Vulnerabilities > F5 > BIG IP Access Policy Manager > Medium

DATE CVE VULNERABILITY TITLE RISK
2020-09-25 CVE-2020-5929 Information Exposure Through Discrepancy vulnerability in F5 products
In versions 13.0.0-13.0.0 HF2, 12.1.0-12.1.2 HF1, and 11.6.1-11.6.2, BIG-IP platforms with Cavium Nitrox SSL hardware acceleration cards, a Virtual Server configured with a Client SSL profile, and using Anonymous (ADH) or Ephemeral (DHE) Diffie-Hellman key exchange and Single DH use option not enabled in the options list may be vulnerable to crafted SSL/TLS Handshakes that may result with a PMS (Pre-Master Secret) that starts in a 0 byte and may lead to a recovery of plaintext messages as BIG-IP TLS/SSL ADH/DHE sends different error messages acting as an oracle.
network
high complexity
f5 CWE-203
5.9
2020-08-26 CVE-2020-5924 Memory Leak vulnerability in F5 Big-Ip Access Policy Manager
In BIG-IP APM versions 12.1.0-12.1.5.1 and 11.6.1-11.6.5.2, RADIUS authentication leaks memory when the username for authentication is not set.
network
low complexity
f5 CWE-401
5.3
2020-08-26 CVE-2020-5923 Unspecified vulnerability in F5 products
In BIG-IP versions 15.0.0-15.1.0.4, 14.1.0-14.1.2.6, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1 and BIG-IQ versions 5.4.0-7.0.0, Self-IP port-lockdown bypass via IPv6 link-local addresses.
low complexity
f5
5.4
2020-08-26 CVE-2020-5917 Inadequate Encryption Strength vulnerability in F5 products
In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.2 and BIG-IQ versions 5.2.0-7.0.0, the host OpenSSH servers utilize keys of less than 2048 bits which are no longer considered secure.
network
high complexity
f5 CWE-326
5.9
2020-08-26 CVE-2020-5916 Improper Privilege Management vulnerability in F5 products
In BIG-IP versions 15.1.0-15.1.0.4 and 15.0.0-15.0.1.3 the Certificate Administrator user role and higher privileged roles can perform arbitrary file reads outside of the web root directory.
network
low complexity
f5 CWE-269
6.8
2020-08-26 CVE-2020-5915 Cross-site Scripting vulnerability in F5 products
In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, an undisclosed TMUI page contains a vulnerability which allows a stored XSS when BIG-IP systems are setup in a device trust.
network
low complexity
f5 CWE-79
6.1
2020-07-01 CVE-2020-5908 Information Exposure Through Log Files vulnerability in F5 Big-Ip Access Policy Manager
In versions bundled with BIG-IP APM 12.1.0-12.1.5 and 11.6.1-11.6.5.2, Edge Client for Linux exposes full session ID in the local log files.
local
low complexity
f5 CWE-532
5.5
2020-07-01 CVE-2020-5905 Cross-site Scripting vulnerability in F5 products
In version 11.6.1-11.6.5.2 of the BIG-IP system Configuration utility Network > WCCP page, the system does not sanitize all user-provided data before display.
network
low complexity
f5 CWE-79
4.3
2020-07-01 CVE-2020-5903 Cross-site Scripting vulnerability in F5 products
In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, a Cross-Site Scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility.
network
low complexity
f5 CWE-79
6.1
2020-05-12 CVE-2020-5898 Unspecified vulnerability in F5 Big-Ip Access Policy Manager
In versions 7.1.5-7.1.9, BIG-IP Edge Client Windows Stonewall driver does not sanitize the pointer received from the userland.
local
low complexity
f5
5.5