Vulnerabilities > F5 > Medium

DATE CVE VULNERABILITY TITLE RISK
2018-03-19 CVE-2014-4024 Information Exposure vulnerability in F5 products
SSL virtual servers in F5 BIG-IP systems 10.x before 10.2.4 HF9, 11.x before 11.2.1 HF12, 11.3.0 before HF10, 11.4.0 before HF8, 11.4.1 before HF5, 11.5.0 before HF5, and 11.5.1 before HF5, when used with third-party Secure Sockets Layer (SSL) accelerator cards, might allow remote attackers to have unspecified impact via a timing side-channel attack.
network
high complexity
f5 CWE-200
5.9
2018-03-08 CVE-2017-6152 Improper Privilege Management vulnerability in F5 Big-Iq Centralized Management 5.1.0/5.2.0
A local user on F5 BIG-IQ Centralized Management 5.1.0-5.2.0 with the Access Manager role has privileges to change the passwords of other users on the system, including the local admin account password.
local
low complexity
f5 CWE-269
6.7
2018-03-01 CVE-2018-5501 Resource Exhaustion vulnerability in F5 products
In some circumstances, on F5 BIG-IP systems running 13.0.0, 12.1.0 - 12.1.3.1, any 11.6.x or 11.5.x release, or 11.2.1, TCP DNS profile allows excessive buffering due to lack of flow control.
network
high complexity
f5 CWE-400
5.9
2018-03-01 CVE-2018-5500 Resource Exhaustion vulnerability in F5 products
On F5 BIG-IP systems running 13.0.0, 12.1.0 - 12.1.3.1, or 11.6.1 - 11.6.2, every Multipath TCP (MCTCP) connection established leaks a small amount of memory.
network
high complexity
f5 CWE-400
5.9
2018-02-06 CVE-2017-6169 Improper Input Validation vulnerability in F5 Big-Ip Policy Enforcement Manager
In versions 13.0.0, 12.0.0-12.1.3, or 11.6.0-11.6.2, an F5 BIG-IP virtual server using the URL categorization feature may cause the Traffic Management Microkernel (TMM) to produce a core file when it receives malformed URLs during categorization.
network
high complexity
f5 CWE-20
6.8
2018-01-19 CVE-2017-6142 Improper Certificate Validation vulnerability in F5 Big-Ip Advanced Firewall Manager
X509 certificate verification was not correctly implemented in the early access "user id" feature in the F5 BIG-IP Advanced Firewall Manager versions 13.0.0, 12.1.0-12.1.2, and 11.6.0-11.6.2, and thus did not properly validate the remote server's identity on certain versions of BIG-IP.
network
high complexity
f5 CWE-295
4.8
2017-12-21 CVE-2017-6139 Information Exposure Through Log Files vulnerability in F5 Big-Ip Access Policy Manager 12.1.2/13.0.0
In F5 BIG-IP APM software version 13.0.0 and 12.1.2, under rare conditions, the BIG-IP APM system appends log details when responding to client requests.
network
high complexity
f5 CWE-532
5.9
2017-12-21 CVE-2017-6136 Improper Input Validation vulnerability in F5 products
In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and WebSafe software version 13.0.0 and 12.0.0 - 12.1.2, undisclosed traffic patterns sent to BIG-IP virtual servers, with the TCP Fast Open and Tail Loss Probe options enabled in the associated TCP profile, may cause a disruption of service to the Traffic Management Microkernel (TMM).
network
high complexity
f5 CWE-20
5.9
2017-12-21 CVE-2017-6134 Improper Input Validation vulnerability in F5 products
In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and WebSafe software version 13.0.0, 12.1.0 - 12.1.2 and 11.5.1 - 11.6.1, an undisclosed sequence of packets, sourced from an adjacent network may cause TMM to crash.
low complexity
f5 CWE-20
6.5
2017-12-21 CVE-2017-0304 SQL Injection vulnerability in F5 Big-Ip Advanced Firewall Manager
A SQL injection vulnerability exists in the BIG-IP AFM management UI on versions 12.0.0, 12.1.0, 12.1.1, 12.1.2 and 13.0.0 that may allow a copy of the firewall rules to be tampered with and impact the Configuration Utility until there is a resync of the rules.
network
low complexity
f5 CWE-89
5.4