Vulnerabilities > F5

DATE CVE VULNERABILITY TITLE RISK
2020-12-24 CVE-2020-27729 Open Redirect vulnerability in F5 Big-Ip Access Policy Manager
In versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, an undisclosed link on the BIG-IP APM virtual server allows a malicious user to build an open redirect URI.
network
f5 CWE-601
5.8
2020-12-24 CVE-2020-27728 Unspecified vulnerability in F5 products
On BIG-IP ASM & Advanced WAF versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.3, under certain conditions, Analytics, Visibility, and Reporting daemon (AVRD) may generate a core file and restart on the BIG-IP system when processing requests sent from mobile devices.
network
f5
4.3
2020-12-24 CVE-2020-27727 Improper Input Validation vulnerability in F5 products
On BIG-IP version 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.3, and 13.1.0-13.1.3.4, when an authenticated administrative user installs RPMs using the iAppsLX REST installer, the BIG-IP system does not sufficiently validate user input, allowing the user read access to the filesystem.
network
low complexity
f5 CWE-20
4.0
2020-12-24 CVE-2020-27726 Cross-Site Scripting vulnerability in F5 Big-Ip Access Policy Manager
In versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.3, 13.1.0-13.1.3.4, and 12.1.0-12.1.5.2, a reflected cross-site scripting (XSS) vulnerability exists in the resource information page for authenticated users when a full webtop is configured on the BIG-IP APM system.
network
f5 CWE-79
4.3
2020-12-24 CVE-2020-27723 Unspecified vulnerability in F5 Big-Ip Access Policy Manager
In versions 14.1.0-14.1.3 and 13.1.0-13.1.3.4, a BIG-IP APM virtual server processing PingAccess requests may lead to a restart of the Traffic Management Microkernel (TMM) process.
network
low complexity
f5
5.0
2020-12-24 CVE-2020-27722 Resource Exhaustion vulnerability in F5 Big-Ip Access Policy Manager
In BIG-IP APM versions 15.0.0-15.0.1.3, 14.1.0-14.1.3, and 13.1.0-13.1.3.4, under certain conditions, the VDI plugin does not observe plugin flow-control protocol causing excessive resource consumption.
network
f5 CWE-400
3.5
2020-12-24 CVE-2020-27720 Unspecified vulnerability in F5 products
On BIG-IP LTM/CGNAT version 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.3, and 13.1.0-13.1.3.5, when processing NAT66 traffic with Port Block Allocation (PBA) mode and SP-DAG enabled, and dag-ipv6-prefix-len configured with a value less than the default of 128, an undisclosed traffic pattern may cause the Traffic Management Microkernel (TMM) to restart.
network
f5
4.3
2020-12-24 CVE-2020-27719 Cross-Site Scripting vulnerability in F5 products
On BIG-IP 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.3, a cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility.
network
f5 CWE-79
4.3
2020-12-24 CVE-2020-27717 Unspecified vulnerability in F5 Big-Ip Domain Name System
On BIG-IP DNS 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.3, 13.1.0-13.1.3.4, and 12.1.0-12.1.5.2, undisclosed series of DNS requests may cause TMM to restart and generate a core file.
network
low complexity
f5
7.8
2020-12-24 CVE-2020-27716 Unspecified vulnerability in F5 Big-Ip Access Policy Manager
On versions 15.1.0-15.1.0.5, 14.1.0-14.1.3, 13.1.0-13.1.3.5, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, when a BIG-IP APM virtual server processes traffic of an undisclosed nature, the Traffic Management Microkernel (TMM) stops responding and restarts.
network
low complexity
f5
7.8