F5 Big-ip Advanced Firewall Manager

BIG-IP AFM vulnerability

BIG-IP iControl REST and tmsh vulnerability

BIG-IP TMSH vulnerability

BIG-IP IPSec vulnerability

BIG-IP AFM DoS protection profile vulnerability

BIG-IP iRules vulnerability

TMM vulnerability

BIG-IP DNS cache vulnerability

TMM vulnerability

BIG-IP Client SSL profile vulnerability

BIG-IP SSL/TLS vulnerability

BIG-IP SSL/TLS vulnerability

BIG-IP Configuration utility vulnerability

BIG-IP PEM iRules vulnerability

BIG-IP SIP profile vulnerability

BIG-IP DNS Cache vulnerability

BIG-IP HTTP/2 vulnerability

BIG-IP DTLS Vulnerability

BIG-IP TMM Vulnerability

BIG-IP Privilege Escalation vulnerability

BIG-IP iControl SOAP vulnerability

BIG-IP iControl SOAP vulnerability

BIG-IP DTLS 1.2 Vulnerability

iControl REST and TMSH vulnerability

BIG-IP scripted monitor vulnerability

BIG-IP and BIG-IQ privilege escalation vulnerability

BIG-IP and BIG-IQ privilege escalation vulnerability

BIG-IP monitors vulnerability

iControl REST and tmsh vulnerability

iControl SOAP vulnerability

The Configuration utility in F5 BIG-IP LTM, Analytics, APM, ASM, GTM, and Link Controller 11.x before 11.2.1 HF16, 11.3.x, 11.4.x before 11.4.1 HF10, 11.5.x before 11.5.4, and 11.6.x before 11.6.1; BIG-IP AAM 11.4.x before 11.4.1 HF10, 11.5.x before 11.5.4, and 11.6.x before 11.6.1; BIG-IP AFM and PEM 11.3.x, 11.4.x before 11.4.1 HF10, 11.5.x before 11.5.4, and 11.6.x before 11.6.1; BIG-IP Edge Gateway, WebAccelerator, and WOM 11.x before 11.2.1 HF16 and 11.3.0; and BIG-IP PSM 11.x before 11.2.1 HF16, 11.3.x, and 11.4.x before 11.4.1 HF10 allows remote authenticated users with certain permissions to gain privileges by leveraging an Access Policy Manager customization configuration section that allows file uploads.

In BIG-IP versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.2.7, undisclosed TMUI page contains a stored cross site scripting vulnerability (XSS). The issue allows a minor privilege escalation for resource admin to escalate to full admin.

In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM and WebSafe software version 13.0.0 and 12.1.0 - 12.1.2, race conditions in iControl REST may lead to commands being executed with different privilege levels than expected.

On BIG-IP (AFM, ASM) 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, and 11.5.1-11.6.4, a stored cross-site scripting vulnerability in AFM feed list. In the worst case, an attacker can store a CSRF which results in code execution as the admin user. The level of user role which can perform this attack are resource administrator and administrator.

BIG-IP Configuration utility and tmsh vulnerability

BIG-IP Configuration utility XSS vulnerability

On BIG-IP version 16.0.x before 16.0.1, 15.1.x before 15.1.1, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.5, and all 12.1.x and 11.6.x versions, undisclosed endpoints in iControl REST allow for a reflected XSS attack, which could lead to a complete compromise of BIG-IP if the victim user is granted the admin role. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.

BIG-IP tmsh vulnerability

BIG-IP MPTCP vulnerability

BIG-IP TMM vulnerability