F5 Big-Ip Analytics vulnerabilities

505 known vulnerabilities affecting f5/big-ip_analytics.

Total CVEs

505

CISA KEV

actively exploited

Public exploits

Exploited in wild

Severity breakdown

CRITICAL39HIGH279MEDIUM183LOW4

Vulnerabilities

SortPage 22 of 26

CVE-2019-6655P4MEDIUMCVSS 5.3≥ 11.5.2, ≤ 11.5.9≥ 11.6.1, ≤ 11.6.4+2 more2019-09-25

CVE-2019-6655 [MEDIUM] CVE-2019-6655: On versions 13.0.0-13.1.0.1, 12.1.0-12.1.4.1, 11.6.1-11.6.4, and 11.5.1-11.5.9, BIG-IP platforms whe On versions 13.0.0-13.1.0.1, 12.1.0-12.1.4.1, 11.6.1-11.6.4, and 11.5.1-11.5.9, BIG-IP platforms where AVR, ASM, APM, PEM, AFM, and/or AAM is provisioned may leak sensitive data.

nvd

CVE-2015-4638P4MEDIUMCVSS 5.0v11.3.0v11.4.0+5 more2015-09-18

CVE-2015-4638 [MEDIUM] CWE-20 CVE-2015-4638: The FastL4 virtual server in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, GTM, Link Controller, and The FastL4 virtual server in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, GTM, Link Controller, and PEM 11.3.0 through 11.5.2 and 11.6.0 through 11.6.0 HF4, BIG-IP Edge Gateway, WebAccelerator, and WOM 11.2.1 through 11.3.0, and BIG-IP PSM 11.2.1 through 11.4.1 allows remote attackers to cause a denial of service (Traffic Management Microkernel restar

nvd

CVE-2020-5890P4MEDIUMCVSS 5.5≥ 12.1.0, ≤ 12.1.5.1≥ 13.1.0, ≤ 13.1.3.3+2 more2020-04-30

CVE-2020-5890 [MEDIUM] CWE-200 CVE-2020-5890: On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, and 12.1.0-12.1.5.1 and BIG-IQ 5.2.0-7.1. On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, and 12.1.0-12.1.5.1 and BIG-IQ 5.2.0-7.1.0, when creating a QKView, credentials for binding to LDAP servers used for remote authentication of the BIG-IP administrative interface will not fully obfuscate if they contain whitespace.

nvd

CVE-2018-15333P4MEDIUMCVSS 5.5≥ 11.2.1, ≤ 11.6.3≥ 12.1.0, ≤ 12.1.4+2 more2018-12-28

CVE-2018-15333 [MEDIUM] CWE-434 CVE-2018-15333: On versions 11.2.1. and greater, unrestricted Snapshot File Access allows BIG-IP system's user with On versions 11.2.1. and greater, unrestricted Snapshot File Access allows BIG-IP system's user with any role, including Guest Role, to have access and download previously generated and available snapshot files on the BIG-IP configuration utility such as QKView and TCPDumps.

nvd

CVE-2019-6632P4MEDIUMCVSS 5.5≥ 12.1.0, < 12.1.4.1≥ 13.0.0, < 13.1.1.5+2 more2019-07-03

CVE-2019-6632 [MEDIUM] CWE-330 CVE-2019-6632: On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, under certain circum On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, under certain circumstances, attackers can decrypt configuration items that are encrypted because the vCMP configuration unit key is generated with insufficient randomness. The attack prerequisite is direct access to encrypted configuration and/or UCS files.

nvd

CVE-2022-28707P4MEDIUMCVSS 5.4v14.1.0v14.1.2+12 more2022-05-05

CVE-2022-28707 [MEDIUM] CWE-79 CVE-2022-28707: On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, and 14.1.x versio On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, and 14.1.x versions prior to 14.1.4.6, a stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility (also referred to as the BIG-IP TMUI) that allows an attacker to execute JavaScript in the context of the currentl

nvd

CVE-2019-6613P4MEDIUMCVSS 5.3≥ 11.5.2, < 11.5.9≥ 11.6.1, < 11.6.4+2 more2019-05-03

CVE-2019-6613 [MEDIUM] CWE-319 CVE-2019-6613: On BIG-IP 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8, SNMP may expose sensit On BIG-IP 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8, SNMP may expose sensitive configuration objects over insecure transmission channels. This issue is exposed when a passphrase is used with various profile types and is accessed using SNMPv2.

nvd

CVE-2020-5940P4MEDIUMCVSS 5.4≥ 14.1.0, < 14.1.2.4≥ 15.1.0, < 15.1.1+1 more2020-11-05

CVE-2020-5940 [MEDIUM] CWE-79 CVE-2020-5940: In versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.2.3, a stored cross-site scripting (XS In versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.2.3, a stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Traffic Management User Interface (TMUI), also known as the BIG-IP Configuration utility.

nvd

CVE-2016-1497P4MEDIUMCVSS 4.9v11.0.0v11.1.0+12 more2016-08-26

CVE-2016-1497 [MEDIUM] CWE-200 CVE-2016-1497: The Configuration utility in F5 BIG-IP systems 11.0.x, 11.1.x, 11.2.x before 11.2.1 HF16, 11.3.x, 11 The Configuration utility in F5 BIG-IP systems 11.0.x, 11.1.x, 11.2.x before 11.2.1 HF16, 11.3.x, 11.4.x before 11.4.1 HF10, 11.5.x before 11.5.4 HF2, 1.6.x before 11.6.1, and 12.0.0 before HF1 allows remote administrators to read Access Policy Manager (APM) access logs via unspecified vectors.

nvd

CVE-2016-5021P4MEDIUMCVSS 4.9v11.5.0v11.5.1+4 more2016-06-24

CVE-2016-5021 [MEDIUM] CWE-200 CVE-2016-5021: The iControl REST service in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, Link Controller, and PEM The iControl REST service in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.5.x before 11.5.4, 11.6.x before 11.6.1, and 12.x before 12.0.0 HF3; BIG-IP DNS 12.x before 12.0.0 HF3; BIG-IP GTM 11.5.x before 11.5.4 and 11.6.x before 11.6.1; BIG-IQ Cloud and Security 4.0.0 through 4.5.0; BIG-IQ Device 4.2.0 through 4.5.0; BIG-IQ

nvd

CVE-2018-15321P4MEDIUMCVSS 4.9≥ 11.2.1, ≤ 11.5.6≥ 11.6.0, ≤ 11.6.3.2+3 more2018-10-31

CVE-2018-15321 [MEDIUM] CWE-269 CVE-2018-15321: When BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.0.5, 12.1.0-12.1.3.5, 11.6.0-11.6.3.2, or 11.2.1-11.5.6, BI When BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.0.5, 12.1.0-12.1.3.5, 11.6.0-11.6.3.2, or 11.2.1-11.5.6, BIG-IQ Centralized Management 5.0.0-5.4.0 or 4.6.0, BIG-IQ Cloud and Orchestration 1.0.0, iWorkflow 2.1.0-2.3.0, or Enterprise Manager 3.1.1 is licensed for Appliance Mode, Admin and Resource administrator roles can by-pass BIG-IP Appliance Mode restric

nvd

CVE-2020-27727P4MEDIUMCVSS 4.9≥ 13.1.0, < 13.1.3.5≥ 14.1.0, < 14.1.3.1+2 more2020-12-24

CVE-2020-27727 [MEDIUM] CWE-20 CVE-2020-27727: On BIG-IP version 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.3, and 13.1.0-13.1.3.4, when an auth On BIG-IP version 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.3, and 13.1.0-13.1.3.4, when an authenticated administrative user installs RPMs using the iAppsLX REST installer, the BIG-IP system does not sufficiently validate user input, allowing the user read access to the filesystem.

nvd

CVE-2022-26340P4MEDIUMCVSS 4.9v11.6.1v11.6.2+29 more2022-05-05

CVE-2022-26340 [MEDIUM] CWE-732 CVE-2022-26340: On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions p On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, and F5 BIG-IQ Centralized Management all versions of 8.x and 7.x, an authenticated, high-privileged attacker with no bash access may be able to access Certificat

nvd

CVE-2026-41954P4MEDIUMCVSS 4.9≥ 17.1.0, ≤ 17.1.3≥ 17.5.0, ≤ 17.5.1+2 more2026-05-13

CVE-2026-41954 [MEDIUM] CWE-200 CVE-2026-41954: Sensitive information disclosure vulnerability exists in the undisclosed iControl REST endpoint and Sensitive information disclosure vulnerability exists in the undisclosed iControl REST endpoint and TMOS Shell (tmsh) command which may allow an authenticated attacker with resource administrator role privileges to view sensitive information. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

nvd

CVE-2022-29474P4MEDIUMCVSS 4.3v11.6.1v11.6.2+29 more2022-05-05

CVE-2022-29474 [MEDIUM] CWE-22 CVE-2022-29474: On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions p On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, a directory traversal vulnerability exists in iControl SOAP that allows an authenticated attacker with at least guest role privileges to read wsdl files in the BI

nvd

CVE-2018-5521P4MEDIUMCVSS 6.1≥ 11.5.1, ≤ 11.5.5≥ 11.6.1, ≤ 11.6.3+2 more2018-06-01

CVE-2018-5521 [MEDIUM] CWE-79 CVE-2018-5521: On F5 BIG-IP 12.1.0-12.1.3.1, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1, carefully crafted URLs can On F5 BIG-IP 12.1.0-12.1.3.1, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1, carefully crafted URLs can be used to reflect arbitrary content into GeoIP lookup responses, potentially exposing clients to XSS.

nvd

CVE-2019-6625P4MEDIUMCVSS 6.1≥ 11.5.1, ≤ 11.6.3≥ 12.1.0, < 12.1.4.1+3 more2019-07-03

CVE-2019-6625 [MEDIUM] CWE-79 CVE-2019-6625: On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, and 11.5.1-11.6.4, a ref On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, and 11.5.1-11.6.4, a reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Traffic Management User Interface (TMUI) also known as the BIG-IP Configuration utility.

nvd

CVE-2019-6626P4MEDIUMCVSS 6.1≥ 11.5.1, ≤ 11.6.3≥ 12.1.0, < 12.1.4.1+3 more2019-07-03

CVE-2019-6626 [MEDIUM] CWE-79 CVE-2019-6626: On BIG-IP (AFM, Analytics, ASM) 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, an On BIG-IP (AFM, Analytics, ASM) 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, and 11.5.1-11.6.3.4, A reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Traffic Management User Interface (TMUI), also known as the Configuration utility.

nvd

CVE-2019-6589P4MEDIUMCVSS 6.1≥ 11.6.0, ≤ 11.6.3.2≥ 12.1.0, ≤ 12.1.3.7+2 more2019-02-14

CVE-2019-6589 [MEDIUM] CWE-79 CVE-2019-6589: On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.3, 12.1.0-12.1.3.7, and 11.6.0-11.6.3.2, a reflected Cross On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.3, 12.1.0-12.1.3.7, and 11.6.0-11.6.3.2, a reflected Cross Site Scripting (XSS) vulnerability is present in an undisclosed page of the BIG-IP TMUI (Traffic Management User Interface) also known as the BIG-IP configuration utility.

nvd

CVE-2020-27719P4MEDIUMCVSS 6.1≥ 14.1.0, < 14.1.3.1≥ 15.0.0, < 15.1.1+1 more2020-12-24

CVE-2020-27719 [MEDIUM] CWE-79 CVE-2020-27719: On BIG-IP 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.3, a cross-site scripting (XSS) vulnerab On BIG-IP 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.3, a cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility.

nvd

← Previous22 / 26Next →