F5 Big-ip Application Acceleration Manager

F5 BIG-IP before 12.0.0 HF3 allows remote authenticated users to modify the account configuration of users with the Resource Administration role and gain privilege via a crafted external Extended Application Verification (EAV) monitor script.

In BIG-IP 15.0.0, 14.0.0-14.1.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.2, and 11.5.2-11.6.4, BIG-IQ 6.0.0-6.1.0 and 5.1.0-5.4.0, iWorkflow 2.3.0, and Enterprise Manager 3.1.1, authenticated users with the ability to upload files (via scp, for example) can escalate their privileges to allow root shell access from within the TMOS Shell (tmsh) interface. The tmsh interface allows users to execute a secondary program via tools like sftp or scp.

On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.2, 13.1.x before 13.1.4.1, and all versions of 12.1.x, a stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to execute JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

TMM Vulnerability

BIG-IP message routing vulnerability

iControl SOAP vulnerability

BIG-IP iControl REST and tmsh vulnerability

BIG-IP Configuration utility authenticated SQL injection vulnerability

ImageMagick before 7.0.8-50 has a "use of uninitialized value" vulnerability in the function ReadCUTImage in coders/cut.c.

On version 15.1.x before 15.1.0.5, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.5, and all versions of 12.1.x and 11.6.x, an authenticated remote command execution vulnerability exists in the BIG-IP Configuration utility. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

In F5 BIG-IP 12.0.0 through 12.1.2, an authenticated attacker may be able to cause an escalation of privileges through a crafted iControl REST connection.

On BIG-IP 11.5.2-11.6.4 and Enterprise Manager 3.1.1, REST users with guest privileges may be able to escalate their privileges and run commands with admin privileges.

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, a cross-site request forgery (CSRF) vulnerability in the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, exists in an undisclosed page.

BIG-IP and BIG-IQ Configuration utility vulnerability

BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4.2, 13.1.x before 13.1.4.1, and all versions of 12.1.x and 11.6.x and all versions of BIG-IQ 8.x, 7.x, and 6.x are vulnerable to cross-site request forgery (CSRF) attacks through iControl SOAP. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Appliance mode iControl REST vulnerability

Appliance mode BIG-IP iControl REST and tmsh vulnerability

Appliance mode iControl REST vulnerability

BIG-IP iControl REST vulnerability

Knowledge Appliance mode iControl REST vulnerability

BIG-IP TMM vulnerability

BIG-IP HSB vulnerability

Appliance mode iControl REST vulnerability

BIG-IP SNMP vulnerability

BIG-IP MPTCP vulnerability

BIG-IP SCP and SFTP vulnerability

BIG-IP Appliance mode external monitor vulnerability

BIG-IP iRules vulnerability

BIG-IP SIP ALG profile vulnerability

TMM Vulnerability

BIG-IP HTTP/2 vulnerability

BIG-IP HTTP/2 vulnerability

BIG-IP HTTP vulnerability

SCTP Vulnerability

BIG-IP SIP Vulnerability

BIG-IP SIP MRF Vulnerability

BIG-IP iControl REST and tmsh vulnerability

BIG-IP TMSH vulnerability

BIG-IP IPSec vulnerability

TMM vulnerability