F5

Big-ip Advanced Web Application Firewall

109 vulnerabilities found.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
7.5

CVE-2020-5939

  • EPSS 0.65%
  • Published 05.11.2020 20:15:17
  • Last modified 21.11.2024 05:34:52

In versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.3, 15.0.0-15.0.1.3, 14.1.0-14.1.2.6, and 13.1.0-13.1.3.4, BIG-IP Virtual Edition (VE) systems on VMware, with an Intel-based 85299 Network Interface Controller (NIC) card and Single Root I/O Virtualization (...

6.5

CVE-2020-5943

  • EPSS 0.15%
  • Published 05.11.2020 20:15:17
  • Last modified 21.11.2024 05:34:52

In versions 14.1.0-14.1.0.1 and 14.1.2.5-14.1.2.7, when a BIG-IP object is created or listed through the REST interface, the protected fields are obfuscated in the REST response, not protected via a SecureVault cryptogram as TMSH does. One example of...

7.5

CVE-2020-5946

  • EPSS 0.65%
  • Published 05.11.2020 20:15:17
  • Last modified 21.11.2024 05:34:52

In BIG-IP Advanced WAF and FPS versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.2.7, under some circumstances, certain format client-side alerts sent to the BIG-IP virtual server configured with DataSafe may cause the Traffic Management Mic...

6.5

CVE-2020-5938

  • EPSS 0.13%
  • Published 29.10.2020 14:15:12
  • Last modified 21.11.2024 05:34:51

On BIG-IP 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, when negotiating IPSec tunnels with configured, authenticated peers, the peer may negotiate a different key length than the BIG-IP configuration would otherwise allow.

5.9

CVE-2020-5929

  • EPSS 0.67%
  • Published 25.09.2020 14:15:13
  • Last modified 21.11.2024 05:34:50

In versions 13.0.0-13.0.0 HF2, 12.1.0-12.1.2 HF1, and 11.6.1-11.6.2, BIG-IP platforms with Cavium Nitrox SSL hardware acceleration cards, a Virtual Server configured with a Client SSL profile, and using Anonymous (ADH) or Ephemeral (DHE) Diffie-Hellm...

7.4

CVE-2020-5913

  • EPSS 0.19%
  • Published 26.08.2020 15:15:13
  • Last modified 21.11.2024 05:34:49

In versions 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.2, the BIG-IP Client or Server SSL profile ignores revoked certificates, even when a valid CRL is present. This impacts SSL/TLS connections and may resu...

9.3

CVE-2020-5922

  • EPSS 0.16%
  • Published 26.08.2020 15:15:13
  • Last modified 21.11.2024 05:34:50

In BIG-IP versions 15.0.0-15.1.0.4, 14.1.0-14.1.2.6, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.2, iControl REST does not implement Cross Site Request Forgery protections for users which make use of Basic Authentication in a web browser.

7.1

CVE-2020-5912

  • EPSS 0.08%
  • Published 26.08.2020 15:15:12
  • Last modified 21.11.2024 05:34:48

In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the restjavad process's dump command does not follow current best coding practices and may overwrite arbitrary files.

10

CVE-2020-5902

Warning Exploit
  • EPSS 94.43%
  • Published 01.07.2020 15:15:15
  • Last modified 02.04.2025 18:28:41

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability i...