Vulnerabilities > F5 > High
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2020-07-02 | CVE-2020-5911 | Unspecified vulnerability in F5 Nginx Controller In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller installer starts the download of Kubernetes packages from an HTTP URL On Debian/Ubuntu system. | 7.3 |
| 2020-07-02 | CVE-2020-5910 | Missing Authentication for Critical Function vulnerability in F5 Nginx Controller In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the Neural Autonomic Transport System (NATS) messaging services in use by the NGINX Controller do not require any form of authentication, so any successful connection would be authorized. | 7.5 |
| 2020-07-01 | CVE-2020-5907 | Unspecified vulnerability in F5 products In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, an authorized user provided with access only to the TMOS Shell (tmsh) may be able to conduct arbitrary file read/writes via the built-in sftp functionality. | 7.2 |
| 2020-07-01 | CVE-2020-5906 | Incorrect Default Permissions vulnerability in F5 products In versions 13.1.0-13.1.3.3, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, the BIG-IP system does not properly enforce the access controls for the scp.blacklist files. | 8.1 |
| 2020-07-01 | CVE-2020-5904 | Cross-Site Request Forgery (CSRF) vulnerability in F5 products In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, a cross-site request forgery (CSRF) vulnerability in the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, exists in an undisclosed page. | 8.8 |
| 2020-07-01 | CVE-2020-5899 | Insufficiently Protected Credentials vulnerability in F5 Nginx Controller In NGINX Controller 3.0.0-3.4.0, recovery code required to change a user's password is transmitted and stored in the database in plain text, which allows an attacker who can intercept the database connection or have read access to the database, to request a password reset using the email address of another registered user then retrieve the recovery code. | 7.8 |
| 2020-07-01 | CVE-2020-5900 | Cross-Site Request Forgery (CSRF) vulnerability in F5 Nginx Controller In versions 3.0.0-3.4.0, 2.0.0-2.9.0, and 1.0.1, there is insufficient cross-site request forgery (CSRF) protections for the NGINX Controller user interface. | 8.8 |
| 2020-05-12 | CVE-2020-5897 | Use After Free vulnerability in F5 Big-Ip Access Policy Manager In versions 7.1.5-7.1.9, there is use-after-free memory vulnerability in the BIG-IP Edge Client Windows ActiveX component. | 8.8 |
| 2020-05-12 | CVE-2020-5896 | Incorrect Default Permissions vulnerability in F5 Big-Ip Access Policy Manager On versions 7.1.5-7.1.9, the BIG-IP Edge Client's Windows Installer Service's temporary folder has weak file and folder permissions. | 7.8 |
| 2020-05-07 | CVE-2020-5895 | Incorrect Permission Assignment for Critical Resource vulnerability in F5 Nginx Controller 3.1.0/3.2.0/3.3.0 On NGINX Controller versions 3.1.0-3.3.0, AVRD uses world-readable and world-writable permissions on its socket, which allows processes or users on the local system to write arbitrary data into the socket. | 7.8 |