Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 795

Export CSV
CVE-2023-22281

BIG-IP AFM vulnerability

On versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.8, 14.1.x before 14.1.5.3, and all versions of 13.1.x, when a BIG-IP AFM NAT policy with a destination NAT rule is configured on a FastL4 virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Advanced Firewall Manager
CVE-2023-22340

BIG-IP SIP profile vulnerability

On BIG-IP versions 16.1.x before 16.1.3.3, 15.1.x before 15.1.8, 14.1.x before 14.1.5.3, and all versions of 13.1.x, when a SIP profile is configured on a Message Routing type virtual server, undisclosed traffic can cause TMM to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Access Policy Manager Big-ip Advanced Firewall Manager Big-ip Analytics and 9 more
CVE-2023-22341

BIG-IP APM OAuth vulnerability

On version 14.1.x before 14.1.5.3, and all versions of 13.1.x, when the BIG-IP APM system is configured with all the following elements, undisclosed requests may cause the Traffic Management Microkernel (TMM) to terminate: * An OAuth Server that references an OAuth Provider * An OAuth profile with the Authorization Endpoint set to '/' * An access profile that references the above OAuth profile and is associated with an HTTPS virtual server Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Access Policy Manager
CVE-2023-22358

BIG-IP Edge Client for Windows vulnerability

In versions beginning with 7.2.2 to before 7.2.3.1, a DLL hijacking vulnerability exists in the BIG-IP Edge Client Windows Installer. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Access Policy Manager Big-ip Edge
CVE-2023-22374

iControl SOAP vulnerability

A format string vulnerability exists in iControl SOAP that allows an authenticated attacker to crash the iControl SOAP CGI process or, potentially execute arbitrary code. In appliance mode BIG-IP, a successful exploit of this vulnerability can allow the attacker to cross a security boundary.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 3.1 · 8.5 High EPSS 70.8% KEV · Not listed
Vendors
F5
Products
Big-ip Access Policy Manager Big-ip Advanced Firewall Manager Big-ip Analytics and 9 more
CVE-2023-22418

BIG-IP APM virtual server vulnerability

On versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.7, 14.1.x before 14.1.5.3, and all versions of 13.1.x, an open redirect vulnerability exists on virtual servers enabled with a BIG-IP APM access policy. This vulnerability allows an unauthenticated malicious attacker to build an open redirect URI. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Access Policy Manager Big-ip Advanced Firewall Manager Big-ip Analytics and 9 more
CVE-2023-22422

HTTP profile vulnerability

On BIG-IP versions 17.0.x before 17.0.0.2 and 16.1.x before 16.1.3.3, when a HTTP profile with the non-default Enforcement options of Enforce HTTP Compliance and Unknown Methods: Reject are configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Access Policy Manager Big-ip Advanced Firewall Manager Big-ip Analytics and 9 more
CVE-2023-22664

BIG-IP HTTP/2 profile vulnerability

On BIG-IP versions 17.0.x before 17.0.0.2 and 16.1.x before 16.1.3.3, and BIG-IP SPK starting in version 1.6.0, when a client-side HTTP/2 profile and the HTTP MRF Router option are enabled for a virtual server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Access Policy Manager Big-ip Advanced Firewall Manager Big-ip Analytics and 10 more
CVE-2023-22839

BIG-IP DNS profile vulnerability

On BIG-IP versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all version of 13.1.x, when a DNS profile with the Rapid Response Mode setting enabled is configured on a virtual server with hardware SYN cookies enabled, undisclosed requests cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip 10000s Big-ip 10000s Firmware Big-ip 10200v and 63 more
CVE-2023-22842

BIG-IP SIP profile vulnerability

On BIG-IP versions 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all versions of 13.1.x, when a SIP profile is configured on a Message Routing type virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Access Policy Manager Big-ip Advanced Firewall Manager Big-ip Analytics and 9 more
CVE-2023-23555

BIG-IP Virtual Edition vulnerability

On BIG-IP Virtual Edition versions 15.1x beginning in 15.1.4 to before 15.1.8 and 14.1.x beginning in 14.1.5 to before 14.1.5.3, and BIG-IP SPK beginning in 1.5.0 to before 1.6.0, when FastL4 profile is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Access Policy Manager Big-ip Advanced Firewall Manager Big-ip Analytics and 10 more
CVE-2023-22326

iControl REST and tmsh vulnerability

In BIG-IP versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all versions of 13.1.x, and all versions of BIG-IQ 8.x and 7.1.x, incorrect permission assignment vulnerabilities exist in the iControl REST and TMOS shell (tmsh) dig command which may allow an authenticated attacker with resource administrator or administrator role privileges to view sensitive information. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Access Policy Manager Big-ip Advanced Firewall Manager Big-ip Analytics and 9 more
CVE-2023-22323

BIG-IP SSL OCSP Authentication profile vulnerability

In BIP-IP versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all versions of 13.1.x, when OCSP authentication profile is configured on a virtual server, undisclosed requests can cause an increase in CPU resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Access Policy Manager Big-ip Advanced Firewall Manager Big-ip Analytics and 9 more
CVE-2023-22302

BIG-IP HTTP profile vulnerability

In BIG-IP versions 17.0.x before 17.0.0.2, and 16.1.x beginning in 16.1.2.2 to before 16.1.3.3, when an HTTP profile is configured on a virtual server and conditions beyond the attacker’s control exist on the target pool member, undisclosed requests sent to the BIG-IP system can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Access Policy Manager Big-ip Advanced Firewall Manager Big-ip Analytics and 9 more
CVE-2023-23552

BIG-IP Advanced WAF and ASM vulnerability

On versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.0 before 15.1.8, 14.1.x before 14.1.5.3, and all versions of 13.1.x, when a BIG-IP Advanced WAF or BIG-IP ASM security policy is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 3.1 · 7.5 High EPSS 1.6% KEV · Not listed
Vendors
F5
Products
Big-ip Advanced Web Application Firewall Big-ip Application Security Manager
CVE-2024-21771

F5 AFM Signature Matching Vulnerability

For unspecified traffic patterns, BIG-IP AFM IPS engine may spend an excessive amount of time matching the traffic against signatures, resulting in Traffic Management Microkernel (TMM) restarting and traffic disruption.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Advanced Firewall Manager
CVE-2023-29163

BIG-IP UDP Profile vulnerability

When UDP profile with idle timeout set to immediate or the value 0 is configured on a virtual server, undisclosed traffic can cause TMM to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Access Policy Manager Big-ip Advanced Firewall Manager Big-ip Advanced Web Application Firewall and 16 more
CVE-2023-28742

BIG-IP iQuery mesh vulnerability

When DNS is provisioned, an authenticated remote command execution vulnerability exists in DNS iQuery mesh. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 3.1 · 7.2 High EPSS 1.5% KEV · Not listed
Vendors
F5
Products
Big-ip Domain Name System
CVE-2023-22372

BIG-IP Edge Client for Windows and Mac OS vulnerability

In the pre connection stage, an improper enforcement of message integrity vulnerability exists in BIG-IP Edge Client for Windows and Mac OS.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Apple F5 Microsoft
Products
Macos Big-ip Access Policy Manager Windows
CVE-2023-24461

BIG-IP Edge Client for Windows and macOS vulnerability

An improper certificate validation vulnerability exists in the BIG-IP Edge Client for Windows and macOS and may allow an attacker to impersonate a BIG-IP APM system.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Apple F5 Microsoft
Products
Macos Big-ip Access Policy Manager Windows