F5 Big-Ip Application Security Manager vulnerabilities

581 known vulnerabilities affecting f5/big-ip_application_security_manager.

Total CVEs

581

CISA KEV

actively exploited

Public exploits

Exploited in wild

Severity breakdown

CRITICAL44HIGH330MEDIUM200LOW7

Vulnerabilities

SortPage 17 of 30

CVE-2017-6148P3HIGHCVSS 7.5≥ 11.5.1, ≤ 11.5.5≥ 11.6.1, ≤ 11.6.2+2 more2018-04-13

CVE-2017-6148 [HIGH] CWE-20 CVE-2017-6148: Responses to SOCKS proxy requests made through F5 BIG-IP version 13.0.0, 12.0.0-12.1.3.1, 11.6.1-11. Responses to SOCKS proxy requests made through F5 BIG-IP version 13.0.0, 12.0.0-12.1.3.1, 11.6.1-11.6.2, or 11.5.1-11.5.5 may cause a disruption of services provided by TMM. The data plane is impacted and exposed only when a SOCKS proxy profile is attached to a Virtual Server. The control plane is not impacted by this vulnerability.

nvd

CVE-2020-5930P3HIGHCVSS 7.5≥ 11.6.1, ≤ 11.6.5≥ 12.1.0, ≤ 12.1.5+3 more2020-09-25

CVE-2020-5930 [HIGH] CVE-2020-5930: In BIG-IP 15.0.0-15.1.0.4, 14.1.0-14.1.2.7, 13.1.0-13.1.3.3, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2 an In BIG-IP 15.0.0-15.1.0.4, 14.1.0-14.1.2.7, 13.1.0-13.1.3.3, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2 and BIG-IQ 5.2.0-7.1.0, unauthenticated attackers can cause disruption of service via undisclosed methods.

nvd

CVE-2018-5507P3HIGHCVSS 7.5≥ 11.5.1, ≤ 11.5.5≥ 11.6.1, ≤ 11.6.2+2 more2018-04-13

CVE-2018-5507 [HIGH] CVE-2018-5507: On F5 BIG-IP versions 13.0.0, 12.1.0-12.1.3.1, 11.6.1-11.6.2, or 11.5.1-11.5.5, vCMP guests running On F5 BIG-IP versions 13.0.0, 12.1.0-12.1.3.1, 11.6.1-11.6.2, or 11.5.1-11.5.5, vCMP guests running on VIPRION 2100, 4200 and 4300 series blades cannot correctly decrypt ciphertext from established SSL sessions with small MTU.

nvd

CVE-2019-6680P3HIGHCVSS 7.5≥ 11.5.2, < 11.6.5.1≥ 12.1.0, ≤ 12.1.5+4 more2019-12-23

CVE-2019-6680 [HIGH] CVE-2019-6680: On BIG-IP versions 15.0.0-15.0.1, 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and On BIG-IP versions 15.0.0-15.0.1, 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5, while processing traffic through a standard virtual server that targets a FastL4 virtual server (VIP on VIP), hardware appliances may stop responding.

nvd

CVE-2021-22977P3HIGHCVSS 7.5≥ 14.1.0, < 14.1.3.1≥ 16.0.0, < 16.0.1.12021-02-12

CVE-2021-22977 [HIGH] CVE-2021-22977: On BIG-IP version 16.0.0-16.0.1 and 14.1.2.4-14.1.3, cooperation between malicious HTTP client code On BIG-IP version 16.0.0-16.0.1 and 14.1.2.4-14.1.3, cooperation between malicious HTTP client code and a malicious server may cause TMM to restart and generate a core file. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.

nvd

CVE-2020-5914P3HIGHCVSS 7.5≥ 11.5.2, < 11.6.5.2≥ 12.1.0, < 12.1.5.2+4 more2020-08-26

CVE-2020-5914 [HIGH] CVE-2020-5914: In BIG-IP ASM versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12 In BIG-IP ASM versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, undisclosed server cookie scenario may cause BD to restart under some circumstances.

nvd

CVE-2020-27718P3HIGHCVSS 7.5≥ 11.6.1, ≤ 11.6.5≥ 12.1.0, ≤ 12.1.5+4 more2020-12-24

CVE-2020-27718 [HIGH] CVE-2020-27718: When a BIG-IP ASM or Advanced WAF system running version 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14 When a BIG-IP ASM or Advanced WAF system running version 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, or 11.6.1-11.6.5.2 processes requests with JSON payload, an unusually large number of parameters can cause excessive CPU usage in the BIG-IP ASM bd process.

nvd

CVE-2020-5882P3HIGHCVSS 7.5≥ 11.6.1, ≤ 11.6.5.1≥ 12.1.0, ≤ 12.1.5+3 more2020-04-30

CVE-2020-5882 [HIGH] CVE-2020-5882: On BIG-IP 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5, and 11.6.1-11.6.5.1, und On BIG-IP 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5, and 11.6.1-11.6.5.1, under certain conditions, the Intel QuickAssist Technology (QAT) cryptography driver may produce a Traffic Management Microkernel (TMM) core file.

nvd

CVE-2019-6677P3HIGHCVSS 7.5≥ 12.1.0, ≤ 12.1.5≥ 13.1.0, < 13.1.3.2+3 more2019-12-23

CVE-2019-6677 [HIGH] CVE-2019-6677: On BIG-IP versions 15.0.0-15.0.1, 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, and 12.1.0-12.1.5, On BIG-IP versions 15.0.0-15.0.1, 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, and 12.1.0-12.1.5, under certain conditions when using custom TCP congestion control settings in a TCP profile, TMM stops processing traffic when processed by an iRule.

nvd

CVE-2020-27728P3HIGHCVSS 7.5≥ 14.1.0, < 14.1.3.1≥ 15.0.0, < 15.1.1+1 more2020-12-24

CVE-2020-27728 [HIGH] CVE-2020-27728: On BIG-IP ASM & Advanced WAF versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.3, under cer On BIG-IP ASM & Advanced WAF versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.3, under certain conditions, Analytics, Visibility, and Reporting daemon (AVRD) may generate a core file and restart on the BIG-IP system when processing requests sent from mobile devices.

nvd

CVE-2019-6673P3HIGHCVSS 7.5≥ 14.0.0, ≤ 14.1.2≥ 15.0.0, ≤ 15.0.12019-11-27

CVE-2019-6673 [HIGH] CVE-2019-6673: On versions 15.0.0-15.0.1 and 14.0.0-14.1.2, when the BIG-IP is configured in HTTP/2 Full Proxy mode On versions 15.0.0-15.0.1 and 14.0.0-14.1.2, when the BIG-IP is configured in HTTP/2 Full Proxy mode, specifically crafted requests may cause a disruption of service provided by the Traffic Management Microkernel (TMM).

nvd

CVE-2021-22985P3HIGHCVSS 7.5≥ 11.6.1, < 11.6.5.2≥ 12.1.0, < 12.1.5.3+4 more2021-02-12

CVE-2021-22985 [HIGH] CWE-400 CVE-2021-22985: On BIG-IP APM version 16.0.x before 16.0.1.1, under certain conditions, when processing VPN traffic On BIG-IP APM version 16.0.x before 16.0.1.1, under certain conditions, when processing VPN traffic with APM, TMM consumes excessive memory. A malicious, authenticated VPN user may abuse this to perform a DoS attack against the APM. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.

nvd

CVE-2021-22975P3HIGHCVSS 7.5≥ 14.1.0, < 14.1.3.1≥ 15.1.0, < 15.1.2.1+1 more2021-02-12

CVE-2021-22975 [HIGH] CVE-2021-22975: On BIG-IP version 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, and 14.1.x before 14.1.3.1, under On BIG-IP version 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, and 14.1.x before 14.1.3.1, under some circumstances, Traffic Management Microkernel (TMM) may restart on the BIG-IP system while passing large bursts of traffic. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.

nvd

CVE-2022-23011P3HIGHCVSS 7.5≥ 14.1.0, < 14.1.3≥ 15.1.0, < 15.1.42022-01-25

CVE-2022-23011 [HIGH] CWE-682 CVE-2022-23011: On certain hardware BIG-IP platforms, in version 15.1.x before 15.1.4 and 14.1.x before 14.1.3, virt On certain hardware BIG-IP platforms, in version 15.1.x before 15.1.4 and 14.1.x before 14.1.3, virtual servers may stop responding while processing TCP traffic due to an issue in the SYN Cookie Protection feature. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

nvd

CVE-2019-8331P3MEDIUMCVSS 6.1≥ 12.1.0, < 12.1.5.1≥ 13.0.0, < 13.1.3.4+2 more2019-02-20

CVE-2019-8331 [MEDIUM] CWE-79 CVE-2019-8331: In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-tem In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.

nvd

CVE-2020-5879P3HIGHCVSS 7.5≥ 11.6.1, ≤ 11.6.5.12020-04-30

CVE-2020-5879 [HIGH] CWE-319 CVE-2020-5879: On BIG-IP ASM 11.6.1-11.6.5.1, under certain configurations, the BIG-IP system sends data plane traf On BIG-IP ASM 11.6.1-11.6.5.1, under certain configurations, the BIG-IP system sends data plane traffic to back-end servers unencrypted, even when a Server SSL profile is applied.

nvd

CVE-2022-41691P3HIGHCVSS 7.5≥ 14.1.0, < 14.1.5.22022-10-19

CVE-2022-41691 [HIGH] CWE-763 CVE-2022-41691: When a BIG-IP Advanced WAF/ASM security policy is configured on a virtual server, undisclosed reques When a BIG-IP Advanced WAF/ASM security policy is configured on a virtual server, undisclosed requests can cause the bd process to terminate.

nvd

CVE-2024-25560P3HIGHCVSS 7.5≥ 15.1.0, < 15.1.10.8≥ 16.1.0, < 16.1.4+1 more2024-05-08

CVE-2024-25560 [HIGH] CWE-476 CVE-2024-25560: When BIG-IP AFM is licensed and provisioned, undisclosed DNS traffic can cause the Traffic Manageme When BIG-IP AFM is licensed and provisioned, undisclosed DNS traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

nvd

CVE-2025-21091P3HIGHCVSS 7.5≥ 15.1.0, ≤ 15.1.10≥ 16.1.0, < 16.1.6+1 more2025-02-05

CVE-2025-21091 [HIGH] CWE-401 CVE-2025-21091: When SNMP v1 or v2c are disabled on the BIG-IP, undisclosed requests can cause an increase in memory When SNMP v1 or v2c are disabled on the BIG-IP, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

nvd

CVE-2020-5880P3HIGHCVSS 7.1≥ 14.1.0, ≤ 14.1.2.3≥ 15.0.0, ≤ 15.0.1.32020-04-30

CVE-2020-5880 [HIGH] CWE-434 CVE-2020-5880: Om BIG-IP 15.0.0-15.0.1.3 and 14.1.0-14.1.2.3, the restjavad process may expose a way for attackers Om BIG-IP 15.0.0-15.0.1.3 and 14.1.0-14.1.2.3, the restjavad process may expose a way for attackers to upload arbitrary files on the BIG-IP system, bypassing the authorization system. Resulting error messages may also reveal internal paths of the server.

nvd

← Previous17 / 30Next →