Lucene search

K
F5Big-ip Access Policy Manager

532 matches found

CVE
CVE
added 2020/10/29 4:15 p.m.39 views

CVE-2020-5935

On BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, FPS, GTM, Link Controller, PEM) versions 15.1.0-15.1.0.5, 14.1.0-14.1.2.3, and 13.1.0-13.1.3.3, when handling MQTT traffic through a BIG-IP virtual server associated with an MQTT profile and an iRule performing manipulations on that traffic, TMM m...

5.9CVSS5.7AI score0.00647EPSS
CVE
CVE
added 2017/05/09 3:29 p.m.38 views

CVE-2016-9253

In F5 BIG-IP 12.1.0 through 12.1.2, specific websocket traffic patterns may cause a disruption of service for virtual servers configured to use the websocket profile.

7.5CVSS7.4AI score0.00778EPSS
CVE
CVE
added 2018/03/22 6:29 p.m.38 views

CVE-2018-5504

In some circumstances, the Traffic Management Microkernel (TMM) does not properly handle certain malformed Websockets requests/responses, which allows remote attackers to cause a denial-of-service (DoS) or possible remote code execution on the F5 BIG-IP system running versions 13.0.0 - 13.1.0.3 or ...

9.3CVSS8.4AI score0.03251EPSS
CVE
CVE
added 2018/04/13 1:29 p.m.38 views

CVE-2018-5507

On F5 BIG-IP versions 13.0.0, 12.1.0-12.1.3.1, 11.6.1-11.6.2, or 11.5.1-11.5.5, vCMP guests running on VIPRION 2100, 4200 and 4300 series blades cannot correctly decrypt ciphertext from established SSL sessions with small MTU.

7.5CVSS7.5AI score0.00537EPSS
CVE
CVE
added 2018/05/02 1:29 p.m.38 views

CVE-2018-5519

On F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.3.3, or 11.2.1-11.6.3.1, administrative users by way of undisclosed methods can exploit the ssldump utility to write to arbitrary file paths. For users who do not have Advanced Shell access (for example, any user when licensed for Appliance Mode), this allo...

5.5CVSS5.2AI score0.00197EPSS
CVE
CVE
added 2018/07/25 2:29 p.m.38 views

CVE-2018-5542

F5 BIG-IP 13.0.0-13.0.1, 12.1.0-12.1.3.6, or 11.2.1-11.6.3.2 HTTPS health monitors do not validate the identity of the monitored server.

8.1CVSS8.1AI score0.00837EPSS
CVE
CVE
added 2019/11/27 10:15 p.m.38 views

CVE-2019-6671

On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2, 14.0.0-14.0.1, and 13.1.0-13.1.3.1, under certain conditions tmm may leak memory when processing packet fragments, leading to resource starvation.

7.5CVSS7.4AI score0.00891EPSS
CVE
CVE
added 2020/04/30 9:15 p.m.38 views

CVE-2020-5877

On BIG-IP 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, malformed input to the DATAGRAM::tcp iRules command within a FLOW_INIT event may lead to a denial of service.

7.5CVSS7.5AI score0.00647EPSS
CVE
CVE
added 2020/07/01 3:15 p.m.38 views

CVE-2020-5907

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, an authorized user provided with access only to the TMOS Shell (tmsh) may be able to conduct arbitrary file read/writes via the built-in sftp functionality.

7.2CVSS7.1AI score0.00358EPSS
CVE
CVE
added 2020/07/01 3:15 p.m.38 views

CVE-2020-5908

In versions bundled with BIG-IP APM 12.1.0-12.1.5 and 11.6.1-11.6.5.2, Edge Client for Linux exposes full session ID in the local log files.

5.5CVSS5.7AI score0.0009EPSS
CVE
CVE
added 2013/10/01 8:55 p.m.37 views

CVE-2013-5975

The access policy logon page (logon.inc) in F5 BIG-IP APM 11.1.0 through 11.2.1 allows remote attackers to conduct clickjacking attacks via unspecified vectors.

4.3CVSS6.8AI score0.00495EPSS
CVE
CVE
added 2018/05/02 1:29 p.m.37 views

CVE-2018-5520

On an F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.3.1, or 11.2.1-11.6.3.1 system configured in Appliance mode, the TMOS Shell (tmsh) may allow an administrative user to use the dig utility to gain unauthorized access to file system resources.

4.4CVSS4.9AI score0.002EPSS
CVE
CVE
added 2019/12/23 5:15 p.m.37 views

CVE-2019-6677

On BIG-IP versions 15.0.0-15.0.1, 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, and 12.1.0-12.1.5, under certain conditions when using custom TCP congestion control settings in a TCP profile, TMM stops processing traffic when processed by an iRule.

7.5CVSS7.5AI score0.00891EPSS
CVE
CVE
added 2019/12/23 6:15 p.m.37 views

CVE-2019-6680

On BIG-IP versions 15.0.0-15.0.1, 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5, while processing traffic through a standard virtual server that targets a FastL4 virtual server (VIP on VIP), hardware appliances may stop responding.

7.8CVSS7.5AI score0.00916EPSS
CVE
CVE
added 2020/08/26 3:15 p.m.37 views

CVE-2020-5915

In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, an undisclosed TMUI page contains a vulnerability which allows a stored XSS when BIG-IP systems are setup in a device trust.

6.1CVSS5.9AI score0.00398EPSS
CVE
CVE
added 2018/09/13 2:29 p.m.36 views

CVE-2018-15310

A vulnerability in BIG-IP APM portal access 11.5.1-11.5.7, 11.6.0-11.6.3, and 12.1.0-12.1.3 discloses the BIG-IP software version in rewritten pages.

4.3CVSS4.6AI score0.00283EPSS
CVE
CVE
added 2018/07/25 2:29 p.m.36 views

CVE-2018-5536

A remote attacker via undisclosed measures, may be able to exploit an F5 BIG-IP APM 13.0.0-13.1.0.7 or 12.1.0-12.1.3.5 virtual server configured with an APM per-request policy object and cause a memory leak in the APM module.

7.5CVSS7.4AI score0.0115EPSS
CVE
CVE
added 2018/07/25 2:29 p.m.36 views

CVE-2018-5537

A remote attacker may be able to disrupt services on F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.3.5, 11.6.0-11.6.3.1, or 11.2.1-11.5.6 if the TMM virtual server is configured with a HTML or a Rewrite profile. TMM may restart while processing some specially prepared HTML content from the back end.

5.3CVSS5.2AI score0.0069EPSS
CVE
CVE
added 2018/09/13 2:29 p.m.36 views

CVE-2018-5549

On BIG-IP APM 11.6.0-11.6.3.1, 12.1.0-12.1.3.3, 13.0.0, and 13.1.0-13.1.0.3, APMD may core when processing SAML Assertion or response containing certain elements.

7.5CVSS7.5AI score0.00749EPSS
CVE
CVE
added 2019/12/23 5:15 p.m.36 views

CVE-2019-6678

On BIG-IP versions 15.0.0-15.0.1, 14.1.0-14.1.2.2, 14.0.0-14.0.1, and 13.1.0-13.1.3.1, the TMM process may restart when the packet filter feature is enabled.

5.3CVSS5.3AI score0.00868EPSS
CVE
CVE
added 2020/08/26 3:15 p.m.36 views

CVE-2020-5918

In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management Microkernel (TMM) may stop responding when processing Stream Control Transmission Protocol (SCTP) traffic when traffic volume is high. This vulnerabili...

7.5CVSS7.4AI score0.00647EPSS
CVE
CVE
added 2020/11/05 8:15 p.m.36 views

CVE-2020-5940

In versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.2.3, a stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Traffic Management User Interface (TMUI), also known as the BIG-IP Configuration utility.

5.4CVSS5.2AI score0.0028EPSS
CVE
CVE
added 2018/10/31 2:29 p.m.35 views

CVE-2018-15324

On BIG-IP APM 14.0.0-14.0.0.2 or 13.0.0-13.1.1.1, TMM may restart when processing a specially crafted request with APM portal access.

5.9CVSS5.7AI score0.00647EPSS
CVE
CVE
added 2019/04/11 6:29 p.m.35 views

CVE-2019-6610

On BIG-IP versions 14.0.0-14.0.0.4, 13.0.0-13.1.1.1, 12.1.0-12.1.4, 11.6.0-11.6.3.4, and 11.5.1-11.5.8, the system is vulnerable to a denial of service attack when performing URL classification.

9CVSS8.3AI score0.00417EPSS
CVE
CVE
added 2019/11/27 10:15 p.m.35 views

CVE-2019-6668

The BIG-IP APM Edge Client for macOS bundled with BIG-IP APM 15.0.0-15.0.1, 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.1.0-13.1.1.5, 12.1.0-12.1.5, and 11.5.1-11.6.5 may allow unprivileged users to access files owned by root.

5.5CVSS5.3AI score0.00184EPSS
CVE
CVE
added 2020/08/26 4:15 p.m.35 views

CVE-2020-5921

in BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.6, 13.1.0-13.1.3.4, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.2, Syn flood causes large number of MCPD context messages destined to secondary blades consuming memory leading to MCPD failure. This issue affects only VIPRION hosts with two o...

7.5CVSS7.4AI score0.00647EPSS
CVE
CVE
added 2018/05/02 1:29 p.m.34 views

CVE-2018-5514

On F5 BIG-IP 13.1.0-13.1.0.5, maliciously crafted HTTP/2 request frames can lead to denial of service. There is data plane exposure for virtual servers when the HTTP2 profile is enabled. There is no control plane exposure to this issue.

7.5CVSS7.4AI score0.03171EPSS
CVE
CVE
added 2019/03/13 10:29 p.m.34 views

CVE-2019-6596

In BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.1, 12.1.0-12.1.3.6, 11.6.1-11.6.3.2, or 11.5.1-11.5.8, when processing fragmented ClientHello messages in a DTLS session TMM may corrupt memory eventually leading to a crash. Only systems offering DTLS connections via APM are impacted.

7.5CVSS7.4AI score0.00778EPSS
CVE
CVE
added 2024/02/14 5:15 p.m.34 views

CVE-2024-23314

When HTTP/2 is configured on BIG-IP or BIG-IP Next SPK systems, undisclosed responses can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

7.5CVSS7.6AI score0.00267EPSS
CVE
CVE
added 2020/08/26 4:15 p.m.33 views

CVE-2020-5926

In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, and 14.1.0-14.1.2.6, a BIG-IP virtual server with a Session Initiation Protocol (SIP) ALG profile, parsing SIP messages that contain a multi-part MIME payload with certain boundary strings can cause TMM to free memory to the wrong cache.

7.5CVSS7.5AI score0.00834EPSS
CVE
CVE
added 2020/10/29 4:15 p.m.31 views

CVE-2020-5934

On BIG-IP APM 15.1.0-15.1.0.5, 14.1.0-14.1.2.3, and 13.1.0-13.1.3.3, when multiple HTTP requests from the same client to configured SAML Single Logout (SLO) URL are passing through a TCP Keep-Alive connection, traffic to TMM can be disrupted.

6.5CVSS6.4AI score0.00178EPSS
CVE
CVE
added 2020/08/26 3:15 p.m.29 views

CVE-2020-5919

In versions 15.1.0-15.1.0.4, rendering of certain session variables by BIG-IP APM UI-based agents in an access profile configured with Modern customization, may cause the Traffic Management Microkernel (TMM) to stop responding.

7.5CVSS7.4AI score0.00647EPSS
Total number of security vulnerabilities532