Vulnerabilities > F5 > High
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2023-10-10 | CVE-2023-45226 | Use of Hard-coded Credentials vulnerability in F5 Big-Ip Next Service Proxy for Kubernetes 1.5.0 The BIG-IP SPK TMM (Traffic Management Module) f5-debug-sidecar and f5-debug-sshd containers contains hardcoded credentials that may allow an attacker with the ability to intercept traffic to impersonate the SPK Secure Shell (SSH) server on those containers. | 7.4 |
| 2023-10-10 | CVE-2023-5450 | Insufficient Verification of Data Authenticity vulnerability in F5 Big-Ip Access Policy Manager An insufficient verification of data vulnerability exists in BIG-IP Edge Client Installer on macOS that may allow an attacker elevation of privileges during the installation process. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. | 7.8 |
| 2023-09-27 | CVE-2023-43124 | Cleartext Transmission of Sensitive Information vulnerability in F5 products BIG-IP APM clients may send IP traffic outside of the VPN tunnel. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated | 7.1 |
| 2023-09-27 | CVE-2023-43125 | Cleartext Transmission of Sensitive Information vulnerability in F5 products BIG-IP APM clients may send IP traffic outside of the VPN tunnel. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated | 8.2 |
| 2023-08-02 | CVE-2023-38418 | Improper Verification of Cryptographic Signature vulnerability in F5 Big-Ip Access Policy Manager The BIG-IP Edge Client Installer on macOS does not follow best practices for elevating privileges during the installation process. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. | 7.8 |
| 2023-05-03 | CVE-2023-28656 | Authorization Bypass Through User-Controlled Key vulnerability in F5 products NGINX Management Suite may allow an authenticated attacker to gain access to configuration objects outside of their assigned environment. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. | 8.1 |
| 2023-05-03 | CVE-2023-28724 | Incorrect Default Permissions vulnerability in F5 products NGINX Management Suite default file permissions are set such that an authenticated attacker may be able to modify sensitive files on NGINX Instance Manager and NGINX API Connectivity Manager. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. | 7.1 |
| 2023-05-03 | CVE-2023-28742 | OS Command Injection vulnerability in F5 Big-Ip Domain Name System When DNS is provisioned, an authenticated remote command execution vulnerability exists in DNS iQuery mesh. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. | 8.8 |
| 2023-05-03 | CVE-2023-29163 | Memory Leak vulnerability in F5 products When UDP profile with idle timeout set to immediate or the value 0 is configured on a virtual server, undisclosed traffic can cause TMM to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. | 7.5 |
| 2023-04-09 | CVE-2023-27727 | Out-of-bounds Read vulnerability in F5 NJS 0.7.10 Nginx NJS v0.7.10 was discovered to contain a segmentation violation via the function njs_function_frame at src/njs_function.h. | 7.5 |