cve,link,title,description,vendor,products,score,severity,epss,cisa,article,ransomware,exploited,poc,trended,trended_no_1,published,trended_score
CVE-2020-5935,https://securityvulnerability.io/vulnerability/CVE-2020-5935,,"On BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, FPS, GTM, Link Controller, PEM) versions 15.1.0-15.1.0.5, 14.1.0-14.1.2.3, and 13.1.0-13.1.3.3, when handling MQTT traffic through a BIG-IP virtual server associated with an MQTT profile and an iRule performing manipulations on that traffic, TMM may produce a core file.",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Fps, Gtm, Link Controller, Pem)",5.9,MEDIUM,0.0010300000431016088,false,false,false,false,,false,false,2020-10-29T15:07:59.000Z,0
CVE-2019-6657,https://securityvulnerability.io/vulnerability/CVE-2019-6657,,"On BIG-IP 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, a reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Traffic Management User Interface (TMUI), also known as the BIG-IP Configuration utility.",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Fps, Gtm, Link Controller, Pem, Webaccelerator)",6.1,MEDIUM,0.0007800000021234155,false,false,false,false,,false,false,2019-11-01T14:53:06.000Z,0
CVE-2019-6655,https://securityvulnerability.io/vulnerability/CVE-2019-6655,,"On versions 13.0.0-13.1.0.1, 12.1.0-12.1.4.1, 11.6.1-11.6.4, and 11.5.1-11.5.9, BIG-IP platforms where AVR, ASM, APM, PEM, AFM, and/or AAM is provisioned may leak sensitive data.",F5,"Big-ip Avr, Asm, Apm, Pem, Afm, And/or Aam",5.3,MEDIUM,0.0008999999845400453,false,false,false,false,,false,false,2019-09-25T19:00:43.000Z,0
CVE-2019-6619,https://securityvulnerability.io/vulnerability/CVE-2019-6619,,"On BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, the Traffic Management Microkernel (TMM) may restart when a virtual server has an HTTP/2 profile with Application Layer Protocol Negotiation (ALPN) enabled and it processes traffic where the ALPN extension size is zero.",F5,"Big-ip (ltm, Aam, Afm, Apm, Asm, Link Controller, Pem, Webaccelerator)",7.5,HIGH,0.000859999970998615,false,false,false,false,,false,false,2019-05-03T19:35:37.000Z,0
CVE-2019-6618,https://securityvulnerability.io/vulnerability/CVE-2019-6618,,"On BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8, users with the Resource Administrator role can modify sensitive portions of the filesystem if provided Advanced Shell Access, such as editing /etc/passwd. This allows modifications to user objects and is contrary to our definition for the Resource Administrator (RA) role restrictions.",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Fps, Gtm, Link Controller, Pem, Webaccelerator)",4.9,MEDIUM,0.000539999979082495,false,false,false,false,,false,false,2019-05-03T19:28:54.000Z,0
CVE-2019-6617,https://securityvulnerability.io/vulnerability/CVE-2019-6617,,"On BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8, a user with the Resource Administrator role is able to overwrite sensitive low-level files (such as /etc/passwd) using SFTP to modify user permissions, without Advanced Shell access. This is contrary to our definition for the Resource Administrator (RA) role restrictions.",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Fps, Gtm, Link Controller, Pem, Webaccelerator)",6.5,MEDIUM,0.001180000021122396,false,false,false,false,,false,false,2019-05-03T19:16:02.000Z,0
CVE-2019-6616,https://securityvulnerability.io/vulnerability/CVE-2019-6616,,"On BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8, administrative users with TMSH access can overwrite critical system files on BIG-IP which can result in bypass of whitelist / blacklist restrictions enforced by appliance mode.",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Fps, Gtm, Link Controller, Pem, Webaccelerator)",7.2,HIGH,0.00171999994199723,false,false,false,false,,false,false,2019-05-03T19:12:57.000Z,0
CVE-2019-6614,https://securityvulnerability.io/vulnerability/CVE-2019-6614,,"On BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, internal methods used to prevent arbitrary file overwrites in Appliance Mode were not fully effective. An authenticated attacker with a high privilege level may be able to bypass protections implemented in appliance mode to overwrite arbitrary system files.",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Fps, Gtm, Link Controller, Pem, Webaccelerator)",6.5,MEDIUM,0.0007200000109151006,false,false,false,false,,false,false,2019-05-03T19:09:12.000Z,0
CVE-2019-6615,https://securityvulnerability.io/vulnerability/CVE-2019-6615,,"On BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8, Administrator and Resource Administrator roles might exploit TMSH access to bypass Appliance Mode restrictions on BIG-IP systems.",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Gtm, Link Controller, Pem, Webaccelerator, Websafe)",4.9,MEDIUM,0.0005499999970197678,false,false,false,false,,false,false,2019-05-03T19:05:20.000Z,0
CVE-2019-6613,https://securityvulnerability.io/vulnerability/CVE-2019-6613,,"On BIG-IP 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8, SNMP may expose sensitive configuration objects over insecure transmission channels. This issue is exposed when a passphrase is used with various profile types and is accessed using SNMPv2.",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Fps, Gtm, Link Controller, Pem, Webaccelerator)",5.3,MEDIUM,0.0006200000061653554,false,false,false,false,,false,false,2019-05-03T18:00:17.000Z,0
CVE-2019-6612,https://securityvulnerability.io/vulnerability/CVE-2019-6612,,"On BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8, DNS query TCP connections that are aborted before receiving a response from a DNS cache may cause TMM to restart.",F5,"Big-ip (ltm, Aam, Afm, Apm, Asm, Dns, Gtm, Link Controller, Pem)",7.5,HIGH,0.000859999970998615,false,false,false,false,,false,false,2019-05-03T17:56:16.000Z,0
CVE-2019-6611,https://securityvulnerability.io/vulnerability/CVE-2019-6611,,"When BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8 are processing certain rare data sequences occurring in PPTP VPN traffic, the BIG-IP system may execute incorrect logic. The TMM may restart and produce a core file as a result of this condition. The BIG-IP system provisioned with the CGNAT module and configured with a virtual server using a PPTP profile is exposed to this vulnerability.",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Fps, Gtm, Link Controller, Pem, Webaccelerator)",7.5,HIGH,0.0008200000156648457,false,false,false,false,,false,false,2019-05-03T17:47:56.000Z,0
CVE-2019-6610,https://securityvulnerability.io/vulnerability/CVE-2019-6610,,"On BIG-IP versions 14.0.0-14.0.0.4, 13.0.0-13.1.1.1, 12.1.0-12.1.4, 11.6.0-11.6.3.4, and 11.5.1-11.5.8, the system is vulnerable to a denial of service attack when performing URL classification.",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Fps, Gtm, Link Controller, Pem, Webaccelerator)",8.6,HIGH,0.0010300000431016088,false,false,false,false,,false,false,2019-04-11T17:09:12.000Z,0
CVE-2019-6597,https://securityvulnerability.io/vulnerability/CVE-2019-6597,,"In BIG-IP 13.0.0-13.1.1.1, 12.1.0-12.1.3.7, 11.6.1-11.6.3.2, or 11.5.1-11.5.8 or Enterprise Manager 3.1.1, when authenticated administrative users run commands in the Traffic Management User Interface (TMUI), also referred to as the BIG-IP Configuration utility, restrictions on allowed commands may not be enforced.",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Fps, Gtm, Link Controller, Pem, Webaccelerator); Enterprise Manager",7.2,HIGH,0.0010400000028312206,false,false,false,false,,false,false,2019-03-11T00:00:00.000Z,0
CVE-2019-6600,https://securityvulnerability.io/vulnerability/CVE-2019-6600,,"In BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.3, 12.1.0-12.1.3.7, 11.6.1-11.6.3.2, or 11.5.1-11.5.8, when remote authentication is enabled for administrative users and all external users are granted the ""guest"" role, unsanitized values can be reflected to the client via the login page. This can lead to a cross-site scripting attack against unauthenticated clients.",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Fps, Gtm, Link Controller, Pem, Webaccelerator)",6.1,MEDIUM,0.000699999975040555,false,false,false,false,,false,false,2019-03-11T00:00:00.000Z,0
CVE-2019-6598,https://securityvulnerability.io/vulnerability/CVE-2019-6598,,"In BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.0.7, 12.1.0-12.1.3.5, 11.6.1-11.6.3.2, or 11.5.1-11.5.8 or Enterprise Manager 3.1.1, malformed requests to the Traffic Management User Interface (TMUI), also referred to as the BIG-IP Configuration utility, may lead to disruption of TMUI services. This attack requires an authenticated user with any role (other than the No Access role). The No Access user role cannot login and does not have the access level to perform the attack.",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Gtm, Link Controller, Pem, Webaccelerator, Websafe); Enterprise Manager",4.3,MEDIUM,0.0007099999929778278,false,false,false,false,,false,false,2019-03-11T00:00:00.000Z,0
CVE-2019-6601,https://securityvulnerability.io/vulnerability/CVE-2019-6601,,"In BIG-IP 13.0.0, 12.1.0-12.1.3.7, 11.6.1-11.6.3.2, or 11.5.1-11.5.8, the Application Acceleration Manager (AAM) wamd process used in processing of images and PDFs fails to drop group permissions when executing helper scripts.",F5,Big-ip (aam),5.5,MEDIUM,0.0004400000034365803,false,false,false,false,,false,false,2019-03-11T00:00:00.000Z,0
CVE-2019-6593,https://securityvulnerability.io/vulnerability/CVE-2019-6593,,"On BIG-IP 11.5.1-11.5.4, 11.6.1, and 12.1.0, a virtual server configured with a Client SSL profile may be vulnerable to a chosen ciphertext attack against CBC ciphers. When exploited, this may result in plaintext recovery of encrypted messages through a man-in-the-middle (MITM) attack, despite the attacker not having gained access to the server's private key itself. (CVE-2019-6593 also known as Zombie POODLE and GOLDENDOODLE.)",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Fps, Gtm, Link Controller, Pem, Webaccelerator)",5.9,MEDIUM,0.0012799999676644802,false,false,false,false,,false,false,2019-02-26T00:00:00.000Z,0
CVE-2019-6592,https://securityvulnerability.io/vulnerability/CVE-2019-6592,,"On BIG-IP 14.1.0-14.1.0.1, TMM may restart and produce a core file when validating SSL certificates in client SSL or server SSL profiles.",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Fps, Gtm, Link Controller, Pem, Webaccelerator)",9.1,CRITICAL,0.0011599999852478504,false,false,false,false,,false,false,2019-02-26T00:00:00.000Z,0
CVE-2019-6594,https://securityvulnerability.io/vulnerability/CVE-2019-6594,,"On BIG-IP 11.5.1-11.6.3.2, 12.1.3.4-12.1.3.7, 13.0.0 HF1-13.1.1.1, and 14.0.0-14.0.0.2, Multi-Path TCP (MPTCP) does not protect against multiple zero length DATA_FINs in the reassembly queue, which can lead to an infinite loop in some circumstances.",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Fps, Gtm, Link Controller, Pem, Webaccelerator)",5.9,MEDIUM,0.0010499999625608325,false,false,false,false,,false,false,2019-02-26T00:00:00.000Z,0
CVE-2019-6589,https://securityvulnerability.io/vulnerability/CVE-2019-6589,,"On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.3, 12.1.0-12.1.3.7, and 11.6.0-11.6.3.2, a reflected Cross Site Scripting (XSS) vulnerability is present in an undisclosed page of the BIG-IP TMUI (Traffic Management User Interface) also known as the BIG-IP configuration utility.",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Fps, Gtm, Link Controller, Pem, Webaccelerator)",6.1,MEDIUM,0.0007900000200606883,false,false,false,false,,false,false,2019-01-29T00:00:00.000Z,0
CVE-2018-15333,https://securityvulnerability.io/vulnerability/CVE-2018-15333,,"On versions 11.2.1. and greater, unrestricted Snapshot File Access allows BIG-IP system's user with any role, including Guest Role, to have access and download previously generated and available snapshot files on the BIG-IP configuration utility such as QKView and TCPDumps.",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Fps, Gtm, Link Controller, Pem, Webaccelerator)",5.5,MEDIUM,0.0005099999834783375,false,false,false,false,,false,false,2018-12-28T15:00:00.000Z,0
CVE-2018-15331,https://securityvulnerability.io/vulnerability/CVE-2018-15331,,"On BIG-IP AAM 13.0.0 or 12.1.0-12.1.3.7, the dcdb_convert utility used by BIG-IP AAM fails to drop group permissions when executing helper scripts, which could be used to leverage attacks against the BIG-IP system.",F5,Big-ip (aam),7.8,HIGH,0.0006300000241026282,false,false,false,false,,false,false,2018-12-20T00:00:00.000Z,0
CVE-2018-15330,https://securityvulnerability.io/vulnerability/CVE-2018-15330,,"On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.1, or 12.1.0-12.1.3.7, when a virtual server using the inflate functionality to process a gzip bomb as a payload, the BIG-IP system will experience a fatal error and may cause the Traffic Management Microkernel (TMM) to produce a core file.",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Fps, Gtm, Link Controller, Pem, Webaccelerator)",7.5,HIGH,0.0010499999625608325,false,false,false,false,,false,false,2018-12-20T00:00:00.000Z,0
CVE-2018-15329,https://securityvulnerability.io/vulnerability/CVE-2018-15329,,"On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.1, or 12.1.0-12.1.3.7, or Enterprise Manager 3.1.1, when authenticated administrative users run commands in the Traffic Management User Interface (TMUI), also referred to as the BIG-IP Configuration utility, restrictions on allowed commands may not be enforced.",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Fps, Gtm, Link Controller, Pem, Webaccelerator), Enterprise Manager",7.2,HIGH,0.0010400000028312206,false,false,false,false,,false,false,2018-12-20T00:00:00.000Z,0