F5

Big-ip Advanced Web Application Firewall

153 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
6.1

CVE-2023-3470

  • EPSS 0.07%
  • Veröffentlicht 02.08.2023 16:15:10
  • Zuletzt bearbeitet 21.11.2024 08:17:20

Specific F5 BIG-IP platforms with Cavium Nitrox FIPS HSM cards generate a deterministic password for the Crypto User account.  The predictable nature of the password allows an authenticated user with TMSH access to the BIG-IP system, or anyone with ...

7.5

CVE-2023-29163

  • EPSS 0.31%
  • Veröffentlicht 03.05.2023 15:15:13
  • Zuletzt bearbeitet 21.11.2024 07:56:38

When UDP profile with idle timeout set to immediate or the value 0 is configured on a virtual server, undisclosed traffic can cause TMM to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

5.3

CVE-2023-24594

  • EPSS 0.14%
  • Veröffentlicht 03.05.2023 15:15:12
  • Zuletzt bearbeitet 21.11.2024 07:48:12

When an SSL profile is configured on a Virtual Server, undisclosed traffic can cause an increase in CPU or SSL accelerator resource utilization.   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

6.1

CVE-2023-27378

  • EPSS 0.35%
  • Veröffentlicht 03.05.2023 15:15:12
  • Zuletzt bearbeitet 21.11.2024 07:52:47

Multiple reflected cross-site scripting (XSS) vulnerabilities exist in undisclosed pages of the BIG-IP Configuration utility which allow an attacker to run JavaScript in the context of the currently logged-in user.  Note: Software versions which hav...

4.3

CVE-2023-28406

  • EPSS 0.6%
  • Veröffentlicht 03.05.2023 15:15:12
  • Zuletzt bearbeitet 21.11.2024 07:55:00

A directory traversal vulnerability exists in an undisclosed page of the BIG-IP Configuration utility which may allow an authenticated attacker to read files with .xml extension. Access to restricted information is limited and the attacker does not c...

7.5

CVE-2023-23552

  • EPSS 53.72%
  • Veröffentlicht 01.02.2023 18:15:11
  • Zuletzt bearbeitet 21.11.2024 07:46:24

On versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.0 before 15.1.8, 14.1.x before 14.1.5.3, and all versions of 13.1.x, when a BIG-IP Advanced WAF or BIG-IP ASM security policy is configured on a virtual server, undisclosed requests can...

7.5

CVE-2022-41836

  • EPSS 0.68%
  • Veröffentlicht 19.10.2022 22:15:13
  • Zuletzt bearbeitet 21.11.2024 07:23:54

When an 'Attack Signature False Positive Mode' enabled security policy is configured on a virtual server, undisclosed requests can cause the bd process to terminate.

3.7

CVE-2022-41983

  • EPSS 0.2%
  • Veröffentlicht 19.10.2022 22:15:13
  • Zuletzt bearbeitet 21.11.2024 07:24:12

On specific hardware platforms, on BIG-IP versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.7, 14.1.x before 14.1.5.1, and all versions of 13.1.x, while Intel QAT (QuickAssist Technology) and the AES-GCM/CCM cipher is in use, undisclosed conditions...

7.2

CVE-2022-41617

  • EPSS 6.34%
  • Veröffentlicht 19.10.2022 22:15:12
  • Zuletzt bearbeitet 21.11.2024 07:23:30

In versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and 13.1.x before 13.1.5.1, When the Advanced WAF / ASM module is provisioned, an authenticated remote code execution vulnerability exists in the BIG-IP iControl REST...

7.5

CVE-2022-41691

  • EPSS 0.94%
  • Veröffentlicht 19.10.2022 22:15:12
  • Zuletzt bearbeitet 21.11.2024 07:23:39

When a BIG-IP Advanced WAF/ASM security policy is configured on a virtual server, undisclosed requests can cause the bd process to terminate.