F5 BIG-IP Information Disclosure Vulnerability (CNVD-2019-41648)

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing and other functions. A security vulnerability exists in F5 BIG-IP versions 13.1.0 through 13.1.1. An attacker could exploit the vulnerability to vi...

CVE-2019-6662

On BIG-IP 13.1.0-13.1.1.4, sensitive information is logged into the local log files and/or remote logging targets when restjavad processes an invalid request. Users with access to the log files would be able to view that data...

F5 BIG-IP APM CVE-2019-6661 Denial of Service Vulnerability

Description F5 BIG-IP APM is prone to a denial-of-service vulnerability. Attackers can exploit this issue to cause excessive resource consumption, resulting in a denial-of-service condition. BIG-IP APM 14.1.0 through 14.1.2, 14.0.0 through 14.0.1, 13.0.0 through 13.1.3, 12.1.0 through 12.1.4, and...

Multiple F5 BIG-IP Products CVE-2019-6664 Remote Security Vulnerability

Description Multiple F5 BIG-IP Products are prone to a remote security vulnerability. An attacker can leverage this issue to bypass security restrictions and perform unauthorized actions. This may aid in further attacks. Technologies Affected F5 BIG-IP AAM 14.1.0 F5 BIG-IP AAM 15.0.0 F5 BIG-IP AF...

Multiple F5 BIG-IP Products CVE-2019-6662 Multiple Information Disclosure Vulnerabilities

Description Multiple F5 BIG-IP Products are prone to multiple information-disclosure vulnerabilities. Successfully exploiting these issues may allow attackers to obtain sensitive information. This may lead to other attacks. Technologies Affected F5 BIG-IP AAM 13.1.0 F5 BIG-IP AAM 13.1.1 F5 BIG-IP...

Vulnerability discovered in F5 BIG-IP and BIG-IQ

F5 has discovered a vulnerability in BIG-IP and BIG-IQ products. The vulnerability is located in lodash version 4.17.12, a javascript programming library. A malicious person with access to the Traffic Management User Interface TMUI or the iControl REST API could exploit the vulnerability to execu...

F5 BIG-IQ Detection Consolidation

Consolidation of F5 BIG-IQ detections. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.143118";...

F5 BIG-IP cross-site scripting vulnerability (CNVD-2019-39753)

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing and other functions. A cross-site scripting vulnerability exists in F5 BIG-IP versions 13.1.0 through 13.1.3, 12.1.0 through 12.1.5, and 11.5.2...

F5 BIG-IP AFM CVE-2019-6658 SQL Injection Vulnerability

Description F5 BIG-IP AFM is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input before using it in an SQL query. An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the...

Multiple F5 BIG-IP Products CVE-2019-6657 Cross Site Scripting Vulnerability

Description Multiple F5 BIG-IP Products are prone to a cross-site scripting vulnerability because they fail to sufficiently sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site...

F5 Networks BIG-IP : BIG-IP APM client for Windows vulnerability (K10015187)

Windows Logon Integration feature of F5 BIG-IP APM client prior to version 7.1.7.1 for Windows by default uses Legacy logon mode which uses a SYSTEM account to establish network access. This feature displays a certificate user interface dialog box which contains the link to the certificate policy...

F5 BIG-IQ Centralized Management CVE-2019-6653 HTML Injection Vulnerability

Description F5 BIG-IQ Centralized Management is prone to an HTML-injection vulnerability because it fails to sanitize user-supplied input. Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected site, potentially allowing the attacker to steal...

F5 Networks BIG-IP : HTTP/2 Ping Flood vulnerability (K98053339)

The version of F5 Networks BIG-IP installed on the remote host is prior to 11.6.5.1 / 12.1.5.1 / 13.1.3.2 / 14.0.1.1 / 14.1.2.1 / 15.0.1.1 / 15.1.0. It is, therefore, affected by a vulnerability as referenced in the K98053339 advisory. Some HTTP/2 implementations are vulnerable to ping floods,...

F5 Networks BIG-IP : Linux SACK Panic vulnerability (K78234183)

Jonathan Looney discovered that the TCPSKBCBskb-tcpgsosegs value was subject to an integer overflow in the Linux kernel when handling TCP Selective Acknowledgments SACKs. A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182,...

F5 BIG-IP and F5 BIG-IP APM Clients Information Disclosure Vulnerability

F5 BIG-IP APM Clients and F5 BIG-IP are both products of F5 Corporation, U.S.A. F5 BIG-IP APM Clients is a suite of APM client software.F5 BIG-IP is an application delivery platform that integrates the functions of network traffic management, application security management and load balancing. An...

F5 Networks BIG-IP : Excess resource consumption due to low MSS values vulnerability (K35421172)

Jonathan Looney discovered that the Linux kernel default MSS is hard-coded to 48 bytes. This allows a remote peer to fragment TCP resend queues significantly more than if a larger MSS were enforced. A remote attacker could use this to cause a denial of service. This has been fixed in stable kerne...

F5 Networks BIG-IP : REST Framework vulnerability (K89509323)

The version of F5 Networks BIG-IP installed on the remote host is prior to 11.6.5 / 12.1.5 / 13.1.3 / 14.0.1 / 14.1.2 / 15.0.1 / 15.1.0. It is, therefore, affected by a vulnerability as referenced in the K89509323 advisory. The BIG-IP/BIG-IQ Configuration utility login page may not follow best...

F5 Networks BIG-IP : HTTP/2 Reset Flood vulnerability (K01988340)

Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RSTSTREAM frames from the peer. Depending on how the peer queues the...

F5 Networks BIG-IP : BIG-IP Analytics vulnerability (K31152411)

BIG-IP platforms provisioned with AAM, AFM,Application Visibility and Reporting AVR, APM, ASM, and/or PEM may leak sensitive data. CVE-2019-6655 Impact BIG-IP AAM, AFM, AVR, APM, ASM, PEM The vulnerability is only present on BIG-IP systems provisioned with AAM, AFM, AVR, APM, ASM, and/or PEM on t...

F5 BIG-IQ Centralized Management CVE-2019-6652 Security Bypass Vulnerability

Description F5 BIG-IQ Centralized Management is prone to a remote security-bypass vulnerability. Successfully exploiting this issue may allow an attacker to bypass certain security restrictions and perform unauthorized actions. Technologies Affected F5 BIG-IQ Centralized Management 6.0.1 F5 BIG-I...