cve,link,title,description,vendor,products,score,severity,epss,cisa,cisa_published,article,ransomware,exploited,exploited_date,poc,trended,trended_no_1,trended_no_1_date,published,trended_score
CVE-2022-41806,https://securityvulnerability.io/vulnerability/CVE-2022-41806,BIG-IP AFM NAT64 Policy Vulnerability CVE-2022-41806,"In versions 16.1.x before 16.1.3.2 and 15.1.x before 15.1.5.1, when BIG-IP AFM Network Address Translation policy with IPv6/IPv4 translation rules is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization.",F5,Big-ip Afm,7.5,HIGH,0.0008900000248104334,false,,false,false,false,,,false,false,,2022-10-19T00:00:00.000Z,0
CVE-2022-41813,https://securityvulnerability.io/vulnerability/CVE-2022-41813,"BIG-IP PEM and AFM TMUI, TMSH and iControl vulnerability CVE-2022-41813","In versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, when BIG-IP is provisioned with PEM or AFM module, an undisclosed input can cause Traffic Management Microkernel (TMM) to terminate.",F5,Big-ip Afm & Pem,6.5,MEDIUM,0.001069999998435378,false,,false,false,false,,,false,false,,2022-10-19T00:00:00.000Z,0
CVE-2022-28695,https://securityvulnerability.io/vulnerability/CVE-2022-28695,Arbitrary Command Execution Vulnerability in F5 BIG-IP AFM,"An authenticated attacker with elevated privileges on F5 BIG-IP AFM can exploit a file upload vulnerability within the Configuration utility. By uploading a specially crafted file, the attacker gains the ability to execute arbitrary commands on the affected system. This vulnerability primarily affects versions 16.1.x, 15.1.x, 14.1.x, and 13.1.x that have not reached End of Technical Support (EoTS). It's crucial for administrators to update to the patched versions to mitigate potential attacks.",F5,Big-ip Afm,7.2,HIGH,0.001339999958872795,false,,false,false,false,,,false,false,,2022-05-05T17:15:00.000Z,0
CVE-2022-23028,https://securityvulnerability.io/vulnerability/CVE-2022-23028,SYN Cookie Protection Issue in BIG-IP AFM by F5 Networks,"An issue exists in the BIG-IP AFM related to TCP Half Open flood vector when global SYN cookie protection is enabled. This causes certain types of TCP connections to fail, impacting the availability and reliability of services. It affects multiple versions of the BIG-IP AFM, necessitating attention from network administrators to ensure proper handling of TCP connections under flood attack conditions.",F5,Big-ip Afm,5.3,MEDIUM,0.0009200000204145908,false,,false,false,false,,,false,false,,2022-01-25T19:11:35.000Z,0
CVE-2022-23024,https://securityvulnerability.io/vulnerability/CVE-2022-23024,Denial of Service Vulnerability in BIG-IP AFM by F5 Networks,"A vulnerability exists in the BIG-IP AFM product by F5 Networks, specifically impacting versions 16.x prior to 16.1.0, 15.1.x prior to 15.1.4.1, 14.1.x prior to 14.1.4.2, and all versions of 13.1.x. This issue arises when the IPsec application layer gateway (ALG) logging profile is set on an IPsec ALG virtual server, allowing unspecified IPsec traffic to lead to the termination of the Traffic Management Microkernel (TMM), resulting in service disruptions.",F5,Big-ip Afm,7.5,HIGH,0.0010300000431016088,false,,false,false,false,,,false,false,,2022-01-25T19:11:28.000Z,0
CVE-2022-23018,https://securityvulnerability.io/vulnerability/CVE-2022-23018,Vulnerability in F5 BIG-IP AFM Affecting Multiple Versions,An issue exists in F5 BIG-IP AFM where specific configurations involving HTTP protocol security and HTTP Proxy Connect profiles can lead to undetected requests that cause the Traffic Management Microkernel (TMM) to unexpectedly terminate. This can result in service disruptions for users and requires immediate attention to avoid operational impacts. Please refer to the official documentation for a complete understanding of affected versions.,F5,Big-ip Afm,7.5,HIGH,0.0010300000431016088,false,,false,false,false,,,false,false,,2022-01-25T19:11:25.000Z,0
CVE-2021-23040,https://securityvulnerability.io/vulnerability/CVE-2021-23040,SQL Injection Vulnerability in F5 BIG-IP Application Security Manager,"A SQL injection vulnerability exists in a hidden page of the BIG-IP Configuration utility for F5 BIG-IP AFM. This flaw is only present when BIG-IP AFM is provisioned, enabling potential attackers to execute unauthorized SQL commands, which could compromise data integrity and security. It affects several versions of the software, necessitating prompt updates to mitigate security risks.",F5,Big-ip Afm,8.8,HIGH,0.0008699999889358878,false,,false,false,false,,,false,false,,2021-09-14T14:42:51.000Z,0
CVE-2021-22983,https://securityvulnerability.io/vulnerability/CVE-2021-22983,Cross-Site Scripting Vulnerability in BIG-IP AFM by F5 Networks,"On specific versions of the BIG-IP Application Security Manager, authenticated users can fall prey to a cross-site scripting attack through maliciously-crafted URLs when accessing the Configuration utility. This vulnerability exposes sensitive data and could allow attackers to manipulate user sessions or gain unauthorized information. Note that affected software versions that have reached End of Software Development are not considered in the evaluation.",F5,Big-ip Afm,5.4,MEDIUM,0.000539999979082495,false,,false,false,false,,,false,false,,2021-02-12T17:57:08.000Z,0
CVE-2020-27714,https://securityvulnerability.io/vulnerability/CVE-2020-27714,Protocol Inspection Vulnerability in BIG-IP AFM by F5 Networks,"On specific versions of F5 Networks' BIG-IP AFM, a vulnerability exists when a Protocol Inspection Profile is applied to a FastL4 virtual server configured for non-TCP traffic. This misconfiguration can lead to unexpected behavior, including the potential for the Traffic Management Microkernel (TMM) to restart, which may disrupt service and compromise network integrity.",F5,Big-ip Afm,7.5,HIGH,0.0010300000431016088,false,,false,false,false,,,false,false,,2020-12-24T15:10:43.000Z,0
CVE-2020-5935,https://securityvulnerability.io/vulnerability/CVE-2020-5935,MQTT Traffic Vulnerability in BIG-IP Products by F5 Networks,"A vulnerability exists in the F5 BIG-IP product line that can result in core file generation when handling MQTT traffic. Specifically, this issue arises when utilizing an MQTT profile alongside an iRule that manipulates the traffic on a BIG-IP virtual server. Affected versions include 15.1.0 through 15.1.0.5, as well as earlier versions such as 14.1.0 through 14.1.2.3 and 13.1.0 through 13.1.3.3. This could potentially impact the stability and performance of systems that rely on the BIG-IP platform for managing MQTT traffic.",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Fps, Gtm, Link Controller, Pem)",5.9,MEDIUM,0.0010300000431016088,false,,false,false,false,,,false,false,,2020-10-29T15:07:59.000Z,0
CVE-2020-5937,https://securityvulnerability.io/vulnerability/CVE-2020-5937,Denial-of-Service Vulnerability in BIG-IP AFM by F5 Networks,"A vulnerability in BIG-IP AFM versions 15.1.0 to 15.1.0.5 can lead to a denial-of-service condition. The issue arises when the Traffic Management Microkernel (TMM) processes layer 4 (L4) behavioral traffic, potentially resulting in the generation of a core file. This anomaly may disrupt service availability, allowing attackers to exploit weaknesses and diminish performance.",F5,Big-ip Afm,7.5,HIGH,0.0010300000431016088,false,,false,false,false,,,false,false,,2020-10-29T13:32:15.000Z,0
CVE-2020-5920,https://securityvulnerability.io/vulnerability/CVE-2020-5920,SQL Injection Vulnerability in F5 BIG-IP AFM Configuration Utility,"A vulnerability exists in the F5 BIG-IP AFM Configuration utility that allows authenticated users to execute a read-only blind SQL injection attack. This flaw affects multiple versions of the BIG-IP AFM product, potentially compromising sensitive data without the need for elevated privileges. Remediation is advised to mitigate the risk from malicious exploitation of this vulnerability.",F5,Big-ip Afm,4.3,MEDIUM,0.000539999979082495,false,,false,false,false,,,false,false,,2020-08-26T14:50:34.000Z,0
CVE-2019-6672,https://securityvulnerability.io/vulnerability/CVE-2019-6672,Performance Degradation in F5 BIG-IP Application Firewall due to Wildcard Virtual Server Configuration,"In specific versions of F5's BIG-IP Application Firewall, the configuration of bad-actor detection on a wildcard virtual server can lead to significant performance degradation. This impacts the efficiency of the system, particularly on hardware equipped with sPVA technology. Users of the affected versions should take precautions and consider adjusting their configurations to mitigate the performance issues.",F5,Big-ip Afm,7.5,HIGH,0.0010300000431016088,false,,false,false,false,,,false,false,,2019-11-27T21:38:16.000Z,0
CVE-2019-6658,https://securityvulnerability.io/vulnerability/CVE-2019-6658,SQL Injection Vulnerability in F5 BIG-IP AFM Configuration Utility,"A security vulnerability in the F5 BIG-IP AFM configuration utility allows authenticated users to potentially execute SQL injection attacks. This could lead to unauthorized data retrieval, manipulation of data, or impact the integrity and availability of the application. Proper security measures and patching are essential to mitigate this risk and protect against potential exploitation.",F5,Big-ip (afm),4.3,MEDIUM,0.000539999979082495,false,,false,false,false,,,false,false,,2019-11-01T14:59:18.000Z,0
CVE-2019-6657,https://securityvulnerability.io/vulnerability/CVE-2019-6657,Reflected Cross-Site Scripting in F5 BIG-IP Traffic Management User Interface,"A reflected cross-site scripting vulnerability exists in an undisclosed page of the F5 BIG-IP Traffic Management User Interface (TMUI), which may allow an attacker to execute arbitrary scripts in the context of the user's browser session. This could lead to unauthorized actions being taken on behalf of a user or the disclosure of sensitive information. Users are advised to apply the necessary updates and patches to mitigate this security risk.",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Fps, Gtm, Link Controller, Pem, Webaccelerator)",6.1,MEDIUM,0.0007800000021234155,false,,false,false,false,,,false,false,,2019-11-01T14:53:06.000Z,0
CVE-2019-6655,https://securityvulnerability.io/vulnerability/CVE-2019-6655,Data Leak Vulnerability in F5 BIG-IP Platforms,"F5 BIG-IP platforms with AVRs, ASMs, APMs, PEMs, AFMs, or AAMs provisioned are susceptible to a data leak issue. This vulnerability affects several versions, potentially exposing sensitive data to unauthorized access. Organizations using affected versions need to apply the necessary updates to mitigate potential risks associated with user data exposure.",F5,"Big-ip Avr, Asm, Apm, Pem, Afm, And/or Aam",5.3,MEDIUM,0.0008999999845400453,false,,false,false,false,,,false,false,,2019-09-25T19:00:43.000Z,0
CVE-2019-6639,https://securityvulnerability.io/vulnerability/CVE-2019-6639,Stored Cross-Site Scripting Vulnerability in BIG-IP by F5 Networks,"A stored cross-site scripting (XSS) vulnerability exists in the TMUI pages for AFM and PEM Subscriber management in BIG-IP deployments. This issue affects multiple versions, allowing a malicious administrator to inject harmful scripts that may be executed by other users. However, the vulnerability is limited to the control plane and cannot be exploited through the data plane.",F5,"Big-ip (afm, Pem)",4.8,MEDIUM,0.0004900000058114529,false,,false,false,false,,,false,false,,2019-07-03T18:26:41.000Z,0
CVE-2019-6636,https://securityvulnerability.io/vulnerability/CVE-2019-6636,Stored Cross-Site Scripting Vulnerability in BIG-IP by F5 Networks,"A stored cross-site scripting vulnerability exists in the AFM feed list of specific versions of BIG-IP by F5 Networks. This vulnerability allows an attacker to inject malicious scripts that could be stored and executed later as an admin user. The potential impact includes code execution and escalation of privileges for users with roles that can perform this attack, specifically resource administrators and administrators. Prompt updates and patches are recommended to mitigate this risk.",F5,"Big-ip (afm, Asm)",8.4,HIGH,0.001930000027641654,false,,false,false,false,,,false,false,,2019-07-03T18:17:07.000Z,0
CVE-2019-6626,https://securityvulnerability.io/vulnerability/CVE-2019-6626,Reflected Cross-Site Scripting Vulnerability in F5 BIG-IP Traffic Management User Interface,"A reflected cross-site scripting vulnerability has been identified in the F5 BIG-IP Traffic Management User Interface (TMUI). This issue can be exploited through an undisclosed page within the configuration utility, allowing attackers to inject malicious scripts into web pages viewed by administrators. When the target interacts with a compromised link, the injected script can execute within the browser session, potentially leading to unauthorized access to sensitive information and altering the normal functionality of the user interface.",F5,"Big-ip (afm, Analytics, Asm)",6.1,MEDIUM,0.0007800000021234155,false,,false,false,false,,,false,false,,2019-07-03T17:34:06.000Z,0
CVE-2019-6619,https://securityvulnerability.io/vulnerability/CVE-2019-6619,Traffic Management Microkernel Vulnerability in F5 BIG-IP Product,The Traffic Management Microkernel (TMM) in certain F5 BIG-IP versions is prone to unexpected restarts when handling HTTP/2 traffic with Application Layer Protocol Negotiation (ALPN) settings that include a zero-sized extension. This could lead to service disruptions affecting network availability.,F5,"Big-ip (ltm, Aam, Afm, Apm, Asm, Link Controller, Pem, Webaccelerator)",7.5,HIGH,0.000859999970998615,false,,false,false,false,,,false,false,,2019-05-03T19:35:37.000Z,0
CVE-2019-6618,https://securityvulnerability.io/vulnerability/CVE-2019-6618,File System Modification Vulnerability in BIG-IP by F5 Networks,"Users with the Resource Administrator role in certain versions of BIG-IP can gain unauthorized access to sensitive areas of the filesystem if granted Advanced Shell Access. This includes the ability to edit critical files such as /etc/passwd, potentially enabling malicious modifications to user objects and violating the inherent restrictions associated with the Resource Administrator role.",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Fps, Gtm, Link Controller, Pem, Webaccelerator)",4.9,MEDIUM,0.000539999979082495,false,,false,false,false,,,false,false,,2019-05-03T19:28:54.000Z,0
CVE-2019-6617,https://securityvulnerability.io/vulnerability/CVE-2019-6617,Sensitive File Overwrite Vulnerability in BIG-IP by F5 Networks,"On certain versions of BIG-IP by F5 Networks, users assigned the Resource Administrator role can exploit a vulnerability that allows them to overwrite sensitive low-level files, such as '/etc/passwd', using SFTP. This occurs without requiring Advanced Shell access, which contravenes the defined restrictions for the Resource Administrator role. This flaw exposes critical system files to unauthorized modifications, potentially leading to unauthorized access and privilege escalation.",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Fps, Gtm, Link Controller, Pem, Webaccelerator)",6.5,MEDIUM,0.001180000021122396,false,,false,false,false,,,false,false,,2019-05-03T19:16:02.000Z,0
CVE-2019-6616,https://securityvulnerability.io/vulnerability/CVE-2019-6616,File Overwrite Vulnerability in BIG-IP by F5 Networks,"The vulnerability allows administrative users with TMSH access on specific versions of F5 BIG-IP to overwrite critical system files. This could potentially lead to the circumvention of established whitelist and blacklist controls, adversely affecting the security posture of the appliance. Organizations utilizing these affected versions should assess their systems for risk and apply appropriate security measures.",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Fps, Gtm, Link Controller, Pem, Webaccelerator)",7.2,HIGH,0.0014400000218302011,false,,false,false,false,,,false,false,,2019-05-03T19:12:57.000Z,0
CVE-2019-6614,https://securityvulnerability.io/vulnerability/CVE-2019-6614,Arbitrary File Overwrite Vulnerability in F5 BIG-IP Products,"The F5 BIG-IP platform allows high-privileged authenticated attackers to exploit insufficient protections in Appliance Mode. Specifically, versions 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, and 12.1.0-12.1.4 are affected. When successfully exploited, this vulnerability enables attackers to overwrite arbitrary system files, potentially leading to a complete compromise of the affected system. This flaw arises due to internal mechanisms failing to adequately prevent such file operations.",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Fps, Gtm, Link Controller, Pem, Webaccelerator)",6.5,MEDIUM,0.0007200000109151006,false,,false,false,false,,,false,false,,2019-05-03T19:09:12.000Z,0
CVE-2019-6615,https://securityvulnerability.io/vulnerability/CVE-2019-6615,Access Control Bypass in BIG-IP by F5 Networks,"A vulnerability exists in F5 Networks' BIG-IP systems, where the Administrator and Resource Administrator roles can exploit TMSH access. This flaw allows for bypassing restrictions imposed by Appliance Mode in specific versions of BIG-IP. Administrators must ensure that systems are adequately secured to prevent unauthorized access through this vulnerability.",F5,"Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Gtm, Link Controller, Pem, Webaccelerator, Websafe)",4.9,MEDIUM,0.0005499999970197678,false,,false,false,false,,,false,false,,2019-05-03T19:05:20.000Z,0