Vulnerabilities > F5 > BIG IP Application Security Manager > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2019-02-20 | CVE-2019-8331 | Cross-site Scripting vulnerability in multiple products In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute. | 6.1 |
| 2019-02-14 | CVE-2019-6589 | Cross-site Scripting vulnerability in F5 products On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.3, 12.1.0-12.1.3.7, and 11.6.0-11.6.3.2, a reflected Cross Site Scripting (XSS) vulnerability is present in an undisclosed page of the BIG-IP TMUI (Traffic Management User Interface) also known as the BIG-IP configuration utility. | 6.1 |
| 2018-12-28 | CVE-2018-15333 | Unrestricted Upload of File with Dangerous Type vulnerability in F5 products On versions 11.2.1. | 5.5 |
| 2018-10-19 | CVE-2018-15315 | Cross-site Scripting vulnerability in F5 products On F5 BIG-IP 13.0.0-13.1.1.1 and 12.1.0-12.1.3.6, there is a reflected Cross Site Scripting (XSS) vulnerability in an undisclosed Configuration Utility page. | 6.1 |
| 2018-10-19 | CVE-2018-15312 | Cross-site Scripting vulnerability in F5 products On F5 BIG-IP 13.0.0-13.1.1.1 and 12.1.0-12.1.3.6, a reflected Cross-Site Scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an authenticated user to execute JavaScript for the currently logged-in user. | 6.1 |
| 2018-10-10 | CVE-2018-15311 | Unspecified vulnerability in F5 products When F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.3.5, 11.6.0-11.6.3.2, or 11.5.1-11.5.6 is processing specially crafted TCP traffic with the Large Receive Offload (LRO) feature enabled, TMM may crash, leading to a failover event. | 5.9 |
| 2018-07-25 | CVE-2018-5537 | Improper Input Validation vulnerability in F5 products A remote attacker may be able to disrupt services on F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.3.5, 11.6.0-11.6.3.1, or 11.2.1-11.5.6 if the TMM virtual server is configured with a HTML or a Rewrite profile. | 5.3 |
| 2018-07-19 | CVE-2018-5532 | Unspecified vulnerability in F5 products On F5 BIG-IP 13.0.0, 12.1.0-12.1.2, 11.6.0-11.6.3.1, or 11.2.1-11.5.6 a domain name cached within the DNS Cache of TMM may continue to be resolved by the cache even after the parent server revokes the record, if the DNS Cache is receiving a stream of requests for the cached name. | 5.3 |
| 2018-06-01 | CVE-2018-5526 | Unspecified vulnerability in F5 Big-Ip Application Security Manager Under certain conditions, on F5 BIG-IP ASM 13.1.0-13.1.0.5, Behavioral DOS (BADOS) protection may fail during an attack. | 6.5 |
| 2018-06-01 | CVE-2018-5525 | Information Exposure vulnerability in F5 products A local file vulnerability exists in the F5 BIG-IP Configuration utility on versions 13.0.0, 12.1.0-12.1.2, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1 that exposes files containing F5-provided data only and do not include any configuration data, proxied traffic, or other potentially sensitive customer data. | 4.3 |