K23876153: BIG-IP APM Edge Client logging vulnerability CVE-2019-6656

Security Advisory Description BIG-IP APM Edge Client logs the full BIG-IP APM session ID in the log files. CVE-2019-6656 Impact This vulnerability may allow unauthorized disclosure of the BIG-IP APM session ID and expose sensitive information to the user of the client device. Security Advisory...

K01226413: The BIG-IP APM PingAccess component caching vulnerability may lead to user impersonation

Security Advisory Description This issue occurs when all of the following conditions are met: You configure Ping Identity Services in the BIG-IP APM system for user authentication and authorization. You are running a BIG-IP APM version using the Ping Access SDK that is vulnerable. Impact This...

K15746: Linux kernel vulnerability CVE-2012-4542

Security Advisory Description Description block/scsiioctl.c in the Linux kernel through 3.8 does not properly consider the SCSI device class during authorization of SCSI commands, which allows local users to bypass intended access restrictions via an SGIO ioctl call that leverages overlapping...

K16318: OpenSSL vulnerability CVE-2015-0287

Security Advisory Description The ASN1itemexd2i function in crypto/asn1/tasndec.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not reinitialize CHOICE and ADB data structures, which might allow attackers to cause a denial of service invalid wri...

K30343902: BIG-IP APM XSS vulnerability CVE-2020-27726

Security Advisory Description A reflected cross-site scripting XSS vulnerability exists in the resource information page for authenticated users when a full webtop is configured on the BIG-IP APM system. CVE-2020-27726 Impact An attacker can craft a malicious URL and send it to an authenticated...

K51574311: BIG-IP APM vulnerability CVE-2020-27716

Security Advisory Description When a BIG-IP APM virtual server processes traffic of an undisclosed nature, the Traffic Management Microkernel TMM stops responding and restarts. CVE-2020-27716 Impact Traffic processing is disrupted while TMM restarts. If the affected BIG-IP system is configured as...

K46901953: BIG-IP APM virtual server vulnerability CVE-2020-5874

Security Advisory Description In certain circumstances, an attacker sending specifically crafted requests to a BIG-IP APM virtual server may cause a disruption of service provided by the Traffic Management MicrokernelTMM. CVE-2020-5874 Impact An attacker may be able to perform a denial-of-service...

K93526903: BIG-IP APM portal access vulnerability CVE-2022-23014

Security Advisory Description When BIG-IP APM portal access is configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel TMM to terminate. CVE-2022-23014 Impact Traffic is disrupted while the TMM process restarts. This vulnerability allows an authenticated...

K82679059: BIG-IP APM SSO vulnerability CVE-2016-3686

Security Advisory Description Cleartext SessionID is visible in URL query parameters under some conditions. CVE-2016-3686 Impact There is a theoretical risk that a user could obtain unauthorized access to the system, causing a security breach. Security Advisory Status F5 Product Development has...

CVE-2023-22341

On version 14.1.x before 14.1.5.3, and all versions of 13.1.x, when the BIG-IP APM system is configured with all the following elements, undisclosed requests may cause the Traffic Management Microkernel TMM to terminate: An OAuth Server that references an OAuth Provider An OAuth profile with the...

CVE-2023-22341

On version 14.1.x before 14.1.5.3, and all versions of 13.1.x, when the BIG-IP APM system is configured with all the following elements, undisclosed requests may cause the Traffic Management Microkernel TMM to terminate: An OAuth Server that references an OAuth Provider An OAuth profile with the...

Open redirect

On versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.7, 14.1.x before 14.1.5.3, and all versions of 13.1.x, an open redirect vulnerability exists on virtual servers enabled with a BIG-IP APM access policy. This vulnerability allows an unauthenticated malicious attacker t...

Design/Logic Flaw

On version 14.1.x before 14.1.5.3, and all versions of 13.1.x, when the BIG-IP APM system is configured with all the following elements, undisclosed requests may cause the Traffic Management Microkernel TMM to terminate: An OAuth Server that references an OAuth Provider An OAuth profile with the...

CVE-2023-22418 BIG-IP APM virtual server vulnerability

On versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.7, 14.1.x before 14.1.5.3, and all versions of 13.1.x, an open redirect vulnerability exists on virtual servers enabled with a BIG-IP APM access policy. This vulnerability allows an unauthenticated malicious attacker t...

CVE-2023-22418 BIG-IP APM virtual server vulnerability

On versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.7, 14.1.x before 14.1.5.3, and all versions of 13.1.x, an open redirect vulnerability exists on virtual servers enabled with a BIG-IP APM access policy. This vulnerability allows an unauthenticated malicious attacker t...

CVE-2023-22418

CVE-2023-22418 describes an open redirect vulnerability in BIG-IP APM virtual servers. An unauthenticated attacker can craft a redirect URI to steer users to malicious sites. Affected branches include BIG-IP APM on 17.x (before 17.0.0.2), 16.x (before 16.1.3.3), 15.x (before 15.1.7), 14.x (before...

CVE-2023-22341 BIG-IP APM OAuth vulnerability

On version 14.1.x before 14.1.5.3, and all versions of 13.1.x, when the BIG-IP APM system is configured with all the following elements, undisclosed requests may cause the Traffic Management Microkernel TMM to terminate: An OAuth Server that references an OAuth Provider An OAuth profile with the...

CVE-2023-22341

CVE-2023-22341 affects the BIG-IP APM module. When configured with: (1) an OAuth Server referencing an OAuth Provider, (2) an OAuth profile with the Authorization Endpoint set to '/', and (3) an access profile referencing the above OAuth profile tied to an HTTPS virtual server, undisclosed reques...

CVE-2023-22341 BIG-IP APM OAuth vulnerability

On version 14.1.x before 14.1.5.3, and all versions of 13.1.x, when the BIG-IP APM system is configured with all the following elements, undisclosed requests may cause the Traffic Management Microkernel TMM to terminate: An OAuth Server that references an OAuth Provider An OAuth profile with the...

K000130496: Overview of F5 vulnerabilities (February 2023)

Security Advisory Description On February 1, 2023, F5 announced the following security issues. This document is intended to serve as an overview of these vulnerabilities and security exposures to help determine the impact to your F5 devices. You can find the details of each issue in the associate...