CVE-2021-22990

CVE-2021-22990 affects BIG-IP TMUI (Configuration utility) when Advanced WAF/ASM is provisioned. It is an authenticated remote command execution vulnerability in undisclosed TMUI pages that can be exploited by highly privileged, network-accessible users via the management port or self IPs. Fixed ...

CVE-2021-22990

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, on systems with Advanced WAF or BIG-IP ASM provisioned, the Traffic Management User Interface TMUI, also referred to as the...

CVE-2021-22987

CVE-2021-22987 is a confirmed BIG-IP TMUI (Configuration utility) vulnerability in Appliance mode. An authenticated remote attacker with network access to the BIG-IP management surface can execute arbitrary commands due to a flaw in undisclosed TMUI pages. Affected versions include 16.0.x before ...

CVE-2021-22987

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3 when running in Appliance mode, the Traffic Management User Interface TMUI, also referred to as the Configuration utility, has an...

Design/Logic Flaw

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, TMUI, also referred to as the Configuration utility, has an authenticated remote command execution vulnerability in undisclosed page...

CVE-2021-22988

CVE-2021-22988 affects BIG-IP TMUI (Configuration utility). In particular, authenticated remote command execution is possible via undisclosed TMUI pages on affected releases. Affected lines include BIG-IP 16.x before 16.0.1.1, 15.x before 15.1.2.1, 14.x before 14.1.4, 13.x before 13.1.3.6, 12.x b...

The vulnerability of the Advanced WAF/ASM TMUI application protection component of BIG-IP allows attackers to execute arbitrary commands, modify, or delete files.

The vulnerability of the Advanced WAF/ASM TMUI application protection component in BIG-IP is related to deficiencies in access control. Exploiting this vulnerability allows an attacker to execute arbitrary commands, modify or delete files remotely...

F5 BIGIP Appliance Mode TMUI Remote Command Execution Vulnerability

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, and remote access policy management. The TMUI remote command execution vulnerability in F5 BIGIP Appliance mode can be exploited by an attacker to execute arbitrar...

F5 BIG-IP 安全漏洞

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, and remote access policy management. F5 BIGIP AWAF/ASM Unauthorized User TMUI Remote Command Execution Vulnerability, the vulnerability allows a user with elevated...

F5 Networks BIG-IP : TMUI authenticated remote command execution vulnerability (K70031188)

The version of F5 Networks BIG-IP installed on the remote host is prior to 11.6.5.3 / 12.1.5.3 / 13.1.3.6 / 14.1.4 / 15.1.2.1 / 16.0.1.1 / 16.1.0. It is, therefore, affected by a vulnerability as referenced in the K70031188 advisory. - On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before...

F5 Networks BIG-IP : Appliance mode TMUI authenticated remote command execution vulnerability (K18132488)

The version of F5 Networks BIG-IP installed on the remote host is prior to 11.6.5.3 / 12.1.5.3 / 13.1.3.6 / 14.1.4 / 15.1.2.1 / 16.0.1.1 / 16.1.0. It is, therefore, affected by a vulnerability as referenced in the K18132488 advisory. - On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before...

F5 Networks BIG-IP : Advanced WAF/ASM TMUI authenticated remote command execution vulnerability (K45056101)

The version of F5 Networks BIG-IP installed on the remote host is prior to 11.6.5.3 / 12.1.5.3 / 13.1.3.6 / 14.1.4 / 15.1.2.1 / 16.0.1.1 / 16.1.0. It is, therefore, affected by a vulnerability as referenced in the K45056101 advisory. - On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before...

The vulnerability of the TMUI interface of the access control and remote authentication management tool BIG-IP Access Policy Manager, the BIG-IP Advanced Firewall Manager network interface, BIG-IP Advanced Web Application Firewall, the BIG-IP Application Acceleration Manager application delivery tools, the BIG-IP Application Security Manager application protection tools, the BIG-IP DDos Hybrid Defender DDoS attack protection tools, the BIG-IP DNS server, the BIG-IP Fraud Protection Service module, the BIG-IP Link Controller internet traffic balancing system, the BIG-IP Local Traffic Manager local traffic balancing system, the BIG-IP Policy Enforcement Manager network traffic control and management system, the SSL decryption and SSL encrypted traffic redirection tool SSL Orchestrator, allowing a perpetrator to execute arbitrary code.

The vulnerability of the TMUI interface of the BIG-IP Access Policy Manager, the BIG-IP Advanced Firewall Manager’s network interface, the BIG-IP Application Acceleration Manager’s application delivery components, the BIG-IP Application Security Manager’s application protection components, the...

CVE-2020-5948 — F5 TMUI XSS vulnerability

On BIG-IP versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.2.7, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, undisclosed endpoints in iControl REST allow for a reflected XSS attack, which could lead to a complete compromise of the BIG-IP system if the victim user is granted the...

CVE-2020-5945

In BIG-IP versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.2.7, undisclosed TMUI page contains a stored cross site scripting vulnerability XSS. The issue allows a minor privilege escalation for resource admin to escalate to full admin...

CVE-2020-5945

In BIG-IP versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.2.7, undisclosed TMUI page contains a stored cross site scripting vulnerability XSS. The issue allows a minor privilege escalation for resource admin to escalate to full admin...

CVE-2020-5940

In versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.2.3, a stored cross-site scripting XSS vulnerability exists in an undisclosed page of the BIG-IP Traffic Management User Interface TMUI, also known as the BIG-IP Configuration utility...

CVE-2020-5945

In BIG-IP versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.2.7, undisclosed TMUI page contains a stored cross site scripting vulnerability XSS. The issue allows a minor privilege escalation for resource admin to escalate to full admin...

Cross site scripting

In versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.2.3, a stored cross-site scripting XSS vulnerability exists in an undisclosed page of the BIG-IP Traffic Management User Interface TMUI, also known as the BIG-IP Configuration utility...

Cross site scripting

In BIG-IP versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.2.7, undisclosed TMUI page contains a stored cross site scripting vulnerability XSS. The issue allows a minor privilege escalation for resource admin to escalate to full admin...