Vulnerabilities > F5 > BIG IP Application Security Manager > 9.4.7

DATE CVE VULNERABILITY TITLE RISK
2020-02-21 CVE-2013-3587 Information Exposure vulnerability in F5 products
The HTTPS protocol, as used in unspecified web applications, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which makes it easier for man-in-the-middle attackers to obtain plaintext secret values by observing length differences during a series of guesses in which a string in an HTTP request URL potentially matches an unknown string in an HTTP response body, aka a "BREACH" attack, a different issue than CVE-2012-4929.
network
high complexity
f5 CWE-200
5.9
2015-09-17 CVE-2015-4040 Path Traversal vulnerability in F5 products
Directory traversal vulnerability in the configuration utility in F5 BIG-IP before 12.0.0 and Enterprise Manager 3.0.0 through 3.1.1 allows remote authenticated users to access arbitrary files in the web root via unspecified vectors.
network
low complexity
f5 CWE-22
4.0
2015-01-15 CVE-2015-1050 Cross-site Scripting vulnerability in F5 Big-Ip Application Security Manager
Cross-site scripting (XSS) vulnerability in F5 BIG-IP Application Security Manager (ASM) before 11.6 allows remote attackers to inject arbitrary web script or HTML via the Response Body field when creating a new user account.
network
f5 CWE-79
4.3
2012-07-09 CVE-2012-1493 Credentials Management vulnerability in F5 products
F5 BIG-IP appliances 9.x before 9.4.8-HF5, 10.x before 10.2.4, 11.0.x before 11.0.0-HF2, and 11.1.x before 11.1.0-HF3, and Enterprise Manager before 2.1.0-HF2, 2.2.x before 2.2.0-HF1, and 2.3.x before 2.3.0-HF3, use a single SSH private key across different customers' installations and do not properly restrict access to this key, which makes it easier for remote attackers to perform SSH logins via the PubkeyAuthentication option.
network
low complexity
f5 CWE-255
7.8
2009-12-24 CVE-2009-4420 Buffer Errors vulnerability in F5 products
Buffer overflow in the bd daemon in F5 Networks BIG-IP Application Security Manager (ASM) 9.4.4 through 9.4.7 and 10.0.0 through 10.0.1, and Protocol Security Manager (PSM) 9.4.5 through 9.4.7 and 10.0.0 through 10.0.1, allows remote attackers to cause a denial of service (crash) via unknown vectors.
network
low complexity
f5 CWE-119
7.8