F5 BIG-IP AFM CVE-2019-6672 Denial of Service Vulnerability

Description F5 BIG-IP AFM is prone to a denial-of-service vulnerability. Attackers can exploit this issue to cause a denial-of-service condition, denying service to legitimate users. BIG-IP AFM 15.0.0 through 15.0.1, 14.1.0 through 14.1.2, and 13.1.0 through 13.1.3 are vulnerable. Technologies...

Multiple F5 BIG-IP Products CVE-2019-6670 Information Disclosure Vulnerability

Description Multiple F5 BIG-IP Products are prone to an information-disclosure vulnerability. Successfully exploiting this issue may allow attackers to obtain sensitive information. This may lead to other attacks. Technologies Affected F5 BIG-IP AAM 11.6.1 F5 BIG-IP AFM 11.6.1 F5 BIG-IP APM 11.6....

Multiple F5 BIG-IP Products CVE-2019-6671 Memory Leak Denial of Service Vulnerability

Description Multiple F5 BIG-IP Products are prone to a denial-of-service vulnerability. Attackers can exploit this issue to cause a denial of service condition. Technologies Affected F5 BIG-IP AAM 13.1.0 F5 BIG-IP AAM 13.1.3 F5 BIG-IP AAM 14.0.0 F5 BIG-IP AAM 14.0.1 F5 BIG-IP AAM 14.1.0 F5 BIG-IP...

F5 BIG-IP AFM SQL Injection Vulnerability

F5 BIG-IP AFM is an advanced firewall product for protection against DDos attacks. F5 BIG-IP AFM suffers from a SQL injection vulnerability, which can be exploited by remote attackers to submit a special SQL request to manipulate a database, obtain sensitive information or execute arbitrary code...

CVE-2019-6658

On BIG-IP AFM 15.0.0-15.0.1, 14.0.0-14.1.2, 13.1.0-13.1.3.1, and 12.1.0-12.1.5, a vulnerability in the AFM configuration utility may allow any authenticated BIG-IP user to run an SQL injection attack...

Sql injection

On BIG-IP AFM 15.0.0-15.0.1, 14.0.0-14.1.2, 13.1.0-13.1.3.1, and 12.1.0-12.1.5, a vulnerability in the AFM configuration utility may allow any authenticated BIG-IP user to run an SQL injection attack...

CVE-2019-6658

On BIG-IP AFM 15.0.0-15.0.1, 14.0.0-14.1.2, 13.1.0-13.1.3.1, and 12.1.0-12.1.5, a vulnerability in the AFM configuration utility may allow any authenticated BIG-IP user to run an SQL injection attack...

CVE-2019-6658

CVE-2019-6658 - BIG-IP AFM SQL injection : A vulnerability in the BIG-IP AFM Configuration utility allows any authenticated BIG-IP user to perform SQL injection. Affected versions include 12.x (12.1.0–12.1.5), 13.x (13.1.0–13.1.3), 14.x (14.0.0–14.1.2), and 15.x (15.0.0–15.0.1). The root cause is...

F5 BIG-IP AFM CVE-2019-6658 SQL Injection Vulnerability

Description F5 BIG-IP AFM is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input before using it in an SQL query. An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the...

CVE-2019-6639

On BIG-IP AFM, PEM 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.1-11.5.8, an undisclosed TMUI pages for AFM and PEM Subscriber management are vulnerable to a stored cross-site scripting XSS issue. This is a control plane issue only and is not...

CVE-2019-6636

On BIG-IP AFM, ASM 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, and 11.5.1-11.6.4, a stored cross-site scripting vulnerability in AFM feed list. In the worst case, an attacker can store a CSRF which results in code execution as the admin user. The level of user role which can...

Cross site scripting

On BIG-IP AFM, ASM 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, and 11.5.1-11.6.4, a stored cross-site scripting vulnerability in AFM feed list. In the worst case, an attacker can store a CSRF which results in code execution as the admin user. The level of user role which can...

Cross site scripting

On BIG-IP AFM, PEM 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.1-11.5.8, an undisclosed TMUI pages for AFM and PEM Subscriber management are vulnerable to a stored cross-site scripting XSS issue. This is a control plane issue only and is not...

CVE-2019-6636

On BIG-IP AFM, ASM 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, and 11.5.1-11.6.4, a stored cross-site scripting vulnerability in AFM feed list. In the worst case, an attacker can store a CSRF which results in code execution as the admin user. The level of user role which can...

CVE-2019-6636

CVE-2019-6636 affects F5 BIG-IP AFM/ASM Feed List with a stored XSS that can lead to CSRF and, in the worst case, code execution as an admin user. Affected versions include BIG-IP 11.5.1–11.6.4, 12.1.0–12.1.4, 13.0.0–13.1.4, 14.0.0–14.0.4, and 14.1.0–14.1.0.5. Root cause is a stored XSS in the AF...

F5 Networks BIG-IP : BIG-IP AFM and PEM TMUI XSS vulnerability (K61002104)

Undisclosed TMUI pages for AFM and PEM Subscriber management are vulnerable to a stored cross-site scripting XSS issue. This is a control plane issue only and is not accessible from the data plane. The attack requires a malicious resource administrator to store the XSS. CVE-2019-6639 Impact A...

CVE-2019-6609

CVE-2019-6609 affects BIG-IP on iSeries (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator) where the secureKeyCapable attribute is not set. This prevents Secure Vault from using F5 hardware support to protect the unit key, causing the unit key ...

F5 Networks BIG-IP : BIG-IP AFM vulnerability (K20682450)

X509 certificate verification was not correctly implementedin the early access 'user id' feature in the BIG-IP Advanced Firewall Manager, and thus did not properly validate the remote server's identity on certain versions of BIG-IP. CVE-2017-6142 Impact In affected BIG-IP AFM versions, the system...

F5 Networks BIG-IP : BIG-IP ASM and BIG-IP AFM/BIG-IP Analytics vulnerability (K23520761)

On F5 BIG-IP 13.1.0 - 13.1.0.3, when ASM and one or more of these modules AFM/AVR are provisioned, the Traffic Management Microkernel TMM may restart while processing DNS requests when thevirtual server is configured with a DNS profile and the Protocol setting is set to TCP . CVE-2018-5505 Note :...

F5 Networks BIG-IP : SQL injection vulnerability (K39428424)

The SQL injection vulnerability in the Configuration utility is related to the BIG-IP AFM system.CVE-2017-0304 Impact An attacker can exploit this vulnerabilityregardless of the BIG-IP AFM provisioning configuration; however, exploiting this vulnerability does not impact traffic processing or the...