F5 Big-Ip Application Security Manager vulnerabilities

575 known vulnerabilities affecting f5/big-ip_application_security_manager.

Total CVEs

575

CISA KEV

actively exploited

Public exploits

Exploited in wild

Severity breakdown

CRITICAL44HIGH327MEDIUM198LOW6

Vulnerabilities

SortPage 11 of 29

CVE-2022-34862P3HIGHCVSS 7.5≥ 13.1.0, ≤ 13.1.5≥ 14.1.0, < 14.1.5+2 more2022-08-04

CVE-2022-34862 [HIGH] CWE-835 CVE-2022-34862: In BIG-IP Versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all ver In BIG-IP Versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, when an LTM virtual server is configured to perform normalization, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not

nvd

CVE-2017-6167P3HIGHCVSS 7.5≥ 12.1.0, ≤ 12.1.2v13.0.02017-12-21

CVE-2017-6167 [HIGH] CWE-362 CVE-2017-6167: In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM and WebSafe software vers In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM and WebSafe software version 13.0.0 and 12.1.0 - 12.1.2, race conditions in iControl REST may lead to commands being executed with different privilege levels than expected.

nvd

CVE-2020-5918P3HIGHCVSS 7.5≥ 11.6.1, < 11.6.5.2≥ 12.1.0, < 12.1.5.2+4 more2020-08-26

CVE-2020-5918 [HIGH] CVE-2020-5918: In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5 In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management Microkernel (TMM) may stop responding when processing Stream Control Transmission Protocol (SCTP) traffic when traffic volume is high. This vulnerability affects TMM by way of a virtual server configured with an SCT

nvd

CVE-2019-6684P3HIGHCVSS 7.5≥ 11.5.2, ≤ 11.6.5≥ 12.1.0, ≤ 12.1.5+3 more2019-12-23

CVE-2019-6684 [HIGH] CVE-2019-6684: On versions 15.0.0-15.0.1.1, 14.0.0-14.1.2.2, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, u On versions 15.0.0-15.0.1.1, 14.0.0-14.1.2.2, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, under certain conditions, a multi-bladed BIG-IP Virtual Clustered Multiprocessing (vCMP) may drop broadcast packets when they are rebroadcast to the vCMP guest secondary blades. An attacker can leverage the fragmented broadcast IP packets to perform any type of fr

nvd

CVE-2019-6682P3HIGHCVSS 7.5≥ 11.5.2, ≤ 11.6.5≥ 12.1.0, ≤ 12.1.5+3 more2019-12-23

CVE-2019-6682 [HIGH] CWE-400 CVE-2019-6682: On versions 15.0.0-15.0.1.1, 14.0.0-14.1.2.2, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, t On versions 15.0.0-15.0.1.1, 14.0.0-14.1.2.2, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, the BIG-IP ASM system may consume excessive resources when processing certain types of HTTP responses from the origin web server. This vulnerability is only known to affect resource-constrained systems in which the security policy is configured with respon

nvd

CVE-2021-23030P3HIGHCVSS 7.5≥ 12.1.0, ≤ 12.1.6≥ 13.1.0, ≤ 13.1.4+3 more2021-09-14

CVE-2021-23030 [HIGH] CWE-20 CVE-2021-23030: On BIG-IP Advanced WAF and BIG-IP ASM version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x On BIG-IP Advanced WAF and BIG-IP ASM version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.3, 13.1.x before 13.1.4.1, and all versions of 12.1.x, when a WebSocket profile is configured on a virtual server, undisclosed requests can cause bd to terminate. Note: Software versions which have reached End of Technical Support (EoTS) a

nvd

CVE-2021-23010P3HIGHCVSS 7.5≥ 12.1.0, ≤ 12.1.5.3≥ 13.0, ≤ 13.1.3.5+3 more2021-05-10

CVE-2021-23010 [HIGH] CVE-2021-23010: On versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1 On versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.5, and 12.1.x before 12.1.5.3, when the BIG-IP ASM/Advanced WAF system processes WebSocket requests with JSON payloads using the default JSON Content Profile in the ASM Security Policy, the BIG-IP ASM bd process may produce a core file. Note: Software versio

nvd

CVE-2021-23011P3HIGHCVSS 7.5≥ 11.6.1, < 11.6.5.3≥ 12.1.0, < 12.1.6+4 more2021-05-10

CVE-2021-23011 [HIGH] CWE-400 CVE-2021-23011: On versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.3, 14.1.x before 14.1.4, 13.1.x before 13.1.4 On versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.3, 14.1.x before 14.1.4, 13.1.x before 13.1.4, 12.1.x before 12.1.6, and 11.6.x before 11.6.5.3, when the BIG-IP system is buffering packet fragments for reassembly, the Traffic Management Microkernel (TMM) may consume an excessive amount of resources, eventually leading to a restart and failover

nvd

CVE-2021-23004P3HIGHCVSS 7.5≥ 11.6.1, < 11.6.5.3≥ 12.1.0, < 12.1.5.3+4 more2021-03-31

CVE-2021-23004 [HIGH] CVE-2021-23004: On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x befo On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, Multipath TCP (MPTCP) forwarding flows may be created on standard virtual servers without MPTCP enabled in the applied TCP profile. Note: Software versions which have reached End of Software Devel

nvd

CVE-2021-23028P3HIGHCVSS 7.5≥ 13.1..3.5, ≤ 13.1.3.6≥ 14.1.3.1, ≤ 14.1.4.1+2 more2021-09-14

CVE-2021-23028 [HIGH] CWE-20 CVE-2021-23028: On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.2, and 13.1.x before On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.2, and 13.1.x before 13.1.4, when JSON content profiles are configured for URLs as part of an F5 Advanced Web Application Firewall (WAF)/BIG-IP ASM security policy and applied to a virtual server, undisclosed requests may cause the BIG-IP ASM bd process to terminate. Note:

nvd

CVE-2021-23036P3HIGHCVSS 7.5≥ 16.0.0, ≤ 16.0.12021-09-14

CVE-2021-23036 [HIGH] CWE-20 CVE-2021-23036: On version 16.0.x before 16.0.1.2, when a BIG-IP ASM and DataSafe profile are configured on a virtua On version 16.0.x before 16.0.1.2, when a BIG-IP ASM and DataSafe profile are configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

nvd

CVE-2021-23033P3HIGHCVSS 7.5≥ 12.1.0, ≤ 12.1.6≥ 13.1.0, < 13.1.4.1+3 more2021-09-14

CVE-2021-23033 [HIGH] CWE-20 CVE-2021-23033: On BIG-IP Advanced WAF and BIG-IP ASM version 16.x before 16.1.0x, 15.1.x before 15.1.3.1, 14.1.x be On BIG-IP Advanced WAF and BIG-IP ASM version 16.x before 16.1.0x, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.3, 13.1.x before 13.1.4.1, and all versions of 12.1.x, when a WebSocket profile is configured on a virtual server, undisclosed requests can cause bd to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are

nvd

CVE-2021-23044P3HIGHCVSS 7.5≥ 11.6.0, ≤ 11.6.5≥ 12.1.0, ≤ 12.1.6+4 more2021-09-14

CVE-2021-23044 [HIGH] CWE-20 CVE-2021-23044: On BIG-IP version 16.x before 16.1.0, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.2, 13.1.x before On BIG-IP version 16.x before 16.1.0, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.2, 13.1.x before 13.1.4.1, and all versions of 12.1.x and 11.6.x, when the Intel QuickAssist Technology (QAT) compression driver is used on affected BIG-IP hardware and BIG-IP Virtual Edition (VE) platforms, undisclosed traffic can cause the Traffic Management Microkernel

nvd

CVE-2021-23045P3HIGHCVSS 7.5≥ 12.1.0, ≤ 12.1.6≥ 13.1.0, < 13.1.4.1+3 more2021-09-14

CVE-2021-23045 [HIGH] CWE-20 CVE-2021-23045: On BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.3, 13.1.x bef On BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.3, 13.1.x before 13.1.4.1, and all versions of 12.1.x, when an SCTP profile with multiple paths is configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of

nvd

CVE-2021-23000P3HIGHCVSS 7.5≥ 13.1.3.4, < 13.1.3.6v12.1.5.22021-03-31

CVE-2021-23000 [HIGH] CVE-2021-23000: On BIG-IP versions 13.1.3.4-13.1.3.6 and 12.1.5.2, if the tmm.http.rfc.enforcement BigDB key is enab On BIG-IP versions 13.1.3.4-13.1.3.6 and 12.1.5.2, if the tmm.http.rfc.enforcement BigDB key is enabled in a BIG-IP system, or the Bad host header value is checked in the AFM HTTP security profile associated with a virtual server, in rare instances, a specific sequence of malicious requests may cause TMM to restart. Note: Software versions which have reached

nvd

CVE-2022-23012P3HIGHCVSS 7.5≥ 14.1.0, < 14.1.4.5≥ 15.1.0, < 15.1.4.12022-01-25

CVE-2022-23012 [HIGH] CWE-415 CVE-2022-23012: On BIG-IP versions 15.1.x before 15.1.4.1 and 14.1.x before 14.1.4.5, when the HTTP/2 profile is con On BIG-IP versions 15.1.x before 15.1.4.1 and 14.1.x before 14.1.4.5, when the HTTP/2 profile is configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

nvd

CVE-2022-23019P3HIGHCVSS 7.5≥ 12.1.0, ≤ 12.1.6≥ 13.1.0, ≤ 13.1.4+3 more2022-01-25

CVE-2022-23019 [HIGH] CWE-20 CVE-2022-23019: On BIG-IP version 16.1.x before 16.1.2, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.4, and all vers On BIG-IP version 16.1.x before 16.1.2, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.4, and all versions of 13.1.x and 12.1.x, when a message routing type virtual server is configured with both Diameter Session and Router Profiles, undisclosed traffic can cause an increase in memory resource utilization. Note: Software versions which have reached End o

nvd

CVE-2022-23022P3HIGHCVSS 7.5≥ 16.1.0, < 16.1.22022-01-25

CVE-2022-23022 [HIGH] CWE-476 CVE-2022-23022: On BIG-IP version 16.1.x before 16.1.2, when an HTTP profile is configured on a virtual server, undi On BIG-IP version 16.1.x before 16.1.2, when an HTTP profile is configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

nvd

CVE-2022-23016P3HIGHCVSS 7.5≥ 15.1.0, < 15.1.4.1≥ 16.1.0, < 16.1.22022-01-25

CVE-2022-23016 [HIGH] CWE-476 CVE-2022-23016: On versions 16.1.x before 16.1.2 and 15.1.x before 15.1.4.1, when BIG-IP SSL Forward Proxy with TLS On versions 16.1.x before 16.1.2 and 15.1.x before 15.1.4.1, when BIG-IP SSL Forward Proxy with TLS 1.3 is configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

nvd

CVE-2022-28701P3HIGHCVSS 7.5v16.1.0v16.1.1+1 more2022-05-05

CVE-2022-28701 [HIGH] CWE-400 CVE-2022-28701: On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, when the stream profile is configured on a virtual s On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, when the stream profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

nvd

← Previous11 / 29Next →