F5 Big-Ip Access Policy Manager vulnerabilities

623 known vulnerabilities affecting f5/big-ip_access_policy_manager.

Total CVEs

623

CISA KEV

actively exploited

Public exploits

Exploited in wild

Severity breakdown

CRITICAL44HIGH336MEDIUM236LOW7

Vulnerabilities

SortPage 15 of 32

CVE-2018-5549P3HIGHCVSS 7.5≥ 11.6.0, ≤ 11.6.3.1≥ 12.1.0, ≤ 12.1.3.3+2 more2018-09-13

CVE-2018-5549 [HIGH] CWE-20 CVE-2018-5549: On BIG-IP APM 11.6.0-11.6.3.1, 12.1.0-12.1.3.3, 13.0.0, and 13.1.0-13.1.0.3, APMD may core when proc On BIG-IP APM 11.6.0-11.6.3.1, 12.1.0-12.1.3.3, 13.0.0, and 13.1.0-13.1.0.3, APMD may core when processing SAML Assertion or response containing certain elements.

nvd

CVE-2018-5534P3HIGHCVSS 7.5≥ 11.5.0, ≤ 11.5.6≥ 11.6.0, ≤ 11.6.3.1+3 more2018-07-19

CVE-2018-5534 [HIGH] CWE-20 CVE-2018-5534: Under certain conditions on F5 BIG-IP 13.1.0-13.1.0.5, 13.0.0, 12.1.0-12.1.3.1, 11.6.0-11.6.3.1, or Under certain conditions on F5 BIG-IP 13.1.0-13.1.0.5, 13.0.0, 12.1.0-12.1.3.1, 11.6.0-11.6.3.1, or 11.5.0-11.5.6, TMM may core while processing SSL forward proxy traffic.

nvd

CVE-2018-5517P3HIGHCVSS 7.5≥ 13.1.0, ≤ 13.1.0.52018-05-02

CVE-2018-5517 [HIGH] CWE-20 CVE-2018-5517: On F5 BIG-IP 13.1.0-13.1.0.5, malformed TCP packets sent to a self IP address or a FastL4 virtual se On F5 BIG-IP 13.1.0-13.1.0.5, malformed TCP packets sent to a self IP address or a FastL4 virtual server may cause an interruption of service. The control plane is not exposed to this issue. This issue impacts the data plane virtual servers and self IPs.

nvd

CVE-2019-6619P3HIGHCVSS 7.5≥ 12.1.0, < 12.1.4.1≥ 13.0.0, < 13.1.1.5+1 more2019-05-03

CVE-2019-6619 [HIGH] CVE-2019-6619: On BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, the Traffic Management Microkernel (T On BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, the Traffic Management Microkernel (TMM) may restart when a virtual server has an HTTP/2 profile with Application Layer Protocol Negotiation (ALPN) enabled and it processes traffic where the ALPN extension size is zero.

nvd

CVE-2019-6612P3HIGHCVSS 7.5≥ 11.5.2, < 11.5.9≥ 11.6.1, < 11.6.4+3 more2019-05-03

CVE-2019-6612 [HIGH] CVE-2019-6612: On BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8, DNS q On BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8, DNS query TCP connections that are aborted before receiving a response from a DNS cache may cause TMM to restart.

nvd

CVE-2020-5930P3HIGHCVSS 7.5≥ 11.6.1, ≤ 11.6.5≥ 12.1.0, ≤ 12.1.5+3 more2020-09-25

CVE-2020-5930 [HIGH] CVE-2020-5930: In BIG-IP 15.0.0-15.1.0.4, 14.1.0-14.1.2.7, 13.1.0-13.1.3.3, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2 an In BIG-IP 15.0.0-15.1.0.4, 14.1.0-14.1.2.7, 13.1.0-13.1.3.3, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2 and BIG-IQ 5.2.0-7.1.0, unauthenticated attackers can cause disruption of service via undisclosed methods.

nvd

CVE-2020-5919P3HIGHCVSS 7.5≥ 15.1.0, < 15.1.0.52020-08-26

CVE-2020-5919 [HIGH] CVE-2020-5919: In versions 15.1.0-15.1.0.4, rendering of certain session variables by BIG-IP APM UI-based agents in In versions 15.1.0-15.1.0.4, rendering of certain session variables by BIG-IP APM UI-based agents in an access profile configured with Modern customization, may cause the Traffic Management Microkernel (TMM) to stop responding.

nvd

CVE-2022-28714P3HIGHCVSS 7.8v11.6.1v11.6.2+29 more2022-05-05

CVE-2022-28714 [HIGH] CWE-427 CVE-2022-28714: On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versio On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, as well as F5 BIG-IP APM Clients 7.x versions prior to 7.2.1.5, a DLL Hijacking vulnerability exists in the BIG-IP Edge Client Windows Installer. Note: Softwar

nvd

CVE-2020-5925P3HIGHCVSS 7.5≥ 11.6.1, < 11.6.5.2≥ 12.1.0, < 12.1.5.2+5 more2020-08-26

CVE-2020-5925 [HIGH] CWE-754 CVE-2020-5925: In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.6, 13.1.0-13.1.3.3, 12.1.0-12.1.5 In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.6, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, undisclosed internally generated UDP traffic may cause the Traffic Management Microkernel (TMM) to restart under some circumstances.

nvd

CVE-2021-22973P3HIGHCVSS 7.5≥ 12.1.0, ≤ 12.1.5≥ 13.1.0, < 13.1.3.5+4 more2021-02-12

CVE-2021-22973 [HIGH] CWE-787 CVE-2021-22973: On BIG-IP version 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x befor On BIG-IP version 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.5, and all 12.1.x versions, JSON parser function does not protect against out-of-bounds memory accesses or writes. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.

nvd

CVE-2021-23051P3HIGHCVSS 7.5≥ 15.1.0.4, < 15.1.3.12021-09-14

CVE-2021-23051 [HIGH] CVE-2021-23051: On BIG-IP versions 15.1.0.4 through 15.1.3, when the Data Plane Development Kit (DPDK)/Elastic Netwo On BIG-IP versions 15.1.0.4 through 15.1.3, when the Data Plane Development Kit (DPDK)/Elastic Network Adapter (ENA) driver is used with BIG-IP on Amazon Web Services (AWS) systems, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. This is due to an incomplete fix for CVE-2020-5862. Note: Software versions which have reache

nvd

CVE-2021-22999P3HIGHCVSS 7.5≥ 14.1.0, < 14.1.4≥ 15.0.0, < 15.1.0+1 more2021-03-31

CVE-2021-22999 [HIGH] CVE-2021-22999: On versions 15.0.x before 15.1.0 and 14.1.x before 14.1.4, the BIG-IP system provides an option to c On versions 15.0.x before 15.1.0 and 14.1.x before 14.1.4, the BIG-IP system provides an option to connect HTTP/2 clients to HTTP/1.x servers. When a client is slow to accept responses and it closes a connection prematurely, the BIG-IP system may indefinitely retain some streams unclosed. Note: Software versions which have reached End of Software Development

nvd

CVE-2022-23011P3HIGHCVSS 7.5≥ 14.1.0, < 14.1.3≥ 15.1.0, < 15.1.4+1 more2022-01-25

CVE-2022-23011 [HIGH] CWE-682 CVE-2022-23011: On certain hardware BIG-IP platforms, in version 15.1.x before 15.1.4 and 14.1.x before 14.1.3, virt On certain hardware BIG-IP platforms, in version 15.1.x before 15.1.4 and 14.1.x before 14.1.3, virtual servers may stop responding while processing TCP traffic due to an issue in the SYN Cookie Protection feature. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

nvd

CVE-2022-23021P3HIGHCVSS 7.5≥ 16.1.0, < 16.1.2v16.1.x before 16.1.22022-01-25

CVE-2022-23021 [HIGH] CWE-476 CVE-2022-23021: On BIG-IP version 16.1.x before 16.1.2, when any of the following configurations are configured on a On BIG-IP version 16.1.x before 16.1.2, when any of the following configurations are configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate: HTTP redirect rule in an LTM policy, BIG-IP APM Access Profile, and Explicit HTTP Proxy in HTTP Profile. Note: Software versions which have reached En

nvd

CVE-2023-29163P3HIGHCVSS 7.5≥ 14.1.0, < 14.1.5.4≥ 15.1.0, < 15.1.8.2+2 more2023-05-03

CVE-2023-29163 [HIGH] CWE-401 CVE-2023-29163: When UDP profile with idle timeout set to immediate or the value 0 is configured on a virtual serve When UDP profile with idle timeout set to immediate or the value 0 is configured on a virtual server, undisclosed traffic can cause TMM to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

nvd

CVE-2022-41624P3HIGHCVSS 7.5≥ 13.1.0, < 13.1.5.1≥ 14.1.0, < 14.1.5.2+3 more2022-10-19

CVE-2022-41624 [HIGH] CWE-401 CVE-2022-41624: In BIG-IP versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.2, 15.1.x before 15.1.7, 14.1.x befo In BIG-IP versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.2, 15.1.x before 15.1.7, 14.1.x before 14.1.5.2, and 13.1.x before 13.1.5.1, when a sideband iRule is configured on a virtual server, undisclosed traffic can cause an increase in memory resource utilization.

nvd

CVE-2022-41832P3HIGHCVSS 7.5≥ 13.1.0, < 13.1.5.1≥ 14.1.0, < 14.1.5.1+3 more2022-10-19

CVE-2022-41832 [HIGH] CWE-401 CVE-2022-41832: In BIG-IP versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x be In BIG-IP versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and 13.1.x before 13.1.5.1, when a SIP profile is configured on a virtual server, undisclosed messages can cause an increase in memory resource utilization.

nvd

CVE-2018-15326P3HIGHCVSS 7.5≥ 11.6.0, ≤ 11.6.3.2≥ 12.1.0, ≤ 12.1.3.5+2 more2018-10-31

CVE-2018-15326 [HIGH] CWE-295 CVE-2018-15326: In some situations on BIG-IP APM 14.0.0-14.0.0.2, 13.0.0-13.1.0.7, 12.1.0-12.1.3.5, or 11.6.0-11.6.3 In some situations on BIG-IP APM 14.0.0-14.0.0.2, 13.0.0-13.1.0.7, 12.1.0-12.1.3.5, or 11.6.0-11.6.3.2, the CRLDP Auth access policy agent may treat revoked certificates as valid when the BIG-IP APM system fails to download a new Certificate Revocation List.

nvd

CVE-2024-41727P3HIGHCVSS 7.5≥ 15.1.0, ≤ 15.1.1≥ 16.1.0, < 16.1.5+1 more2024-08-14

CVE-2024-41727 [HIGH] CWE-400 CVE-2024-41727: In BIG-IP tenants running on r2000 and r4000 series hardware, or BIG-IP Virtual Edition (VEs) using In BIG-IP tenants running on r2000 and r4000 series hardware, or BIG-IP Virtual Edition (VEs) using Intel E810 SR-IOV NIC, undisclosed traffic can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

nvd

CVE-2018-15329P3HIGHCVSS 7.2≥ 12.1.0, ≤ 12.1.3.7≥ 13.0.0, ≤ 13.1.1.1+1 more2018-12-20

CVE-2018-15329 [HIGH] CWE-862 CVE-2018-15329: On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.1, or 12.1.0-12.1.3.7, or Enterprise Manager 3.1.1, when au On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.1, or 12.1.0-12.1.3.7, or Enterprise Manager 3.1.1, when authenticated administrative users run commands in the Traffic Management User Interface (TMUI), also referred to as the BIG-IP Configuration utility, restrictions on allowed commands may not be enforced.

nvd

← Previous15 / 32Next →