K08510472: BIG-IP TMUI vulnerability CVE-2022-28695

Security Advisory Description An authenticated attacker with high privileges can upload a maliciously crafted file to the BIG-IP AFM Configuration utility, which allows an attacker to run arbitrary commands. CVE-2022-28695 Impact This vulnerability may allow an authenticated high-privilege attack...

K00432398: BIG-IP TMUI XSS vulnerability CVE-2019-6626

Security Advisory Description A reflected cross-site scripting XSS vulnerability exists in an undisclosed page of the BIG-IP Traffic Management User Interface TMUI, also known as the BIG-IP Configuration utility. CVE-2019-6626 Impact If a targeted administrative user accesses the Configuration...

K30500703: TMUI vulnerability CVE-2018-5511

Security Advisory Description When authenticated administrative users run commands in the Traffic Management User Interface TMUI, also referred to as the BIG-IP Configuration utility, restrictions on allowed commands may not be enforced. CVE-2018-5511 Impact This vulnerability allows a privilege...

K31301245: TMUI CSRF vulnerability CVE-2020-5904

Security Advisory Description A cross-site request forgery CSRF vulnerability in the Traffic Management User Interface TMUI, also referred to as the Configuration utility, exists in an undisclosed page. CVE-2020-5904 Impact An attacker may be able to use the session of an administrator user to...

K21435974: TMUI XSS vulnerability CVE-2021-23037

Security Advisory Description A reflected cross-site scripting XSS vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to execute JavaScript in the context of the currently logged-in user. CVE-2021-23037 Impact An attacker may exploit this...

K55879220: Overview of F5 vulnerabilities (May 2022)

Security Advisory Description On May 4, 2022, F5 announced the following security issues. This document is intended to serve as an overview of these vulnerabilities and security exposures to help determine the impact to your F5 devices. You can find the details of each issue in the associated...

K68151373: IP Intelligence Feed List TMUI vulnerability CVE-2019-6636

Security Advisory Description On BIG-IP AFM, ASM 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, and 11.5.1-11.6.4, a stored cross-site scripting vulnerability in AFM feed list. In the worst case, an attacker can store a CSRF which results in code execution as the admin user. Th...

CVE-2022-41813 BIG-IP PEM and AFM TMUI, TMSH and iControl vulnerability CVE-2022-41813

In versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, when BIG-IP is provisioned with PEM or AFM module, an undisclosed input can cause Traffic Management Microkernel TMM to terminate...

F5 Networks BIG-IP : BIG-IP PEM and AFM TMUI, TMSH, and iControl REST vulnerability (K93723284)

The version of F5 Networks BIG-IP installed on the remote host is prior to 14.1.5 / 15.1.6.1 / 16.1.3.1 / 17.0.0. It is, therefore, affected by a vulnerability as referenced in the K93723284 advisory. When the BIG-IP system is provisioned with the PEM or AFM module, an undisclosed input can cause...

F5 Networks BIG-IP : BIG-IP DNS TMUI vulnerability (K38893457)

The version of F5 Networks BIG-IP installed on the remote host is prior to 14.1.5 / 15.1.6.1 / 16.1.3 / 17.0.0. It is, therefore, affected by a vulnerability as referenced in the K38893457 advisory. A vulnerability exists in undisclosed pages of the BIG-IP DNS Traffic Management User Interface TM...

CVE-2022-33947

CVE-2022-33947 affects BIG-IP DNS TMUI (TMUI/DNS) in BIG-IP versions 16.0.x–16.1.2, 15.1.x, 14.1.x and 13.1.x; an authenticated operator can cause Tomcat restart and perform unauthorized DNS requests via undisclosed TMUI requests. Root cause: deserialization issue in TMUI leading to control-plane...

CVE-2022-33947 BIG-IP DNS TMUI Vulnerability CVE-2022-33947

In BIG-IP Versions 16.1.x before 16.1.3, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, a vulnerability exists in undisclosed pages of the BIG-IP DNS Traffic Management User Interface TMUI that allows an authenticated attacker with at least operator role privileges to...

CVE-2022-33947: Deserialization of Untrusted Data

In BIG-IP Versions 16.1.x before 16.1.3, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, a vulnerability exists in undisclosed pages of the BIG-IP DNS Traffic Management User Interface TMUI that allows an authenticated attacker with at least operator role privileges to...

F5 BIG-IP DNS TMUI Denial of Service Vulnerability

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. A denial-of-service vulnerability exists in the F5 BIG-IP DNS TMUI, which can be exploited by an authenticated attacker with ...

F5 BIG-IP has an unspecified vulnerability (CNVD-2022-74719)

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. A security vulnerability exists in F5 BIG-IP that could be exploited to modify and delete Dashboards created by other BIG-IP...

F5 BIG-IP TMUI Cross-Site Scripting Vulnerability (CNVD-2022-77533)

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. A cross-site scripting vulnerability exists in the F5 BIG-IP TMUI, which can be exploited by attackers to execute JavaScript ...

CVE-2022-27659

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, and 14.1.x versions prior to 14.1.4.6, an authenticated attacker can modify or delete Dashboards created by other BIG-IP users in the Traffic Management User Interface TMUI. Note: Software versions which have reach...

Code injection

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, and 14.1.x versions prior to 14.1.4.6, an authenticated attacker can modify or delete Dashboards created by other BIG-IP users in the Traffic Management User Interface TMUI. Note: Software versions which have reach...

CVE-2022-27659

CVE-2022-27659 affects F5 BIG-IP TMUI (Traffic Management User Interface). An authenticated attacker can modify or delete dashboards created by other BIG-IP users on vulnerable branches. Affects 16.1.x (<16.1.2.2), 15.1.x (<15.1.5.1), and 14.1.x (

CVE-2022-27659

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, and 14.1.x versions prior to 14.1.4.6, an authenticated attacker can modify or delete Dashboards created by other BIG-IP users in the Traffic Management User Interface TMUI. Note: Software versions which have reach...