F5 Networks BIG-IP : BIG-IP SSL state mirroring vulnerability (K65720640)

BIG-IP systems setup for connection mirroring in a High Availability HA pair transfers sensitive cryptographic objects over an insecure communications channel. This is a control plane issue which is exposed only on the network used for connection mirroring.CVE-2020-5886 Impact On-path attackers m...

F5 Networks BIG-IP : BIG-IP QKView vulnerability (K03318649)

When creating a QKView, credentials for binding to LDAP servers used for remote authentication of the BIG-IP administrative interface will not fully obfuscate if they contain whitespace. CVE-2020-5890 Impact The BIG-IP system may disclose sensitive information used for authentication with...

F5 Networks BIG-IP : BIG-IP SSL state mirroring vulnerability (K17663061)

BIG-IP systems set up for connection mirroring in a high availability HA pair transfersensitive cryptographic objects over an insecure communications channel. This is a control plane issue which is exposed only on the network used for connection mirroring.CVE-2020-5885 Impact On-path attackers ma...

F5 Networks BIG-IP : BIG-IP APM portal access reflected XSS vulnerability (K24415506)

The version of F5 Networks BIG-IP installed on the remote host is prior to 14.1.2.4 / 15.0.1.3 / 15.1.0.2. It is, therefore, affected by a vulnerability as referenced in the K24415506 advisory. - On versions 15.1.0-15.1.0.1, 15.0.0-15.0.1.2, and 14.1.0-14.1.2.3, in BIG-IP APM portal access, a...

F5 Networks BIG-IP : BIG-IP VE interface vulnerability (K03386032)

When the BIG-IP Virtual Edition VE is configured with VLAN groups and there are devices configured with OSPF connected to it, the Network Device Abstraction Layer NDAL Interfaces can lock up and in turn disruptingthe communication between the mcpd and tmm processesCVE-2020-5881. Impact This issue...

F5 Networks BIG-IP : BIG-IP APM virtual server vulnerability (K46901953)

In certain circumstances, an attacker sending specifically crafted requests to aBIG-IP APM virtual server may cause a disruption of service provided by the Traffic Management MicrokernelTMM. CVE-2020-5874 Impact An attacker may be able to perform a denial-of-service DoS attack on a BIG-IP system ...

F5 BIG-IQ Information Disclosure Vulnerability

F5 BIG-IQ is a software-based cloud management solution from F5 USA. The solution supports the deployment of application delivery and network services across public and private clouds, traditional data centers and hybrid environments. An information disclosure vulnerability exists in F5 BIG-IQ...

F5 BIG-IQ Access Control Error Vulnerability

F5 BIG-IQ is a software-based cloud management solution from F5 USA. The solution supports the deployment of application delivery and network services across public and private clouds, traditional data centers and hybrid environments. An access control error vulnerability exists in F5 BIG-IQ...

CVE-2020-5870

In BIG-IQ 5.2.0-7.0.0, high availability HA synchronization mechanisms do not use any form of authentication for connecting to the peer...

F5 Networks BIG-IP : Lodash library vulnerability (K47105354)

The version of F5 Networks BIG-IP installed on the remote host is prior to 12.1.5.2 / 13.1.3.4 / 13.1.3.5 / 14.1.2.5 / 14.1.2.7 / 15.0.1.4 / 15.1.0.5 / 15.1.1 / 16.0.0. It is, therefore, affected by a vulnerability as referenced in the K47105354 advisory. - Versions of lodash lower than 4.17.12 a...

F5 NGINX Controller Trust Management Issue Vulnerability

F5 NGINX Controller is a centralized monitoring and management platform for NGINX from F5. The platform supports the management of multiple NGINX instances using a visual interface. A security vulnerability exists in F5 NGINX Controller versions prior to 3.2.0, which stems from the fact that by...

F5 NGINX Controller Information Disclosure Vulnerability (CNVD-2020-33346)

F5 NGINX Controller is a centralized monitoring and management platform for NGINX from F5. The platform supports the management of multiple NGINX instances using a visual interface. A security vulnerability exists in F5 NGINX Controller versions prior to 3.3.0 that originates when NGINX Controlle...

PT-2020-05: Cross-site scripting (XSS) in F5 Traffic Management User Interface (TMUI)

The vulnerability allows remote attackers to execute malicious JavaScript code in the context of the current user. If the logged-on user has administrative rights and Advanced Shell bash access, an attacker who successfully exploited the vulnerability could fully compromise the BIG-IP system...

PT-2020-04: Arbitrary code execution in F5 Traffic Management User Interface (TMUI)

The vulnerability allows unauthorized remote attackers to execute malicious code on the system, obtain sensitive information, or hijack traffic, as well as use the server with the Traffic Management User Interface TMUI for attacks on other internal resources of the target organization. Advisory...

F5 BIG-IP and BIG-IQ Encryption Issues Vulnerability

F5 BIG-IP and F5 BIG-IQ are both products of F5 Corporation, U.S.A. F5 BIG-IP is an application delivery platform that integrates network traffic management, application security management, load balancing, etc. F5 BIG-IQ is a software-based cloud management solution. The solution supports the...

F5 Networks BIG-IP : ImageMagick vulnerability (K03512441)

ImageMagick before 7.0.8-50 has an integer overflow vulnerability in the function TIFFSeekCustomStream in coders/tiff.c. CVE-2019-13136 Impact BIG-IP AAM,Edge Gateway, WebAccelerator This issue affects BIG-IP systems only when WAM or AAM is provisioned.If exploited, this vulnerability may result ...

F5 Networks BIG-IP : ImageMagick vulnerability (K20336394)

ImageMagick before 7.0.8-50 has a 'use of uninitialized value' vulnerability in the function ReadCUTImage in coders/cut.c. CVE-2019-13135 Impact BIG-IP AAM,Edge Gateway, and WebAccelerator This issue affects BIG-IP systems only when WAM or AAM is provisioned. If exploited, this vulnerabilitymay...

F5 BIG-IP Buffer Error Vulnerability

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing and other functions. A security vulnerability exists in F5 BIG-IP versions 12.1.0 through 12.1.5. An attacker can exploit the vulnerability to caus...

F5 Networks BIG-IP : BIG-IP APM Portal Access vulnerability (K73183618)

The version of F5 Networks BIG-IP installed on the remote host is prior to 11.6.5.2 / 12.1.5.2 / 14.1.2.5 / 15.0.1.3 / 15.1.0.2 / 16.0.0. It is, therefore, affected by a vulnerability as referenced in the K73183618 advisory. InBIG-IP APM Portal Access, HTTP pages that are served by back-end serve...

F5 BIG-IP Input Validation Error Vulnerability (CNVD-2020-24027)

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing and other functions. A security vulnerability exists in F5 BIG-IP versions 15.1.0 through 15.1.0.1, 15.0.0 through 15.0.1.1, and 14.1.0 through...