cve,link,title,description,vendor,products,score,severity,epss,cisa,article,ransomware,exploited,poc,trended,trended_no_1,published,trended_score
CVE-2022-41813,https://securityvulnerability.io/vulnerability/CVE-2022-41813,"BIG-IP PEM and AFM TMUI, TMSH and iControl vulnerability CVE-2022-41813","In versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, when BIG-IP is provisioned with PEM or AFM module, an undisclosed input can cause Traffic Management Microkernel (TMM) to terminate.",F5,Big-ip Afm & Pem,6.5,MEDIUM,0.001069999998435378,false,false,false,false,,false,false,2022-10-19T00:00:00.000Z,0
CVE-2020-5942,https://securityvulnerability.io/vulnerability/CVE-2020-5942,,"In BIG-IP PEM versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.2.7, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, when processing Capabilities-Exchange-Answer (CEA) packets with certain attributes from the Policy and Charging Rules Function (PCRF) server, the Traffic Management Microkernel (TMM) may generate a core file and restart.",F5,Big-ip (pem),7.5,HIGH,0.0010300000431016088,false,false,false,false,,false,false,2020-11-05T19:15:48.000Z,0
CVE-2020-5935,https://securityvulnerability.io/vulnerability/CVE-2020-5935,,"On BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, FPS, GTM, Link Controller, PEM) versions 15.1.0-15.1.0.5, 14.1.0-14.1.2.3, and 13.1.0-13.1.3.3, when handling MQTT traffic through a BIG-IP virtual server associated with an MQTT profile and an iRule performing manipulations on that traffic, TMM may produce a core file.",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Fps, Gtm, Link Controller, Pem)",5.9,MEDIUM,0.0010300000431016088,false,false,false,false,,false,false,2020-10-29T15:07:59.000Z,0
CVE-2019-6657,https://securityvulnerability.io/vulnerability/CVE-2019-6657,,"On BIG-IP 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, a reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Traffic Management User Interface (TMUI), also known as the BIG-IP Configuration utility.",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Fps, Gtm, Link Controller, Pem, Webaccelerator)",6.1,MEDIUM,0.0007800000021234155,false,false,false,false,,false,false,2019-11-01T14:53:06.000Z,0
CVE-2019-6655,https://securityvulnerability.io/vulnerability/CVE-2019-6655,,"On versions 13.0.0-13.1.0.1, 12.1.0-12.1.4.1, 11.6.1-11.6.4, and 11.5.1-11.5.9, BIG-IP platforms where AVR, ASM, APM, PEM, AFM, and/or AAM is provisioned may leak sensitive data.",F5,"Big-ip Avr, Asm, Apm, Pem, Afm, And/or Aam",5.3,MEDIUM,0.0008999999845400453,false,false,false,false,,false,false,2019-09-25T19:00:43.000Z,0
CVE-2019-6639,https://securityvulnerability.io/vulnerability/CVE-2019-6639,,"On BIG-IP (AFM, PEM) 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.1-11.5.8, an undisclosed TMUI pages for AFM and PEM Subscriber management are vulnerable to a stored cross-site scripting (XSS) issue. This is a control plane issue only and is not accessible from the data plane. The attack requires a malicious resource administrator to store the XSS.",F5,"Big-ip (afm, Pem)",4.8,MEDIUM,0.0004900000058114529,false,false,false,false,,false,false,2019-07-03T18:26:41.000Z,0
CVE-2019-6628,https://securityvulnerability.io/vulnerability/CVE-2019-6628,,"On BIG-IP PEM 14.1.0-14.1.0.5 and 14.0.0-14.0.0.4, under certain conditions, the TMM process may terminate and restart while processing BIG-IP PEM traffic with the OpenVPN classifier.",F5,Big-ip Pem,7.5,HIGH,0.0010300000431016088,false,false,false,false,,false,false,2019-07-03T17:42:53.000Z,0
CVE-2019-6619,https://securityvulnerability.io/vulnerability/CVE-2019-6619,,"On BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, the Traffic Management Microkernel (TMM) may restart when a virtual server has an HTTP/2 profile with Application Layer Protocol Negotiation (ALPN) enabled and it processes traffic where the ALPN extension size is zero.",F5,"Big-ip (ltm, Aam, Afm, Apm, Asm, Link Controller, Pem, Webaccelerator)",7.5,HIGH,0.000859999970998615,false,false,false,false,,false,false,2019-05-03T19:35:37.000Z,0
CVE-2019-6618,https://securityvulnerability.io/vulnerability/CVE-2019-6618,,"On BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8, users with the Resource Administrator role can modify sensitive portions of the filesystem if provided Advanced Shell Access, such as editing /etc/passwd. This allows modifications to user objects and is contrary to our definition for the Resource Administrator (RA) role restrictions.",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Fps, Gtm, Link Controller, Pem, Webaccelerator)",4.9,MEDIUM,0.000539999979082495,false,false,false,false,,false,false,2019-05-03T19:28:54.000Z,0
CVE-2019-6617,https://securityvulnerability.io/vulnerability/CVE-2019-6617,,"On BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8, a user with the Resource Administrator role is able to overwrite sensitive low-level files (such as /etc/passwd) using SFTP to modify user permissions, without Advanced Shell access. This is contrary to our definition for the Resource Administrator (RA) role restrictions.",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Fps, Gtm, Link Controller, Pem, Webaccelerator)",6.5,MEDIUM,0.001180000021122396,false,false,false,false,,false,false,2019-05-03T19:16:02.000Z,0
CVE-2019-6616,https://securityvulnerability.io/vulnerability/CVE-2019-6616,,"On BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8, administrative users with TMSH access can overwrite critical system files on BIG-IP which can result in bypass of whitelist / blacklist restrictions enforced by appliance mode.",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Fps, Gtm, Link Controller, Pem, Webaccelerator)",7.2,HIGH,0.00171999994199723,false,false,false,false,,false,false,2019-05-03T19:12:57.000Z,0
CVE-2019-6614,https://securityvulnerability.io/vulnerability/CVE-2019-6614,,"On BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, internal methods used to prevent arbitrary file overwrites in Appliance Mode were not fully effective. An authenticated attacker with a high privilege level may be able to bypass protections implemented in appliance mode to overwrite arbitrary system files.",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Fps, Gtm, Link Controller, Pem, Webaccelerator)",6.5,MEDIUM,0.0007200000109151006,false,false,false,false,,false,false,2019-05-03T19:09:12.000Z,0
CVE-2019-6615,https://securityvulnerability.io/vulnerability/CVE-2019-6615,,"On BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8, Administrator and Resource Administrator roles might exploit TMSH access to bypass Appliance Mode restrictions on BIG-IP systems.",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Gtm, Link Controller, Pem, Webaccelerator, Websafe)",4.9,MEDIUM,0.0005499999970197678,false,false,false,false,,false,false,2019-05-03T19:05:20.000Z,0
CVE-2019-6613,https://securityvulnerability.io/vulnerability/CVE-2019-6613,,"On BIG-IP 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8, SNMP may expose sensitive configuration objects over insecure transmission channels. This issue is exposed when a passphrase is used with various profile types and is accessed using SNMPv2.",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Fps, Gtm, Link Controller, Pem, Webaccelerator)",5.3,MEDIUM,0.0006200000061653554,false,false,false,false,,false,false,2019-05-03T18:00:17.000Z,0
CVE-2019-6612,https://securityvulnerability.io/vulnerability/CVE-2019-6612,,"On BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8, DNS query TCP connections that are aborted before receiving a response from a DNS cache may cause TMM to restart.",F5,"Big-ip (ltm, Aam, Afm, Apm, Asm, Dns, Gtm, Link Controller, Pem)",7.5,HIGH,0.000859999970998615,false,false,false,false,,false,false,2019-05-03T17:56:16.000Z,0
CVE-2019-6611,https://securityvulnerability.io/vulnerability/CVE-2019-6611,,"When BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8 are processing certain rare data sequences occurring in PPTP VPN traffic, the BIG-IP system may execute incorrect logic. The TMM may restart and produce a core file as a result of this condition. The BIG-IP system provisioned with the CGNAT module and configured with a virtual server using a PPTP profile is exposed to this vulnerability.",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Fps, Gtm, Link Controller, Pem, Webaccelerator)",7.5,HIGH,0.0008200000156648457,false,false,false,false,,false,false,2019-05-03T17:47:56.000Z,0
CVE-2019-6610,https://securityvulnerability.io/vulnerability/CVE-2019-6610,,"On BIG-IP versions 14.0.0-14.0.0.4, 13.0.0-13.1.1.1, 12.1.0-12.1.4, 11.6.0-11.6.3.4, and 11.5.1-11.5.8, the system is vulnerable to a denial of service attack when performing URL classification.",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Fps, Gtm, Link Controller, Pem, Webaccelerator)",8.6,HIGH,0.0010300000431016088,false,false,false,false,,false,false,2019-04-11T17:09:12.000Z,0
CVE-2019-6598,https://securityvulnerability.io/vulnerability/CVE-2019-6598,,"In BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.0.7, 12.1.0-12.1.3.5, 11.6.1-11.6.3.2, or 11.5.1-11.5.8 or Enterprise Manager 3.1.1, malformed requests to the Traffic Management User Interface (TMUI), also referred to as the BIG-IP Configuration utility, may lead to disruption of TMUI services. This attack requires an authenticated user with any role (other than the No Access role). The No Access user role cannot login and does not have the access level to perform the attack.",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Gtm, Link Controller, Pem, Webaccelerator, Websafe); Enterprise Manager",4.3,MEDIUM,0.0007099999929778278,false,false,false,false,,false,false,2019-03-11T00:00:00.000Z,0
CVE-2019-6597,https://securityvulnerability.io/vulnerability/CVE-2019-6597,,"In BIG-IP 13.0.0-13.1.1.1, 12.1.0-12.1.3.7, 11.6.1-11.6.3.2, or 11.5.1-11.5.8 or Enterprise Manager 3.1.1, when authenticated administrative users run commands in the Traffic Management User Interface (TMUI), also referred to as the BIG-IP Configuration utility, restrictions on allowed commands may not be enforced.",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Fps, Gtm, Link Controller, Pem, Webaccelerator); Enterprise Manager",7.2,HIGH,0.0010400000028312206,false,false,false,false,,false,false,2019-03-11T00:00:00.000Z,0
CVE-2019-6600,https://securityvulnerability.io/vulnerability/CVE-2019-6600,,"In BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.3, 12.1.0-12.1.3.7, 11.6.1-11.6.3.2, or 11.5.1-11.5.8, when remote authentication is enabled for administrative users and all external users are granted the ""guest"" role, unsanitized values can be reflected to the client via the login page. This can lead to a cross-site scripting attack against unauthenticated clients.",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Fps, Gtm, Link Controller, Pem, Webaccelerator)",6.1,MEDIUM,0.000699999975040555,false,false,false,false,,false,false,2019-03-11T00:00:00.000Z,0
CVE-2019-6593,https://securityvulnerability.io/vulnerability/CVE-2019-6593,,"On BIG-IP 11.5.1-11.5.4, 11.6.1, and 12.1.0, a virtual server configured with a Client SSL profile may be vulnerable to a chosen ciphertext attack against CBC ciphers. When exploited, this may result in plaintext recovery of encrypted messages through a man-in-the-middle (MITM) attack, despite the attacker not having gained access to the server's private key itself. (CVE-2019-6593 also known as Zombie POODLE and GOLDENDOODLE.)",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Fps, Gtm, Link Controller, Pem, Webaccelerator)",5.9,MEDIUM,0.0012799999676644802,false,false,false,false,,false,false,2019-02-26T00:00:00.000Z,0
CVE-2019-6594,https://securityvulnerability.io/vulnerability/CVE-2019-6594,,"On BIG-IP 11.5.1-11.6.3.2, 12.1.3.4-12.1.3.7, 13.0.0 HF1-13.1.1.1, and 14.0.0-14.0.0.2, Multi-Path TCP (MPTCP) does not protect against multiple zero length DATA_FINs in the reassembly queue, which can lead to an infinite loop in some circumstances.",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Fps, Gtm, Link Controller, Pem, Webaccelerator)",5.9,MEDIUM,0.0010499999625608325,false,false,false,false,,false,false,2019-02-26T00:00:00.000Z,0
CVE-2019-6592,https://securityvulnerability.io/vulnerability/CVE-2019-6592,,"On BIG-IP 14.1.0-14.1.0.1, TMM may restart and produce a core file when validating SSL certificates in client SSL or server SSL profiles.",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Fps, Gtm, Link Controller, Pem, Webaccelerator)",9.1,CRITICAL,0.0011599999852478504,false,false,false,false,,false,false,2019-02-26T00:00:00.000Z,0
CVE-2019-6589,https://securityvulnerability.io/vulnerability/CVE-2019-6589,,"On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.3, 12.1.0-12.1.3.7, and 11.6.0-11.6.3.2, a reflected Cross Site Scripting (XSS) vulnerability is present in an undisclosed page of the BIG-IP TMUI (Traffic Management User Interface) also known as the BIG-IP configuration utility.",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Fps, Gtm, Link Controller, Pem, Webaccelerator)",6.1,MEDIUM,0.0007900000200606883,false,false,false,false,,false,false,2019-01-29T00:00:00.000Z,0
CVE-2018-15333,https://securityvulnerability.io/vulnerability/CVE-2018-15333,,"On versions 11.2.1. and greater, unrestricted Snapshot File Access allows BIG-IP system's user with any role, including Guest Role, to have access and download previously generated and available snapshot files on the BIG-IP configuration utility such as QKView and TCPDumps.",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Fps, Gtm, Link Controller, Pem, Webaccelerator)",5.5,MEDIUM,0.0005099999834783375,false,false,false,false,,false,false,2018-12-28T15:00:00.000Z,0