cve,link,title,description,vendor,products,score,severity,epss,cisa,cisa_published,article,ransomware,exploited,exploited_date,poc,trended,trended_no_1,trended_no_1_date,published,trended_score
CVE-2019-6657,https://securityvulnerability.io/vulnerability/CVE-2019-6657,Reflected Cross-Site Scripting in F5 BIG-IP Traffic Management User Interface,"A reflected cross-site scripting vulnerability exists in an undisclosed page of the F5 BIG-IP Traffic Management User Interface (TMUI), which may allow an attacker to execute arbitrary scripts in the context of the user's browser session. This could lead to unauthorized actions being taken on behalf of a user or the disclosure of sensitive information. Users are advised to apply the necessary updates and patches to mitigate this security risk.",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Fps, Gtm, Link Controller, Pem, Webaccelerator)",6.1,MEDIUM,0.0007800000021234155,false,,false,false,false,,,false,false,,2019-11-01T14:53:06.000Z,0
CVE-2019-6619,https://securityvulnerability.io/vulnerability/CVE-2019-6619,Traffic Management Microkernel Vulnerability in F5 BIG-IP Product,The Traffic Management Microkernel (TMM) in certain F5 BIG-IP versions is prone to unexpected restarts when handling HTTP/2 traffic with Application Layer Protocol Negotiation (ALPN) settings that include a zero-sized extension. This could lead to service disruptions affecting network availability.,F5,"Big-ip (ltm, Aam, Afm, Apm, Asm, Link Controller, Pem, Webaccelerator)",7.5,HIGH,0.000859999970998615,false,,false,false,false,,,false,false,,2019-05-03T19:35:37.000Z,0
CVE-2019-6618,https://securityvulnerability.io/vulnerability/CVE-2019-6618,File System Modification Vulnerability in BIG-IP by F5 Networks,"Users with the Resource Administrator role in certain versions of BIG-IP can gain unauthorized access to sensitive areas of the filesystem if granted Advanced Shell Access. This includes the ability to edit critical files such as /etc/passwd, potentially enabling malicious modifications to user objects and violating the inherent restrictions associated with the Resource Administrator role.",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Fps, Gtm, Link Controller, Pem, Webaccelerator)",4.9,MEDIUM,0.000539999979082495,false,,false,false,false,,,false,false,,2019-05-03T19:28:54.000Z,0
CVE-2019-6617,https://securityvulnerability.io/vulnerability/CVE-2019-6617,Sensitive File Overwrite Vulnerability in BIG-IP by F5 Networks,"On certain versions of BIG-IP by F5 Networks, users assigned the Resource Administrator role can exploit a vulnerability that allows them to overwrite sensitive low-level files, such as '/etc/passwd', using SFTP. This occurs without requiring Advanced Shell access, which contravenes the defined restrictions for the Resource Administrator role. This flaw exposes critical system files to unauthorized modifications, potentially leading to unauthorized access and privilege escalation.",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Fps, Gtm, Link Controller, Pem, Webaccelerator)",6.5,MEDIUM,0.001180000021122396,false,,false,false,false,,,false,false,,2019-05-03T19:16:02.000Z,0
CVE-2019-6616,https://securityvulnerability.io/vulnerability/CVE-2019-6616,File Overwrite Vulnerability in BIG-IP by F5 Networks,"The vulnerability allows administrative users with TMSH access on specific versions of F5 BIG-IP to overwrite critical system files. This could potentially lead to the circumvention of established whitelist and blacklist controls, adversely affecting the security posture of the appliance. Organizations utilizing these affected versions should assess their systems for risk and apply appropriate security measures.",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Fps, Gtm, Link Controller, Pem, Webaccelerator)",7.2,HIGH,0.0014400000218302011,false,,false,false,false,,,false,false,,2019-05-03T19:12:57.000Z,0
CVE-2019-6614,https://securityvulnerability.io/vulnerability/CVE-2019-6614,Arbitrary File Overwrite Vulnerability in F5 BIG-IP Products,"The F5 BIG-IP platform allows high-privileged authenticated attackers to exploit insufficient protections in Appliance Mode. Specifically, versions 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, and 12.1.0-12.1.4 are affected. When successfully exploited, this vulnerability enables attackers to overwrite arbitrary system files, potentially leading to a complete compromise of the affected system. This flaw arises due to internal mechanisms failing to adequately prevent such file operations.",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Fps, Gtm, Link Controller, Pem, Webaccelerator)",6.5,MEDIUM,0.0007200000109151006,false,,false,false,false,,,false,false,,2019-05-03T19:09:12.000Z,0
CVE-2019-6615,https://securityvulnerability.io/vulnerability/CVE-2019-6615,Access Control Bypass in BIG-IP by F5 Networks,"A vulnerability exists in F5 Networks' BIG-IP systems, where the Administrator and Resource Administrator roles can exploit TMSH access. This flaw allows for bypassing restrictions imposed by Appliance Mode in specific versions of BIG-IP. Administrators must ensure that systems are adequately secured to prevent unauthorized access through this vulnerability.",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Gtm, Link Controller, Pem, Webaccelerator, Websafe)",4.9,MEDIUM,0.0005499999970197678,false,,false,false,false,,,false,false,,2019-05-03T19:05:20.000Z,0
CVE-2019-6613,https://securityvulnerability.io/vulnerability/CVE-2019-6613,SNMP Vulnerability in BIG-IP Products by F5 Networks,"A vulnerability exists in F5 Networks BIG-IP products where SNMP may inadvertently expose sensitive configuration objects. This issue affects multiple versions and arises when a passphrase is applied to various profile types accessed via SNMPv2, leading to potential unauthorized access to critical network configurations over unencrypted transmission channels.",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Fps, Gtm, Link Controller, Pem, Webaccelerator)",5.3,MEDIUM,0.0006200000061653554,false,,false,false,false,,,false,false,,2019-05-03T18:00:17.000Z,0
CVE-2019-6611,https://securityvulnerability.io/vulnerability/CVE-2019-6611,Incorrect Logic Execution in BIG-IP Systems due to PPTP VPN Traffic Processing,"The vulnerability in certain versions of F5 BIG-IP systems arises when processing specific rare data sequences in PPTP VPN traffic. This anomaly can lead to incorrect logic execution, potentially causing the Traffic Management Microkernel (TMM) to restart unexpectedly and create a core file. Systems provisioned with the Carrier Grade NAT (CGNAT) module and configured with a PPTP profile are particularly susceptible to this issue.",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Fps, Gtm, Link Controller, Pem, Webaccelerator)",7.5,HIGH,0.0008200000156648457,false,,false,false,false,,,false,false,,2019-05-03T17:47:56.000Z,0
CVE-2019-6610,https://securityvulnerability.io/vulnerability/CVE-2019-6610,Denial of Service Vulnerability in F5 BIG-IP Products,"A denial of service vulnerability exists in F5 BIG-IP systems that allows an attacker to disrupt service by exploiting weaknesses in URL classification. Specifically, the affected versions may become unresponsive during certain operations, impacting the availability of services dependent on these products.",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Fps, Gtm, Link Controller, Pem, Webaccelerator)",8.6,HIGH,0.0010499999625608325,false,,false,false,false,,,false,false,,2019-04-11T17:09:12.000Z,0
CVE-2019-6597,https://securityvulnerability.io/vulnerability/CVE-2019-6597,Command Restriction Flaw in BIG-IP Configuration Utility by F5 Networks,"A command restriction flaw exists in F5 Networks’ BIG-IP where authenticated administrative users can execute unauthorized commands through the Traffic Management User Interface (TMUI). This vulnerability may lead to unintended administrative access and manipulation of system settings, compromising the security posture of the application and potentially exposing sensitive data or configurations.",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Fps, Gtm, Link Controller, Pem, Webaccelerator); Enterprise Manager",7.2,HIGH,0.0010400000028312206,false,,false,false,false,,,false,false,,2019-03-11T00:00:00.000Z,0
CVE-2019-6598,https://securityvulnerability.io/vulnerability/CVE-2019-6598,Traffic Management User Interface Vulnerability in F5 BIG-IP,"In the F5 BIG-IP version range of 11.5.1 to 14.0.0.2, a vulnerability exists in the Traffic Management User Interface (TMUI) that allows authenticated users to submit malformed requests. This can lead to a disruption of TMUI services. Users with any role except the No Access role can exploit this vulnerability, as they possess sufficient access rights to perform the attack on the TMUI.",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Gtm, Link Controller, Pem, Webaccelerator, Websafe); Enterprise Manager",4.3,MEDIUM,0.0007099999929778278,false,,false,false,false,,,false,false,,2019-03-11T00:00:00.000Z,0
CVE-2019-6600,https://securityvulnerability.io/vulnerability/CVE-2019-6600,Cross-Site Scripting Vulnerability in F5 BIG-IP Products,"In specific versions of F5 BIG-IP, when remote authentication is enabled for administrative users and external users are assigned the 'guest' role, there is a potential for unsanitized values to be reflected back to the client through the login page. This susceptibility can expose unauthenticated clients to cross-site scripting attacks, allowing attackers to execute arbitrary scripts in the context of a user's session, which can result in unauthorized actions and sensitive data exposure.",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Fps, Gtm, Link Controller, Pem, Webaccelerator)",6.1,MEDIUM,0.000699999975040555,false,,false,false,false,,,false,false,,2019-03-11T00:00:00.000Z,0
CVE-2019-6592,https://securityvulnerability.io/vulnerability/CVE-2019-6592,BIG-IP SSL Certificate Validation Issue by F5 Networks,"An issue exists within the F5 BIG-IP product affecting versions 14.1.0 to 14.1.0.1, where the Traffic Management Microkernel (TMM) may unexpectedly restart. This occurs during the validation of SSL certificates in both client SSL and server SSL profiles, potentially impacting the availability of services reliant on secure communications.",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Fps, Gtm, Link Controller, Pem, Webaccelerator)",9.1,CRITICAL,0.0011599999852478504,false,,false,false,false,,,false,false,,2019-02-26T00:00:00.000Z,0
CVE-2019-6593,https://securityvulnerability.io/vulnerability/CVE-2019-6593,Chosen Ciphertext Attack Vulnerability in BIG-IP by F5 Networks,"On specific versions of BIG-IP by F5 Networks, a virtual server set up with a Client SSL profile is exposed to a vulnerability that allows an attacker to conduct a chosen ciphertext attack against CBC ciphers. This flaw can enable an attacker to recover plaintext from encrypted messages through a man-in-the-middle (MITM) attack, all without needing access to the server's private key. The affected versions include BIG-IP 11.5.1 to 11.5.4, 11.6.1, and 12.1.0, raising serious concerns regarding data confidentiality and integrity.",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Fps, Gtm, Link Controller, Pem, Webaccelerator)",5.9,MEDIUM,0.0012799999676644802,false,,false,false,false,,,false,false,,2019-02-26T00:00:00.000Z,0
CVE-2019-6594,https://securityvulnerability.io/vulnerability/CVE-2019-6594,Multi-Path TCP Issue in BIG-IP Products by F5 Networks,"An issue exists in the Multi-Path TCP (MPTCP) implementation in specific versions of BIG-IP products from F5 Networks. This vulnerability occurs when the system fails to adequately manage multiple zero length DATA_FIN packets in the reassembly queue, which may result in an infinite loop under certain conditions. It is crucial for users of affected versions to be aware of this issue and implement recommended mitigations.",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Fps, Gtm, Link Controller, Pem, Webaccelerator)",5.9,MEDIUM,0.0010499999625608325,false,,false,false,false,,,false,false,,2019-02-26T00:00:00.000Z,0
CVE-2019-6589,https://securityvulnerability.io/vulnerability/CVE-2019-6589,,"On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.3, 12.1.0-12.1.3.7, and 11.6.0-11.6.3.2, a reflected Cross Site Scripting (XSS) vulnerability is present in an undisclosed page of the BIG-IP TMUI (Traffic Management User Interface) also known as the BIG-IP configuration utility.",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Fps, Gtm, Link Controller, Pem, Webaccelerator)",6.1,MEDIUM,0.0007900000200606883,false,,false,false,false,,,false,false,,2019-01-29T00:00:00.000Z,0
CVE-2018-15333,https://securityvulnerability.io/vulnerability/CVE-2018-15333,,"On versions 11.2.1. and greater, unrestricted Snapshot File Access allows BIG-IP system's user with any role, including Guest Role, to have access and download previously generated and available snapshot files on the BIG-IP configuration utility such as QKView and TCPDumps.",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Fps, Gtm, Link Controller, Pem, Webaccelerator)",5.5,MEDIUM,0.0005099999834783375,false,,false,false,false,,,false,false,,2018-12-28T15:00:00.000Z,0
CVE-2018-15330,https://securityvulnerability.io/vulnerability/CVE-2018-15330,,"On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.1, or 12.1.0-12.1.3.7, when a virtual server using the inflate functionality to process a gzip bomb as a payload, the BIG-IP system will experience a fatal error and may cause the Traffic Management Microkernel (TMM) to produce a core file.",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Fps, Gtm, Link Controller, Pem, Webaccelerator)",7.5,HIGH,0.0010499999625608325,false,,false,false,false,,,false,false,,2018-12-20T00:00:00.000Z,0
CVE-2018-15329,https://securityvulnerability.io/vulnerability/CVE-2018-15329,,"On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.1, or 12.1.0-12.1.3.7, or Enterprise Manager 3.1.1, when authenticated administrative users run commands in the Traffic Management User Interface (TMUI), also referred to as the BIG-IP Configuration utility, restrictions on allowed commands may not be enforced.",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Fps, Gtm, Link Controller, Pem, Webaccelerator), Enterprise Manager",7.2,HIGH,0.0010400000028312206,false,,false,false,false,,,false,false,,2018-12-20T00:00:00.000Z,0
CVE-2018-15328,https://securityvulnerability.io/vulnerability/CVE-2018-15328,,"On BIG-IP 14.0.x, 13.x, 12.x, and 11.x, Enterprise Manager 3.1.1, BIG-IQ 6.x, 5.x, and 4.x, and iWorkflow 2.x, the passphrases for SNMPv3 users and trap destinations that are used for authentication and privacy are not handled by the BIG-IP system Secure Vault feature; they are written in the clear to the various configuration files.",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Fps, Gtm, Link Controller, Pem, Webaccelerator), Enterprise Manager, Big-iq Centralized Management, F5 Iworkflow",7.5,HIGH,0.0010400000028312206,false,,false,false,false,,,false,false,,2018-12-12T14:00:00.000Z,0
CVE-2018-15318,https://securityvulnerability.io/vulnerability/CVE-2018-15318,,"In BIG-IP 14.0.0-14.0.0.2, 13.1.0.4-13.1.1.1, or 12.1.3.4-12.1.3.6, If an MPTCP connection receives an abort signal while the initial flow is not the primary flow, the initial flow will remain after the closing procedure is complete. TMM may restart and produce a core file as a result of this condition.",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Fps, Gtm, Link Controller, Pem, Webaccelerator)",7.5,HIGH,0.0008999999845400453,false,,false,false,false,,,false,false,,2018-10-31T14:00:00.000Z,0
CVE-2018-15317,https://securityvulnerability.io/vulnerability/CVE-2018-15317,,"In BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.5, 12.1.0-12.1.4.1, and 11.2.1-11.6.3.2, an attacker sending specially crafted SSL records to a SSL Virtual Server will cause corruption in the SSL data structures leading to intermittent decrypt BAD_RECORD_MAC errors. Clients will be unable to access the application load balanced by a virtual server with an SSL profile until tmm is restarted.",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Fps, Gtm, Link Controller, Pem, Webaccelerator)",7.5,HIGH,0.001019999966956675,false,,false,false,false,,,false,false,,2018-10-31T14:00:00.000Z,0
CVE-2018-15322,https://securityvulnerability.io/vulnerability/CVE-2018-15322,,"On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.0.7, 12.1.0-12.1.3.5, 11.6.0-11.6.3.2, or 11.2.1-11.5.6, BIG-IQ Centralized Management 6.0.0-6.0.1, 5.0.0-5.4.0 or 4.6.0, BIG-IQ Cloud and Orchestration 1.0.0, iWorkflow 2.0.1-2.3.0, or Enterprise Manager 3.1.1 a BIG-IP user granted with tmsh access may cause the BIG-IP system to experience denial-of-service (DoS) when the BIG-IP user uses the tmsh utility to run the edit cli preference command and proceeds to save the changes to another filename repeatedly. This action utilises storage space on the /var partition and when performed repeatedly causes the /var partition to be full.",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Gtm, Link Controller, Pem, Webaccelerator, Websafe), Big-iq Centralized Management, Big-iq Cloud And Orchestration, Iworkflow, Enterprise Manager",6.5,MEDIUM,0.0007200000109151006,false,,false,false,false,,,false,false,,2018-10-31T14:00:00.000Z,0
CVE-2018-15320,https://securityvulnerability.io/vulnerability/CVE-2018-15320,,"On BIG-IP 14.0.0-14.0.0.2 or 13.0.0-13.1.1.1, undisclosed traffic patterns may lead to denial of service conditions for the BIG-IP system. The configuration which exposes this condition is the BIG-IP self IP address which is part of a VLAN group and has the Port Lockdown setting configured with anything other than ""allow-all"".",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Fps, Gtm, Link Controller, Pem, Webaccelerator)",7.5,HIGH,0.0008999999845400453,false,,false,false,false,,,false,false,,2018-10-31T14:00:00.000Z,0