CVE-2016-5235

A Cross Site Scripting XSS vulnerability in versions of F5 WebSafe Dashboard 3.9.x and earlier, aka F5 WebSafe Alert Server, allows an unauthenticated user to inject HTML via a crafted alert...

PT-2019-7831

Name of the Vulnerable Software and Affected Versions F5 WebSafe Dashboard versions 3.9.x and earlier Description A Cross Site Scripting XSS issue allows an unauthenticated user to inject HTML via a crafted alert. This enables potential attackers to execute malicious scripts on the client-side...

PT-2019-7832

Name of the Vulnerable Software and Affected Versions F5 WebSafe Dashboard versions 3.9.5 and earlier Description The issue allows privileged authenticated users to inject arbitrary web script or HTML when creating a new user, account, or signature. This is a Cross-Site-Scripting XSS vulnerabilit...

CVE-2016-5236: Improper Neutralization of Input During Web Page Generation

Cross-Site-Scripting XSS vulnerabilities in F5 WebSafe Dashboard 3.9.5 and earlier, aka F5 WebSafe Alert Server, allow privileged authenticated users to inject arbitrary web script or HTML when creating a new user, account or signature...

CVE-2016-5235: Improper Neutralization of Input During Web Page Generation

A Cross Site Scripting XSS vulnerability in versions of F5 WebSafe Dashboard 3.9.x and earlier, aka F5 WebSafe Alert Server, allows an unauthenticated user to inject HTML via a crafted alert...

F5 WebSafe Alert Server Arbitrary Code Execution Vulnerability

F5 WebSafe is a suite of web fraud protection solutions from F5 USA. The solution provides malware and fraud detection, client-side mobile threat protection, etc. F5 WebSafe Alert Server is one of the alert services. A security vulnerability exists in F5 WebSafe Alert Server versions 1.0.0 throug...

Code injection

On F5 WebSafe Alert Server 1.0.0-4.2.6, a malicious, authenticated user can execute code on the alert server by using a maliciously crafted payload...

CVE-2018-5545

On F5 WebSafe Alert Server 1.0.0-4.2.6, a malicious, authenticated user can execute code on the alert server by using a maliciously crafted payload...

CVE-2018-5545

On F5 WebSafe Alert Server 1.0.0-4.2.6, a malicious, authenticated user can execute code on the alert server by using a maliciously crafted payload...

CVE-2018-5545

On F5 WebSafe Alert Server 1.0.0-4.2.6, a malicious, authenticated user can execute code on the alert server by using a maliciously crafted payload...

CVE-2018-5545

CVE-2018-5545 affects F5 WebSafe Alert Server versions 1.0.0–4.2.6. An authenticated user can execute arbitrary code on the alert server by sending a malicious payload via the Dashboard. The advisory lists CVSSv3.0 score 8.8 (HIGH) with network access, low privileges required, and no user interac...

PT-2018-17039

Name of the Vulnerable Software and Affected Versions F5 WebSafe Alert Server versions 1.0.0 through 4.2.6 Description A malicious, authenticated user can execute code on the alert server by using a maliciously crafted payload. Recommendations For F5 WebSafe Alert Server versions 1.0.0 through...

CVE-2018-5545: Improper Input Validation

On F5 WebSafe Alert Server 1.0.0-4.2.6, a malicious, authenticated user can execute code on the alert server by using a maliciously crafted payload...

CVE-2017-6136

In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and WebSafe software version 13.0.0 and 12.0.0 - 12.1.2, undisclosed traffic patterns sent to BIG-IP virtual servers, with the TCP Fast Open and Tail Loss Probe options enabled in the associated TCP profile, may cause...

Design/Logic Flaw

In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and WebSafe software version 13.0.0 and 12.0.0 - 12.1.2, undisclosed traffic patterns sent to BIG-IP virtual servers, with the TCP Fast Open and Tail Loss Probe options enabled in the associated TCP profile, may cause...

Code injection

In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and Websafe software version 13.0.0, 12.0.0 to 12.1.2, 11.6.0 to 11.6.1 and 11.5.0 - 11.5.4, an undisclosed sequence of packets sent to BIG-IP High Availability state mirror listeners primary and/or secondary IP may...

CVE-2017-6135

CVE-2017-6135 affects F5 BIG-IP software (LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM, WebSafe) version 13.0.0. The issue is a slow memory leak caused by undisclosed IPv4/IPv6 packets sent to the BIG-IP management port or self IP addresses, which can lead to out-of-memory (...

CVE-2017-6138

In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and WebSafe software version 13.0.0 and 12.1.0 - 12.1.2, malicious requests made to virtual servers with an HTTP profile can cause the TMM to restart. The issue is exposed with BIG-IP APM profiles, regardless of...

CVE-2017-6167

CVE-2017-6167 is a race-condition vulnerability in F5 BIG-IP iControl REST that can cause commands to execute with elevated privileges. Affected BIG-IP versions include 13.x (13.0.0), 12.x (12.1.0–12.1.2), 14.x (14.1.x), 15.x (15.0–15.1.1/2), and 16.x (16.0.0–16.0.1). Red Hat and F5 advisories co...

CVE-2017-6132

CVE-2017-6132 affects F5 BIG-IP LTM and multiple modules (AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM, WebSafe) across versions 11.5.0–11.5.4, 11.6.0–11.6.1, 12.0.0–12.1.2, and 13.0.0. The issue stems from an undisclosed sequence of packets sent to HA mirror listeners that may c...