CVE-2014-6271

CVE-2014-6271 (Shellshock) affects GNU Bash up to 4.3, enabling remote code execution by processing trailing strings after function definitions in environment variables. Exploitation vectors include OpenSSH ForceCommand, mod_cgi/mod_cgid in Apache, DHCP client scripts, and other environment-passi...

CVE-2014-7169

CVE-2014-7169 affects GNU Bash up to 4.3, where parsing of function definitions in environment variables can be exploited to run commands or impact other attributes across privilege boundaries (notably via ForceCommand in OpenSSH sshd and via mod_cgi/mod_cgid in Apache, as well as DHCP client scr...

CVE-2011-3188

CVE-2011-3188 affects the Linux kernel prior to 3.1, where IPv4 and IPv6 sequence numbers/Fragment IDs are generated with a modified MD4. This predictable value generation enables remote attackers to cause DoS or hijack sessions by crafting packets. The vulnerability is mitigated by upgrading the...

CVE-2013-3587

CVE-2013-3587 (BREACH) concerns TLS/SSL data compression leaks where compressed HTTPS responses reveal plaintext by observing size differences. The linked documents confirm this is a BREACH-type issue affecting HTTPS with HTTP compression, not tied to a single product. Mitigations documented incl...

CVE-2014-0196

CVE-2014-0196 affects the Linux kernel (through 3.14.3) specifically the n_tty_write function in drivers/tty/n_tty.c. The flaw permits a local user to trigger a race condition between read and write operations with long strings in the LECHO & !OPOST case, enabling denial of service (memory corrup...

CVE-2014-8730

CVE-2014-8730 is listed in Brocade ASCG advisories as addressed by security updates; the connected document shows this CVE mapped to general remote services and notes fixes are provided via ASCG updates (e.g., 3.3.0/3.3.0a). The initial description describes a POODLE-style padding issue in SSL/TL...

CVE-2012-3163

CVE-2012-3163 affects the MySQL Server component in Oracle MySQL 5.1.64 and earlier and 5.5.26 and earlier. It is described as an unspecified vulnerability that remote authenticated users can exploit via unknown vectors related to Information Schema, impacting confidentiality, integrity, and avai...

CVE-2014-0101

The CVE-2014-0101 issue affects the Linux kernel up to version 3.13.6, where the function sctp_sf_do_5_1D_ce in net/sctp/sm_statefuns.c does not validate certain auth_enable/auth_capable fields before sctp_sf_authenticate. This can enable a remote attacker to cause a denial of service by sending ...

CVE-2016-9244

CVE-2016-9244 affects F5 BIG-IP: a BIG-IP SSL virtual server with a non-default Client SSL profile that has the Session Tickets option enabled may leak up to 31 bytes of uninitialized memory, potentially exposing SSL session IDs (and possibly more). The issue is tied to the Ticketbleed memory dis...

CVE-2014-5209

The CVE-2014-5209 issue affects NTP 4.2.7p25 private (mode 6/7) messages via GET_RESTRICT, enabling information disclosure of sensitive data. Impact is limited to partial confidentiality; no exploit details are provided in the sources. No patched version is listed in the initial docs; a practical...

CVE-2014-4027

CVE-2014-4027 affects the Linux kernel prior to 3.14. The flaw is in the rd_build_device_space function (drivers/target/target_core_rd.c), where a data structure is not properly initialized, enabling local users to read sensitive information from ramdisk_mcp memory by abusing access to a SCSI ini...

CVE-2015-4040

CVE-2015-4040 – F5 BIG-IP configuration utility directory traversal : The vulnerability affects F5 BIG-IP prior to 12.0.0 and Enterprise Manager 3.0.0–3.1.1. An authenticated user could use the handler parameter to traverse the web root and access files (e.g., WEB-INF/web.xml). This is a post-aut...

CVE-2015-3628

CVE-2015-3628 covers an authenticated privilege-escalation in the F5 iControl API (iCall) that allows a user with the Resource Administrator role to gain higher privileges via a crafted iCall script or handler in a SOAP request to iControl/iControlPortal.cgi. Technical details across connected do...

CVE-2016-2084

CVE-2016-2084 affects F5 BIG-IP and BIG-IQ cloud deployments (AWS, Azure, Verizon) where certificates and keys are not regenerated during deployment, allowing potential disclosure of sensitive data or disruption. The root cause is improper regeneration of certificates/keys when deploying cloud im...

CVE-2014-6031

CVE-2014-6031 describes a remote buffer overflow in the BIG-IP MCPQ daemon that is exploitable by authenticated administrative users, potentially causing a denial-of-service. Affected products/versions include BIG-IP LTM/AAM/AFM/Analytics/APM/ASM/GT M/LineRate/Edge Gateway/WOM with vulnerable ran...

CVE-2015-5516

CVE-2015-5516 describes a memory leak in the F5 BIG-IP last-hop kernel module that can be triggered by processing UDP traffic, potentially causing a remote DoS through increased memory consumption. Affected products include BIG-IP LTM, GTM, Link Controller and several other BIG-IP components acro...

CVE-2015-8022

CVE-2015-8022 affects multiple F5 BIG-IP products (LTM, Analytics, APM, ASM, GTM, Link Controller; AAM, AFM, PEM; Edge Gateway, WebAccelerator, WOM, PSM) across 11.x releases. The root cause is in the Configuration utility: an Access Policy Manager customization configuration section that allows ...

CVE-2016-9250

The CVE-2016-9250 advisory for F5 BIG-IP identifies an unauthenticated attacker with access to the management/control plane who can delete arbitrary files via an undisclosed mechanism. Affected BIG-IP versions are 11.2.1, 11.4.0–11.6.1, and 12.0.0–12.1.2, with exposure to the web Configuration ut...

CVE-2016-5022

CVE-2016-5022 affects F5 BIG-IP components when Packet Filtering is enabled on virtual servers/self IPs. An unauthenticated remote attacker can disrupt services by sending crafted traffic, causing the Traffic Management Microkernel (TMM) to restart and temporarily fail to process traffic. Affecte...

CVE-2015-7394

CVE-2015-7394 affects the datastor kernel module across multiple F5 BIG-IP products (Analytics, APM, ASM, Link Controller, LTM, AAM, AFM, PEM, Edge Gateway, WebAccelerator, WOM, GTM, PSM, BIG-IQ suites, Enterprise Manager) with versions listed as vulnerable. The root cause is the ability for remo...

CVE-2015-8099

CVE-2015-8099 affects F5 BIG-IP products (multiple modules) where software SYN cookies are configured on virtual servers. Under limited conditions, an invalid TCP segment can cause a DoS (High-Speed Bridge hang) in the data plane via virtual servers. The vulnerability impacts various BIG-IP relea...

CVE-2017-6128

CVE-2017-6128 affects F5 BIG‑IP family (sshd DoS). The advisory lists multiple products (BIG‑IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, PSM, PSM, WebSafe, WebAccelerator, iWorkflow, BIG‑IQ components, and related management interfaces) with specific vulne...

CVE-2014-4024

Summary (CVE-2014-4024) : The vulnerability affects F5 BIG-IP SSL virtual servers when used with third-party SSL accelerator cards. A timing side-channel could allow remote attackers to observe activity with potential impact, under very specific conditions on local networks. Affected product fami...

CVE-2016-6876

The CVE-2016-6876 issue affects F5 BIG-IP products using the RESOLV::lookup iRule to resolve PTR records. The vulnerability allows a remote attacker to trigger excessive resource consumption or a possible Traffic Management Microkernel crash, potentially causing failover. Affected families includ...

CVE-2016-5023

CVE-2016-5023 affects F5 BIG-IP TMM when virtual servers are configured with a TCP profile. The vulnerability allows a remote attacker to cause a denial-of-service (TMM restart) by sending crafted TCP traffic. Affected versions include various 11.x and 12.0.0 releases with TCP profiles; impact is...

CVE-2009-4420

The CVE-2009-4420 issue describes a buffer overflow in the bd daemon of F5 Networks BIG-IP Application Security Manager (ASM) and Protocol Security Manager (PSM). Affected are ASM versions 9.4.4–9.4.7 and 10.0.0–10.0.1, and PSM versions 9.4.5–9.4.7 and 10.0.0–10.0.1. The underlying cause is a buf...

CVE-2016-7468

CVE-2016-7468 affects F5 BIG-IP TMM in versions 11.4.1–11.5.4 when tm.tcpprogressive is set to enabled (default is negotiate). An unauthenticated remote attacker could disrupt traffic or trigger failover by sending crafted traffic. The vendor advisory K13053402 confirms vulnerable ranges and list...

CVE-2015-6546

CVE-2015-6546 affects the vCMP host in multiple BIG-IP products (Analytics, APM, ASM, GTM, Link Controller, LTM, AAM, AFM, PEM, Edge Gateway, WebAccelerator, WOM, PSM) with vulnerable versions 11.0.0–11.5.3. The issue allows remote attackers to cause a denial of service by sending malicious traff...

CVE-2016-7474

The CVE-2016-7474 issue affects F5 BIG-IP MCPD: the MCPD binary cache can allow a local user with Advanced Shell access to leak previously unrecoverable data (e.g., passwords for recently created local accounts and passphrases since last reboot). The F5 advisory lists affected BIG-IP products and...

CVE-2019-6608

CVE-2019-6608 affects BIG-IP SNMPD on multiple versions (11.5.1–11.6.3, 12.1.0–12.1.3, 13.0.0–13.1.1.1, 14.0.0–14.0.0.2) where processing authorized SNMP requests may leak memory in multi‑blade BIG-IP vCMP guests. The vulnerability manifests as progressive memory growth in the snmpd process, pote...

CVE-2014-2927

F5 BIG-IP ConfigSync rsync vulnerability (CVE-2014-2927) allows unauthenticated remote read/write via the ConfigSync IP in failover mode. Affected: BIG-IP LTM and multiple modules (and Enterprise Manager 3.x) across versions from 11.0.0 up to 11.5.1 (including HF3/HF4 and related revisions) and 3...

CVE-2016-1497

The CVE-2016-1497 issue affects the BIG-IP Configuration utility across multiple BIG-IP releases and allows an authorized admin to read APM access logs via the Configuration utility. Impact is exposure of session details in Access Policy Manager logs; an attacker must have a valid BIG-IP admin ac...

CVE-2013-0150

CVE-2013-0150 is a directory-traversal flaw in client-side signed components used by F5 BIG-IP APM (versions 10.1.0–10.2.4, 11.0.0–11.3.0) and FirePass (6.0.0–6.1.0, 7.0.0) when APM is provisioned. The vulnerability allows a remote attacker to upload and execute arbitrary files by supplying a fil...

CVE-2014-2928

CVE-2014-2928 (F5 iControl remote command execution) affects F5 BIG-IP products that expose the iControl API (LTM, APM, ASM, GTM, Link Controller, PSM, AAM, AFM, PEM, Analytics, Edge Gateway, WebAccelerator, WOM, Enterprise Manager, BIG-IQ variants). The vulnerability arises from insufficient val...

CVE-2015-7393

CVE-2015-7393 : The vulnerability affects the dcoep binary across multiple F5 BIG-IP products (LTM, Analytics, APM, ASM, DNS, Edge Gateway/WebAccelerator/WOM, GTM, PSM, Enterprise Manager, BIG-IQ variants) and versions listed as vulnerable (e.g., 11.2.0–11.6.0 and 12.0.0 before HF1 among others)....

CVE-2018-15321

CVE-2018-15321 affects BIG-IP products when Appliance mode is licensed and Admin/Resource Administrator roles have or are granted TMSH access. The issue allows high-privilege attackers to bypass Appliance mode restrictions and overwrite critical system files via TMSH, bypassing security controls....

CVE-2018-15322

The CVE-2018-15322 affects BIG-IP family with tmsh access where repeatedly saving edits via the tmsh edit cli preference command can exhaust /var partition storage, causing DoS. Affected: BIG-IP (versions 14.0.0–14.0.0.2, 13.0.0–13.1.0.7, 12.1.0–12.1.3.5, 11.6.0–11.6.3.2, 11.2.1–11.5.6); BIG-IQ C...

CVE-2014-4023

CVE-2014-4023 describes an XSS vulnerability in tmui/dashboard/echo.jsp used by the BIG-IP Configuration utility (and Enterprise Manager). Connected sources confirm multiple BIG-IP family components (LTM, APM, ASM, GTM, Link Controller, Edge Gateway, Analytics, WebAccelerator, WOM, PEM, AAM, Ente...

CVE-2016-5020

CVE-2016-5020 affects F5 BIG-IP products (notably BIG-IP LTM, AAM, AFM, and related modules) and is caused by a vulnerability in the use of a crafted external Extended Application Verification (EAV) monitor script that allows a user with the Resource Administrator role to modify account configura...

CVE-2016-5736

CVE-2016-5736 concerns the default configuration of the IPsec IKE peer listener in multiple F5 BIG-IP products, where the anonymous IKE peer object is present and enabled. This allows a remote attacker to initiate IKE Phase 1 negotiations and potentially brute-force Phase 2 negotiations via unspe...

CVE-2016-7476

The CVE-2016-7476 issue affects the Traffic Management Microkernel (TMM) in multiple F5 BIG-IP components. A memory leak when handling certain TCP traffic can allow remote attackers to cause DoS via a crafted TCP packet. According to vendor advisories (K87416818), vulnerable versions include BIG-...

CVE-2019-6604

CVE-2019-6604 affects BIG-IP systems with High-Speed Bridge (HSB) under non-default Layer 2 forwarding configurations. A VLAN group configuration combined with vlangroup.flow.allocate being disabled can cause the HSB to lock up, eventually stopping traffic processing and triggering a failover in ...

CVE-2018-15317

In BIG-IP systems, CVE-2018-15317 affects TMM when handling SSL records on SSL Virtual Servers. The issue causes corruption of SSL data structures, leading to intermittent BAD_RECORD_MAC errors and DoS where clients cannot access the load-balanced app until TMM is restarted. Affected versions inc...

CVE-2016-7469

CVE-2016-7469 is a stored XSS vulnerability in the BIG-IP Configuration utility device name change page affecting multiple BIG-IP products (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, PSM, WebAccelerator, WOM, WebSafe) across versions 12.0.0–12.1.2, 11.4.0–11...

CVE-2018-15325

BIG-IP iControl and tmsh (CVE-2018-15325) affects BIG-IP 14.0.0–14.0.0.2 and 13.0.0–13.1.1.1; authenticated users executing commands may leak a small amount of memory, risking an out-of-memory condition in the control plane and potential HA failover. Fixes are listed as 14.0.0.3 or 14.1.0 for 14....

CVE-2014-3959

CVE-2014-3959 is an XSS vulnerability in list.jsp used by BIG-IP Configuration utilities. Concretes: affected products include BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, GTM, Link Controller, Enterprise Manager and related components; vulnerable across multiple versions (for example BIG-IP LTM, A...

CVE-2016-9252

The CVE-2016-9252 issue affects F5 BIG-IP Traffic Management Microkernel (TMM) for IPv6 handling of minimum path MTU options. According to vendor advisories, vulnerable are BIG-IP TMM components across multiple lines: BIG-IP 12.x (before 12.1.2), 11.6.x (before 11.6.1 HF2), 11.5.4 HF3, and earlie...

CVE-2015-8021

The CVE-2015-8021 entry maps to an actual vulnerability in the BIG-IP Configuration utility where file uploads via uploadImage.php are not properly validated. Affected BIG-IP products (LTM, Analytics, APM, ASM, GTM, Link Controller, PSM, and related modules) running vulnerable 11.x releases are e...

CVE-2016-7475

CVE-2016-7475 affects F5 BIG-IP SPDY and HTTP/2 profiles where the Traffic Management Microkernel (TMM) may fail to properly clean up pool member connections. Affected: BIG-IP LTM and related modules on versions including 12.0.0–12.1.0, 11.4.0–11.6.1 (and some later 11.x/12.x entries listed by th...

CVE-2017-6155

The CVE-2017-6155 issue affects F5 BIG-IP TMM in versions with SPDY or HTTP/2 profiles (BIG-IP 11.2.x, 11.4.1–11.5.5, 11.6.0–11.6.2, 12.0.0–12.1.3.1, 13.0.0). Malformed SPDY/HTTP/2 requests can disrupt service on TMM when such profiles are attached; no control-plane exposure is reported. Impact i...