Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1,059

Export CSV
CVE-2024-24989

NGINX HTTP/3 QUIC vulnerability

When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed requests can cause NGINX worker processes to terminate. Note: The HTTP/3 QUIC module is not enabled by default and is considered experimental. For more information, refer to Support for QUIC and HTTP/3 https://nginx.org/en/docs/quic.html . NOTE: Software versions which have reached End of Technical Support (EoTS) are not evaluated

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed
Vendors
F5
Products
Nginx Open Source Nginx Plus
CVE-2024-23805

F5 Application Visibility and Reporting module and BIG-IP Advanced WAF/ASM vulnerability

Undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. For the Application Visibility and Reporting module, this may occur when the HTTP Analytics profile with URLs enabled under Collected Entities is configured on a virtual server and the DB variables avr.IncludeServerInURI or avr.CollectOnlyHostnameFromURI are enabled. For BIG-IP Advanced WAF and ASM, this may occur when either a DoS or Bot Defense profile is configured on a virtual server and the DB variables avr.IncludeServerInURI or avr.CollectOnlyHostnameFromURI are enabled. Note: The DB variables avr.IncludeServerInURI and avr.CollectOnlyHostnameFromURI are not enabled by default. For more information about the HTTP Analytics profile and the Collect URLs setting, refer to K30875743: Create a new Analytics profile and attach it to your virtual servers https://my.f5.com/manage/s/article/K30875743 . Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Advanced Web Application Firewall Big-ip Application Security Manager
CVE-2024-21782

BIG-IP and BIG-IQ secure copy vulnerability

BIG-IP or BIG-IQ Resource Administrators and Certificate Managers who have access to the secure copy (scp) utility but do not have access to Advanced shell (bash) can execute arbitrary commands with a specially crafted command string. This vulnerability is due to an incomplete fix for CVE-2020-5873. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Access Policy Manager Big-ip Advanced Firewall Manager Big-ip Analytics and 9 more
CVE-2022-41780

F5OS CLI vulnerability CVE-2022-41780

In F5OS-A version 1.x before 1.1.0 and F5OS-C version 1.x before 1.4.0, a directory traversal vulnerability exists in an undisclosed location of the F5OS CLI that allows an attacker to read arbitrary files.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
F5
Products
F5os-a F5os-c
CVE-2022-41806

BIG-IP AFM NAT64 Policy Vulnerability CVE-2022-41806

In versions 16.1.x before 16.1.3.2 and 15.1.x before 15.1.5.1, when BIG-IP AFM Network Address Translation policy with IPv6/IPv4 translation rules is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Advanced Firewall Manager
CVE-2022-41813

BIG-IP PEM and AFM TMUI, TMSH and iControl vulnerability CVE-2022-41813

In versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, when BIG-IP is provisioned with PEM or AFM module, an undisclosed input can cause Traffic Management Microkernel (TMM) to terminate.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Advanced Firewall Manager Big-ip Policy Enforcement Manager
CVE-2022-36795

BIG-IP software SYN cookies vulnerability CVE-2022-36795

In BIG-IP versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.7, and 14.1.x before 14.1.5.1, when an LTM TCP profile with Auto Receive Window Enabled is configured on a virtual server, undisclosed traffic can cause the virtual server to stop processing new client connections.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Access Policy Manager Big-ip Advanced Firewall Manager Big-ip Analytics and 8 more
CVE-2022-41617

BIG-IP Advanced WAF and ASM iControl REST vulnerability CVE-2022-41617

In versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and 13.1.x before 13.1.5.1, When the Advanced WAF / ASM module is provisioned, an authenticated remote code execution vulnerability exists in the BIG-IP iControl REST interface.

CVSS 3.1 · 7.2 High EPSS 1.4% KEV · Not listed
Vendors
F5
Products
Big-ip Advanced Web Application Firewall Big-ip Application Security Manager
CVE-2022-41624

BIG-IP iRules vulnerability CVE-2022-41624

In BIG-IP versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.2, 15.1.x before 15.1.7, 14.1.x before 14.1.5.2, and 13.1.x before 13.1.5.1, when a sideband iRule is configured on a virtual server, undisclosed traffic can cause an increase in memory resource utilization.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Access Policy Manager Big-ip Advanced Firewall Manager Big-ip Analytics and 8 more
CVE-2022-41694

BIG-IP and BIG-IQ mcpd vulnerability CVE-2022-41694

In BIG-IP versions 16.1.x before 16.1.3, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, and BIG-IQ versions 8.x before 8.2.0.1 and all versions of 7.x, when an SSL key is imported on a BIG-IP or BIG-IQ system, undisclosed input can cause MCPD to terminate.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Access Policy Manager Big-ip Advanced Firewall Manager Big-ip Analytics and 8 more
CVE-2022-41741

NGINX ngx_http_mp4_module vulnerability CVE-2022-41741

NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngx_http_mp4_module that might allow a local attacker to corrupt NGINX worker memory, resulting in its termination or potential other impact using a specially crafted audio or video file. The issue affects only NGINX products that are built with the ngx_http_mp4_module, when the mp4 directive is used in the configuration file. Further, the attack is possible only if an attacker can trigger processing of a specially crafted audio or video file with the module ngx_http_mp4_module.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed
Vendors
Debian F5 Fedoraproject and 1 more
Products
Debian Linux Nginx Nginx Ingress Controller and 3 more
CVE-2022-41742

NGINX ngx_http_mp4_module vulnerability CVE-2022-41742

NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngx_http_mp4_module that might allow a local attacker to cause a worker process crash, or might result in worker process memory disclosure by using a specially crafted audio or video file. The issue affects only NGINX products that are built with the module ngx_http_mp4_module, when the mp4 directive is used in the configuration file. Further, the attack is possible only if an attacker can trigger processing of a specially crafted audio or video file with the module ngx_http_mp4_module.

CVSS 3.1 · 7.1 High EPSS 1.2% KEV · Not listed
Vendors
Debian F5 Fedoraproject and 1 more
Products
Debian Linux Nginx Nginx Ingress Controller and 3 more
CVE-2022-41743

NGINX ngx_http_hls_module vulnerability CVE-2022-41743

NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngx_http_hls_module that might allow a local attacker to corrupt NGINX worker memory, resulting in its crash or potential other impact using a specially crafted audio or video file. The issue affects only NGINX Plus when the hls directive is used in the configuration file. Further, the attack is possible only if an attacker can trigger processing of a specially crafted audio or video file with the module ngx_http_hls_module.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed
Vendors
F5
Products
Nginx Ingress Controller Nginx Plus
CVE-2022-41770

BIG-IP and BIG-IQ iControl REST vulnerability CVE-2022-41770

In BIG-IP versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.7, 14.1.x before 14.1.5.1, and all versions of 13.1.x, and BIG-IQ all versions of 8.x and 7.x, an authenticated iControl REST user can cause an increase in memory resource utilization, via undisclosed requests.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Access Policy Manager Big-ip Advanced Firewall Manager Big-ip Analytics and 9 more
CVE-2022-41983

BIG-IP TMM Vulnerability CVE-2022-41983

On specific hardware platforms, on BIG-IP versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.7, 14.1.x before 14.1.5.1, and all versions of 13.1.x, while Intel QAT (QuickAssist Technology) and the AES-GCM/CCM cipher is in use, undisclosed conditions can cause BIG-IP to send data unencrypted even with an SSL Profile applied.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Access Policy Manager Big-ip Advanced Firewall Manager Big-ip Advanced Web Application Firewall and 16 more
CVE-2022-41832

BIG-IP SIP vulnerability CVE-2022-41832

In BIG-IP versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and 13.1.x before 13.1.5.1, when a SIP profile is configured on a virtual server, undisclosed messages can cause an increase in memory resource utilization.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Access Policy Manager Big-ip Advanced Firewall Manager Big-ip Analytics and 8 more
CVE-2024-24990

NGINX HTTP/3 QUIC vulnerability

When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed requests can cause NGINX worker processes to terminate. Note: The HTTP/3 QUIC module is not enabled by default and is considered experimental. For more information, refer to Support for QUIC and HTTP/3 https://nginx.org/en/docs/quic.html . Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
F5
Products
Nginx Open Source Nginx Plus
CVE-2022-41835

F5OS vulnerability CVE-2022-41835

In F5OS-A version 1.x before 1.1.0 and F5OS-C version 1.x before 1.5.0, excessive file permissions in F5OS allows an authenticated local attacker to execute limited set of commands in a container and impact the F5OS controller.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
F5
Products
F5os-a F5os-c