Lucene search

K
F5Big-ip Advanced Firewall Manager

14 matches found

CVE
CVE
added 2023/10/10 2:15 p.m.4422 views

CVE-2023-44487

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

7.5CVSS8AI score0.94434EPSS
CVE
CVE
added 2023/10/26 9:15 p.m.505 views

CVE-2023-46747

Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support (EoTS) a...

9.8CVSS9.9AI score0.94439EPSS
CVE
CVE
added 2023/10/26 9:15 p.m.316 views

CVE-2023-46748

An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an authenticated attacker with network access to the Configuration utility through the BIG-IP management port and/or self IP addresses to execute arbitrary system commands. Note: Software version...

8.8CVSS9.2AI score0.03554EPSS
CVE
CVE
added 2023/10/10 1:15 p.m.86 views

CVE-2023-41373

A directory traversal vulnerability exists in the BIG-IP Configuration Utility that may allow an authenticated attacker to execute commands on the BIG-IP system. For BIG-IP system running in Appliance mode, a successful exploit can allow the attacker to cross a security boundary. Note: Software ver...

9.9CVSS9.4AI score0.02644EPSS
CVE
CVE
added 2023/10/10 1:15 p.m.74 views

CVE-2023-40534

When a client-side HTTP/2 profile and the HTTP MRF Router option are enabled for a virtual server, and an iRule using the HTTP_REQUEST event or Local Traffic Policy are associated with the virtual server, undisclosed requests can cause TMM to terminate. Note: Software versions which have reached En...

7.5CVSS7.6AI score0.00571EPSS
CVE
CVE
added 2023/10/10 1:15 p.m.73 views

CVE-2023-43611

The BIG-IP Edge Client Installer on macOS does not follow best practices for elevating privileges during the installation process. This vulnerability is due to an incomplete fix for CVE-2023-38418. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

7.8CVSS7.6AI score0.00105EPSS
CVE
CVE
added 2023/10/10 1:15 p.m.71 views

CVE-2023-41964

The BIG-IP and BIG-IQ systems do not encrypt some sensitive information written to Database (DB) variables. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

6.5CVSS5.4AI score0.00198EPSS
CVE
CVE
added 2023/10/10 1:15 p.m.71 views

CVE-2023-43746

When running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, utilizing BIG-IP external monitor on a BIG-IP system. A successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have...

8.7CVSS8.4AI score0.00056EPSS
CVE
CVE
added 2023/10/10 1:15 p.m.65 views

CVE-2023-40537

An authenticated user's session cookie may remain valid for a limited time after logging out from the BIG-IP Configuration utility on a multi-blade VIPRION platform. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

8.1CVSS8AI score0.00361EPSS
CVE
CVE
added 2023/10/10 1:15 p.m.65 views

CVE-2023-41085

When IPSec is configured on a Virtual Server, undisclosed traffic can cause TMM to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

7.5CVSS7.5AI score0.00576EPSS
CVE
CVE
added 2023/10/10 1:15 p.m.61 views

CVE-2023-40542

When TCP Verified Accept is enabled on a TCP profile that is configured on a Virtual Server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

7.5CVSS7.5AI score0.00576EPSS
CVE
CVE
added 2023/10/10 1:15 p.m.60 views

CVE-2023-43485

When TACACS+ audit forwarding is configured on BIG-IP or BIG-IQ system, sharedsecret is logged in plaintext in the audit log. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

5.5CVSS5.8AI score0.00226EPSS
CVE
CVE
added 2023/10/10 1:15 p.m.58 views

CVE-2023-42768

When a non-admin user has been assigned an administrator role via an iControl REST PUT request and later the user's role is reverted back to a non-admin role via the Configuration utility, tmsh, or iControl REST. BIG-IP non-admin user can still have access to iControl REST admin resource. Note: Sof...

7.2CVSS7AI score0.00428EPSS
CVE
CVE
added 2023/10/10 1:15 p.m.54 views

CVE-2023-45219

Exposure of Sensitive Information vulnerability exist in an undisclosed BIG-IP TMOS shell (tmsh) command which may allow an authenticated attacker with resource administrator role privileges to view sensitive information. Note: Software versions which have reached End of Technical Support (EoTS) ar...

4.4CVSS5AI score0.00104EPSS