Vulnerabilities > F5 > BIG IP Access Policy Manager > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2019-02-26 | CVE-2019-6593 | Use of a Broken or Risky Cryptographic Algorithm vulnerability in F5 products On BIG-IP 11.5.1-11.5.4, 11.6.1, and 12.1.0, a virtual server configured with a Client SSL profile may be vulnerable to a chosen ciphertext attack against CBC ciphers. | 5.9 |
| 2019-02-20 | CVE-2019-8331 | Cross-site Scripting vulnerability in multiple products In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute. | 6.1 |
| 2019-02-14 | CVE-2019-6589 | Cross-site Scripting vulnerability in F5 products On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.3, 12.1.0-12.1.3.7, and 11.6.0-11.6.3.2, a reflected Cross Site Scripting (XSS) vulnerability is present in an undisclosed page of the BIG-IP TMUI (Traffic Management User Interface) also known as the BIG-IP configuration utility. | 6.1 |
| 2019-02-05 | CVE-2019-6591 | Cross-site Scripting vulnerability in F5 Big-Ip Access Policy Manager On BIG-IP APM 14.0.0 to 14.0.0.4, 13.0.0 to 13.1.1.3 and 12.1.0 to 12.1.3.7, a reflected cross-site scripting (XSS) vulnerability exists in the resource information page for authenticated users when a full webtop is configured on the BIG-IP APM system. | 5.4 |
| 2018-12-28 | CVE-2018-15335 | Unspecified vulnerability in F5 Big-Ip Access Policy Manager When APM 13.0.0-13.1.x is deployed as an OAuth Resource Server, APM becomes a client application to an external OAuth authorization server. | 5.9 |
| 2018-12-28 | CVE-2018-15334 | Cross-Site Request Forgery (CSRF) vulnerability in F5 Big-Ip Access Policy Manager A cross-site request forgery (CSRF) vulnerability in the APM webtop 11.2.1 or greater may allow attacker to force an APM webtop session to log out and require re-authentication. | 4.3 |
| 2018-12-28 | CVE-2018-15333 | Unrestricted Upload of File with Dangerous Type vulnerability in F5 products On versions 11.2.1. | 5.5 |
| 2018-10-31 | CVE-2018-15325 | Resource Exhaustion vulnerability in F5 products In BIG-IP 14.0.0-14.0.0.2 or 13.0.0-13.1.1.1, iControl and TMSH usage by authenticated users may leak a small amount of memory when executing commands | 4.3 |
| 2018-10-31 | CVE-2018-15324 | Improper Input Validation vulnerability in F5 Big-Ip Access Policy Manager On BIG-IP APM 14.0.0-14.0.0.2 or 13.0.0-13.1.1.1, TMM may restart when processing a specially crafted request with APM portal access. | 5.9 |
| 2018-10-31 | CVE-2018-15323 | Improper Input Validation vulnerability in F5 products On BIG-IP 14.0.0-14.0.0.2 or 13.0.0-13.1.1.1, in certain circumstances, when processing traffic through a Virtual Server with an associated MQTT profile, the TMM process may produce a core file and take the configured HA action. | 5.9 |