is tracking the recent critical security vulnerability impacting F5’s BIG-IP solution. The vulnerability, CVE-2023-46747, could allow an attacker to bypass authentication and potentially compromise the system via request smuggling. Imperva Threat Research has been actively monitoring this...

F5 Issues Warning: BIG-IP Vulnerability Allows Remote Code Execution

F5 has alerted customers of a critical security vulnerability impacting BIG-IP that could result in unauthenticated remote code execution. The issue, rooted in the configuration utility component, has been assigned the CVE identifier CVE-2023-46747, and carries a CVSS score of 9.8 out of a maximu...

F5 Networks BIG-IP : Multiple Vulnerabilities (K000137353, K000137365)

The version of F5 Networks BIG-IP installed on the remote host is potentially affected by multiple vulnerabilities as referenced in the K000137353 and K000137365 advisories: - K000137353: BIG-IP Configuration utility unauthenticated remote code execution vulnerability CVE-2023-46747 - K000137365:...

K000137368: Overview of F5 vulnerabilities (October 26, 2023)

Security Advisory Description On October 26, 2023, F5 announced the following security issues. This document is intended to serve as an overview of these vulnerabilities and security exposures to help determine the impact to your F5 devices. You can find the details of each issue in the associate...

F5 BIG-IP TMUI AJP Smuggling RCE

This module exploits a flaw in F5's BIG-IP Traffic Management User Interface TMUI that enables an external, unauthenticated attacker to create an administrative user. Once the user is created, the module uses the new account to execute a command payload. Both the exploit and check methods...