Vulnerabilities > F5 > BIG IP Advanced WEB Application Firewall > High

DATE CVE VULNERABILITY TITLE RISK
2020-12-11 CVE-2020-5949 Unspecified vulnerability in F5 products
On BIG-IP versions 14.0.0-14.0.1 and 13.1.0-13.1.3.4, certain traffic pattern sent to a virtual server configured with an FTP profile can cause the FTP channel to break.
network
low complexity
f5
7.5
2020-11-05 CVE-2020-5946 Unspecified vulnerability in F5 Big-Ip Fraud Protection Service
In BIG-IP Advanced WAF and FPS versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.2.7, under some circumstances, certain format client-side alerts sent to the BIG-IP virtual server configured with DataSafe may cause the Traffic Management Microkernel (TMM) to restart, resulting in a Denial-of-Service (DoS).
network
low complexity
f5
7.5
2020-11-05 CVE-2020-5939 Unspecified vulnerability in F5 products
In versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.3, 15.0.0-15.0.1.3, 14.1.0-14.1.2.6, and 13.1.0-13.1.3.4, BIG-IP Virtual Edition (VE) systems on VMware, with an Intel-based 85299 Network Interface Controller (NIC) card and Single Root I/O Virtualization (SR-IOV) enabled on vSphere, may fail and leave the Traffic Management Microkernel (TMM) in a state where it cannot transmit traffic.
network
low complexity
f5
7.5
2020-08-26 CVE-2020-5922 Cross-Site Request Forgery (CSRF) vulnerability in F5 products
In BIG-IP versions 15.0.0-15.1.0.4, 14.1.0-14.1.2.6, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.2, iControl REST does not implement Cross Site Request Forgery protections for users which make use of Basic Authentication in a web browser.
network
low complexity
f5 CWE-352
8.8
2020-08-26 CVE-2020-5913 Improper Certificate Validation vulnerability in F5 products
In versions 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.2, the BIG-IP Client or Server SSL profile ignores revoked certificates, even when a valid CRL is present.
network
high complexity
f5 CWE-295
7.4
2020-08-26 CVE-2020-5912 Unspecified vulnerability in F5 products
In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the restjavad process's dump command does not follow current best coding practices and may overwrite arbitrary files.
local
low complexity
f5
7.1