Vulnerabilities > F5 > BIG IP Application Security Manager > High

DATE CVE VULNERABILITY TITLE RISK
2020-03-27 CVE-2020-5861 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in F5 products
On BIG-IP 12.1.0-12.1.5, the TMM process may produce a core file in some cases when Ram Cache incorrectly optimizes stored data resulting in memory errors.
network
low complexity
f5 CWE-119
7.5
2020-03-27 CVE-2020-5860 Cleartext Transmission of Sensitive Information vulnerability in F5 products
On BIG-IP 15.0.0-15.1.0.2, 14.1.0-14.1.2.3, 13.1.0-13.1.3.2, 12.1.0-12.1.5.1, and 11.5.2-11.6.5.1 and BIG-IQ 7.0.0, 6.0.0-6.1.0, and 5.2.0-5.4.0, in a High Availability (HA) network failover in Device Service Cluster (DSC), the failover service does not require a strong form of authentication and HA network failover traffic is not encrypted by Transport Layer Security (TLS).
network
high complexity
f5 CWE-319
8.1
2020-03-27 CVE-2020-5859 Unspecified vulnerability in F5 products
On BIG-IP 15.1.0.1, specially formatted HTTP/3 messages may cause TMM to produce a core file.
network
low complexity
f5
7.5
2020-03-27 CVE-2020-5858 Unspecified vulnerability in F5 products
On BIG-IP 15.0.0-15.0.1.2, 14.1.0-14.1.2.2, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5.1 and BIG-IQ 7.0.0, 6.0.0-6.1.0, and 5.2.0-5.4.0, users with non-administrator roles (for example, Guest or Resource Administrator) with tmsh shell access can execute arbitrary commands with elevated privilege via a crafted tmsh command.
local
low complexity
f5
7.8
2020-03-27 CVE-2020-5857 Unspecified vulnerability in F5 products
On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2.2, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, undisclosed HTTP behavior may lead to a denial of service.
network
low complexity
f5
7.5
2020-02-06 CVE-2020-5856 Unspecified vulnerability in F5 products
On BIG-IP 15.0.0-15.0.1.1 and 14.1.0-14.1.2.2, while processing specifically crafted traffic using the default 'xnet' driver, Virtual Edition instances hosted in Amazon Web Services (AWS) may experience a TMM restart.
network
low complexity
f5
7.5
2020-01-14 CVE-2020-5852 Unspecified vulnerability in F5 products
Undisclosed traffic patterns received may cause a disruption of service to the Traffic Management Microkernel (TMM).
network
low complexity
f5
7.5
2019-12-23 CVE-2019-6687 Improper Certificate Validation vulnerability in F5 Big-Ip Application Security Manager
On versions 15.0.0-15.0.1.1, the BIG-IP ASM Cloud Security Services profile uses a built-in verification mechanism that fails to properly authenticate the X.509 certificate of remote endpoints.
network
high complexity
f5 CWE-295
7.4
2019-12-23 CVE-2019-6685 Improper Privilege Management vulnerability in F5 products
On BIG-IP versions 15.0.0-15.0.1.1, 14.1.0-14.1.2.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, users with access to edit iRules are able to create iRules which can lead to an elevation of privilege, configuration modification, and arbitrary system command execution.
local
low complexity
f5 CWE-269
7.8
2019-12-23 CVE-2019-6684 Unspecified vulnerability in F5 products
On versions 15.0.0-15.0.1.1, 14.0.0-14.1.2.2, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, under certain conditions, a multi-bladed BIG-IP Virtual Clustered Multiprocessing (vCMP) may drop broadcast packets when they are rebroadcast to the vCMP guest secondary blades.
network
low complexity
f5
7.5