Vulnerabilities > F5 > High

DATE CVE VULNERABILITY TITLE RISK
2018-04-13 CVE-2017-6148 Improper Input Validation vulnerability in F5 products
Responses to SOCKS proxy requests made through F5 BIG-IP version 13.0.0, 12.0.0-12.1.3.1, 11.6.1-11.6.2, or 11.5.1-11.5.5 may cause a disruption of services provided by TMM.
network
low complexity
f5 CWE-20
7.5
2018-04-03 CVE-2016-7472 Improper Input Validation vulnerability in F5 Big-Ip Application Security Manager 12.1.0/12.1.1
F5 BIG-IP ASM version 12.1.0 - 12.1.1 may allow remote attackers to cause a denial of service (DoS) via a crafted HTTP request.
network
low complexity
f5 CWE-20
7.5
2018-03-22 CVE-2018-5509 Improper Input Validation vulnerability in F5 products
On F5 BIG-IP versions 13.0.0 or 12.1.0 - 12.1.3.1, when a specifically configured virtual server receives traffic of an undisclosed nature, TMM will crash and take the configured failover action, potentially causing a denial of service.
network
low complexity
f5 CWE-20
7.5
2018-03-22 CVE-2018-5504 Unspecified vulnerability in F5 products
In some circumstances, the Traffic Management Microkernel (TMM) does not properly handle certain malformed Websockets requests/responses, which allows remote attackers to cause a denial-of-service (DoS) or possible remote code execution on the F5 BIG-IP system running versions 13.0.0 - 13.1.0.3 or 12.1.0 - 12.1.3.1.
network
high complexity
f5
8.1
2018-03-22 CVE-2018-5503 Improper Input Validation vulnerability in F5 Big-Ip Policy Enforcement Manager
On F5 BIG-IP versions 13.0.0 - 13.1.0.3 or 12.0.0 - 12.1.3.1, TMM may restart when processing a specifically crafted page through a virtual server with an associated PEM policy that has content insertion as an action.
network
low complexity
f5 CWE-20
7.5
2018-03-22 CVE-2018-5502 Improper Certificate Validation vulnerability in F5 products
On F5 BIG-IP versions 13.0.0 - 13.1.0.3, attackers may be able to disrupt services on the BIG-IP system with maliciously crafted client certificate.
network
low complexity
f5 CWE-295
7.5
2018-03-01 CVE-2017-6154 Improper Input Validation vulnerability in F5 Big-Ip Application Security Manager
On F5 BIG-IP systems running 13.0.0, 12.1.0 - 12.1.3.1, or 11.6.1 - 11.6.2, the BIG-IP ASM bd daemon may core dump memory under some circumstances when processing undisclosed types of data on systems with 48 or more CPU cores.
network
low complexity
f5 CWE-20
7.5
2018-03-01 CVE-2017-6150 Improper Input Validation vulnerability in F5 products
Under certain conditions for F5 BIG-IP systems 13.0.0 or 12.1.0 - 12.1.3.1, using FastL4 profiles, when the Reassemble IP Fragments option is disabled (default), some specific large fragmented packets may restart the Traffic Management Microkernel (TMM).
network
low complexity
f5 CWE-20
7.5
2017-12-21 CVE-2017-6167 Race Condition vulnerability in F5 products
In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM and WebSafe software version 13.0.0 and 12.1.0 - 12.1.2, race conditions in iControl REST may lead to commands being executed with different privilege levels than expected.
network
high complexity
f5 CWE-362
7.5
2017-12-21 CVE-2017-6164 Improper Input Validation vulnerability in F5 products
In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, WebAccelerator and WebSafe software version 13.0.0, 12.0.0 - 12.1.2, 11.6.0 - 11.6.1 and 11.5.0 - 11.5.4, in some circumstances, Traffic Management Microkernel (TMM) does not properly handle certain malformed TLS1.2 records, which allows remote attackers to cause a denial-of-service (DoS) or possible remote command execution on the BIG-IP system.
network
high complexity
f5 CWE-20
8.1