CVE-2022-28708

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2 and 15.1.x versions prior to 15.1.5.1, when a BIG-IP DNS resolver-enabled, HTTP-Explicit or SOCKS profile is configured on a virtual server, an undisclosed DNS response can cause the Traffic Management Microkernel TMM process to terminate. Note:...

CVE-2022-28708

CVE-2022-28708 affects F5 BIG-IP in 16.1.x (before 16.1.2.2) and 15.1.x (before 15.1.5.1) when a DNS resolver-enabled, HTTP-Explicit or SOCKS profile is on a virtual server. An undisclosed DNS response can cause the Traffic Management Microkernel (TMM) process to terminate, resulting in functiona...

CVE-2022-28707

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, and 14.1.x versions prior to 14.1.4.6, a stored cross-site scripting XSS vulnerability exists in an undisclosed page of the BIG-IP Configuration utility also referred to as the BIG-IP TMUI that allows an attacker t...

CVE-2022-28707

CVE-2022-28707 is a stored XSS in BIG-IP TMUI (Configuration utility). Affected versions: BIG-IP 16.1.0–16.1.2.2, 15.1.0–15.1.5, 14.1.0–14.1.4.6. The vulnerability allows executing JavaScript in the context of the currently logged-in user via an undisclosed TMUI page. The advisory notes exploitat...

CVE-2022-28706

On F5 BIG-IP 16.1.x versions prior to 16.1.2 and 15.1.x versions prior to 15.1.5.1, when the DNS resolver configuration is used, undisclosed requests can cause the Traffic Management Microkernel TMM to terminate. Note: Software versions which have reached End of Technical Support EoTS are not...

CVE-2022-28706

CVE-2022-28706 affects F5 BIG-IP with DNS resolver enabled. Vulnerability in the DNS resolver can cause the Traffic Management Microkernel (TMM) to terminate, producing a DoS. Affected are BIG-IP 16.1.x before 16.1.2 and 15.1.x before 15.1.5.1 (EoTS exclusions apply). Fixes are provided in the ad...

CVE-2022-28705

The CVE-2022-28705 issue affects F5 BIG-IP platforms with a built-in ePVA acceleration and the pva.fwdaccel BigDB setting, where undisclosed requests to a virtual server using a FastL4 profile with ePVA can cause the Traffic Management Microkernel (TMM) to terminate, leading to DoS. Affected vers...

CVE-2022-28705

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, on platforms with an ePVA and the pva.fwdaccel BigDB variable enabled, undisclosed requests to a virtual server with a FastL4 profile that has...

CVE-2022-28701

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, when the stream profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2022-28701

CVE-2022-28701 (F5 BIG-IP Stream profile DoS) In F5 BIG-IP 16.1.x, when a stream profile is configured on a virtual server, certain undisclosed requests can cause memory resource utilization to spike, degrading system performance and potentially causing a TMM restart or DoS. The advisory confirms...

CVE-2022-28695

CVE-2022-28695 affects F5 BIG-IP AFM/ TMUI: an authenticated attacker with high privileges can upload a maliciously crafted file via the BIG-IP AFM Configuration utility to execute arbitrary commands on the system. Affected branches and fixes (per vendor advisory): BIG-IP AFM 16.1.x versions 16.1...

CVE-2022-28695

On F5 BIG-IP AFM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, an authenticated attacker with high privileges can upload a maliciously crafted file to the BIG-IP AFM Configuration utility, which allows...

CVE-2022-28691

CVE-2022-28691 affects F5 BIG-IP where RTSP profiles on a virtual server can cause undisclosed traffic to increase TMM resource utilization, leading to degraded performance or DoS. Affected branches and fixes per F5 advisory: BIG-IP 16.1.x before 16.1.2.2; 15.1.x before 15.1.5; 14.1.x before 14.1...

CVE-2022-28691

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, when a Real Time Streaming Protocol RTSP profile is configured on a virtual server, undisclosed traffic can cause an increase in Traffic...

CVE-2022-27880

CVE-2022-27880 (F5 Traffix SDC) : A stored Cross-Site Scripting (XSS) vulnerability exists in an undisclosed page of the Traffix SDC Configuration utility. Affected versions are 5.2.x prior to 5.2.2 and 5.1.x prior to 5.1.35. An authenticated attacker can store malicious HTML/JavaScript that exec...

CVE-2022-27880

On F5 Traffix SDC 5.2.x versions prior to 5.2.2 and 5.1.x versions prior to 5.1.35, a stored Cross-Site Scripting XSS vulnerability exists in an undisclosed page of the Traffix SDC Configuration utility that allows an attacker to execute JavaScript in the context of the currently logged-in user...

CVE-2022-27878

On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP, and F5 BIG-IP Guided Configuration GC all versions prior to 9.0, a stored cross-site scripting XSS vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to execute...

CVE-2022-27878

CVE-2022-27878 is a stored cross-site scripting (XSS) vulnerability in F5 BIG-IP TMUI/Guided Configuration. The issue affects BIG-IP TMUI and GC across multiple major versions (16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, 11.6.x) and, for Guided Configuration, all versions before 9.0. The root cause i...

CVE-2022-27878

On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP, and F5 BIG-IP Guided Configuration GC all versions prior to 9.0, a stored cross-site scripting XSS vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to execute...

CVE-2022-27875

On F5 Access for Android 3.x versions prior to 3.0.8, a Task Hijacking vulnerability exists in the F5 Access for Android application, which may allow an attacker to steal sensitive user information. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...