F5 Big-Ip Application Security Manager vulnerabilities

581 known vulnerabilities affecting f5/big-ip_application_security_manager.

Total CVEs

581

CISA KEV

actively exploited

Public exploits

Exploited in wild

Severity breakdown

CRITICAL44HIGH330MEDIUM200LOW7

Vulnerabilities

SortPage 29 of 30

CVE-2026-42058P4MEDIUMCVSS 4.3≥ 17.1.0, ≤ 17.1.3≥ 17.5.0, ≤ 17.5.1+2 more2026-05-13

CVE-2026-42058 [MEDIUM] CWE-732 CVE-2026-42058: An authenticated attacker's undisclosed requests to BIG-IP iControl REST can lead to an information An authenticated attacker's undisclosed requests to BIG-IP iControl REST can lead to an information leak of BIG-IP local user account names. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

nvd

CVE-2026-20732P4MEDIUMCVSS 4.3≥ 16.1.0, ≤ 16.1.6≥ 17.1.0, < 17.1.3.1+1 more2026-02-04

CVE-2026-20732 [MEDIUM] CWE-451 CVE-2026-20732: A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacke A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

nvd

CVE-2015-1050P4MEDIUMCVSS 4.3≤ 11.5.12015-01-15

CVE-2015-1050 [MEDIUM] CWE-79 CVE-2015-1050: Cross-site scripting (XSS) vulnerability in F5 BIG-IP Application Security Manager (ASM) before 11.6 Cross-site scripting (XSS) vulnerability in F5 BIG-IP Application Security Manager (ASM) before 11.6 allows remote attackers to inject arbitrary web script or HTML via the Response Body field when creating a new user account.

nvd

CVE-2020-5932P4MEDIUMCVSS 4.8≥ 15.1.0, < 15.1.12020-10-29

CVE-2020-5932 [MEDIUM] CWE-79 CVE-2020-5932: On BIG-IP ASM 15.1.0-15.1.0.5, a cross-site scripting (XSS) vulnerability exists in the BIG-IP ASM C On BIG-IP ASM 15.1.0-15.1.0.5, a cross-site scripting (XSS) vulnerability exists in the BIG-IP ASM Configuration utility response and blocking pages. An authenticated user with administrative privileges can specify a response page with any content, including JavaScript code that will be executed when preview is opened.

nvd

CVE-2020-5905P4MEDIUMCVSS 4.3≥ 11.6.1, ≤ 11.6.5.22020-07-01

CVE-2020-5905 [MEDIUM] CWE-79 CVE-2020-5905: In version 11.6.1-11.6.5.2 of the BIG-IP system Configuration utility Network > WCCP page, the syste In version 11.6.1-11.6.5.2 of the BIG-IP system Configuration utility Network > WCCP page, the system does not sanitize all user-provided data before display.

nvd

CVE-2026-42408P4MEDIUMCVSS 4.4≥ 16.1.0, ≤ 16.1.6≥ 17.1.0, ≤ 17.1.3+1 more2026-05-13

CVE-2026-42408 [MEDIUM] CWE-312 CVE-2026-42408: When BIG-IP DNS is provisioned, a vulnerability exists in an undisclosed TMOS Shell (tmsh) command t When BIG-IP DNS is provisioned, a vulnerability exists in an undisclosed TMOS Shell (tmsh) command that may allow a highly privileged authenticated attacker to view sensitive information. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

nvd

CVE-2024-41723P4MEDIUMCVSS 4.3≥ 15.1.0, ≤ 15.1.1≥ 16.1.0, < 16.1.5+1 more2024-08-14

CVE-2024-41723 [MEDIUM] CWE-200 CVE-2024-41723: Undisclosed requests to BIG-IP iControl REST can lead to information leak of user account names. No Undisclosed requests to BIG-IP iControl REST can lead to information leak of user account names. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

nvd

CVE-2024-23603P4LOWCVSS 3.8≥ 15.1.0, < 15.1.9≥ 16.1.0, < 16.1.4+1 more2024-02-14

CVE-2024-23603 [LOW] CWE-89 CVE-2024-23603: An SQL injection vulnerability exists in an undisclosed page of the BIG-IP Configuration utility. An SQL injection vulnerability exists in an undisclosed page of the BIG-IP Configuration utility. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

nvd

CVE-2019-6635P4MEDIUMCVSS 4.4≥ 11.5.2, < 11.5.9≥ 11.6.1, < 11.6.4+4 more2019-07-03

CVE-2019-6635 [MEDIUM] CVE-2019-6635: On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11. On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.1-11.5.8, when the BIG-IP system is licensed for Appliance mode, a user with either the Administrator or the Resource Administrator role can bypass Appliance mode restrictions.

nvd

CVE-2019-6633P4MEDIUMCVSS 4.4≥ 11.5.2, ≤ 11.5.9≥ 11.6.1, ≤ 11.6.4+4 more2019-07-03

CVE-2019-6633 [MEDIUM] CVE-2019-6633: On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4.1, and 11.5.1-11.6.4, whe On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4.1, and 11.5.1-11.6.4, when the BIG-IP system is licensed with Appliance mode, user accounts with Administrator and Resource Administrator roles can bypass Appliance mode restrictions.

nvd

CVE-2019-6670P4MEDIUMCVSS 4.4≥ 11.5.1, ≤ 11.6.5≥ 12.1.0, ≤ 12.1.5+4 more2019-11-27

CVE-2019-6670 [MEDIUM] CWE-312 CVE-2019-6670: On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.1-11 On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.1-11.6.5, vCMP hypervisors are incorrectly exposing the plaintext unit key for their vCMP guests on the filesystem.

nvd

CVE-2022-1389P4MEDIUMCVSS 4.3v11.6.1v11.6.2+29 more2022-05-05

CVE-2022-1389 [MEDIUM] CWE-352 CVE-2022-1389: On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP (fixed in 17.0.0) On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP (fixed in 17.0.0), a cross-site request forgery (CSRF) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility. This vulnerability allows an attacker to run a limited set of commands: ping, traceroute, and WOM diagnostics. Note: Software versions

nvd

CVE-2020-5851P4MEDIUMCVSS 4.6v14.1.0.2.0.45.4v14.1.0.2.0.62.42020-01-14

CVE-2020-5851 [MEDIUM] CVE-2020-5851: On impacted versions and platforms the Trusted Platform Module (TPM) system integrity check cannot d On impacted versions and platforms the Trusted Platform Module (TPM) system integrity check cannot detect modifications to specific system components. This issue only impacts specific engineering hotfixes and platforms. NOTE: This vulnerability does not affect any of the BIG-IP major, minor or maintenance releases you obtained from downloads.f5.com. The affec

nvd

CVE-2023-45219P4MEDIUMCVSS 4.4≥ 13.1.0, ≤ 13.1.5≥ 14.1.0, ≤ 14.1.5+2 more2023-10-10

CVE-2023-45219 [MEDIUM] CWE-200 CVE-2023-45219: Exposure of Sensitive Information vulnerability exist in an undisclosed BIG-IP TMOS shell (tmsh) co Exposure of Sensitive Information vulnerability exist in an undisclosed BIG-IP TMOS shell (tmsh) command which may allow an authenticated attacker with resource administrator role privileges to view sensitive information. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

nvd

CVE-2015-7759P4LOWCVSS 3.7v12.0.02016-01-12

CVE-2015-7759 [LOW] CWE-20 CVE-2015-7759: BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, Link Controller, and PEM 12.0.0 before HF1, when the TCP BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, Link Controller, and PEM 12.0.0 before HF1, when the TCP profile for a virtual server is configured with Congestion Metrics Cache enabled, allow remote attackers to cause a denial of service (Traffic Management Microkernel (TMM) restart) via crafted ICMP packets, related to Path MTU (PMTU) discovery.

nvd

CVE-2022-41983P4LOWCVSS 3.7≥ 13.1.0, ≤ 13.1.5≥ 14.1.0, < 14.1.5.1+2 more2022-10-19

CVE-2022-41983 [LOW] CWE-319 CVE-2022-41983: On specific hardware platforms, on BIG-IP versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.7, 14. On specific hardware platforms, on BIG-IP versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.7, 14.1.x before 14.1.5.1, and all versions of 13.1.x, while Intel QAT (QuickAssist Technology) and the AES-GCM/CCM cipher is in use, undisclosed conditions can cause BIG-IP to send data unencrypted even with an SSL Profile applied.

nvd

CVE-2019-6679P4LOWCVSS 3.3≥ 11.5.9, ≤ 11.5.10≥ 11.6.4, < 11.6.5.1+5 more2019-12-23

CVE-2019-6679 [LOW] CWE-59 CVE-2019-6679: On BIG-IP versions 15.0.0-15.0.1, 14.1.0.2-14.1.2.2, 14.0.0.5-14.0.1, 13.1.1.5-13.1.3.1, 12.1.4.1-12 On BIG-IP versions 15.0.0-15.0.1, 14.1.0.2-14.1.2.2, 14.0.0.5-14.0.1, 13.1.1.5-13.1.3.1, 12.1.4.1-12.1.5, 11.6.4-11.6.5, and 11.5.9-11.5.10, the access controls implemented by scp.whitelist and scp.blacklist are not properly enforced for paths that are symlinks. This allows authenticated users with SCP access to overwrite certain configuration files that

nvd

CVE-2026-63020P4LOWCVSS 3.1≥ 17.1.0, ≤ 17.1.3≥ 17.5.0, ≤ 17.5.1+1 more2026-09-02

CVE-2026-63020 [LOW] CWE-451 CVE-2026-63020: A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacke A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages Impact: An attacker may trick authenticated BIG-IP users into accessing malicious links and reflect a spoofed error message in the victim's BIG-IP Configuration utility web browser session. This is a control plane issue; the

nvd

CVE-2019-11109P4MEDIUMCVSS 4.4≥ 11.5.2, ≤ 11.6.5≥ 12.1.0, ≤ 12.1.5+3 more2019-12-18

CVE-2019-11109 [MEDIUM] CVE-2019-11109: Logic issue in the subsystem for Intel(R) SPS before versions SPS_E5_04.01.04.275.0, SPS_SoC-X_04.00 Logic issue in the subsystem for Intel(R) SPS before versions SPS_E5_04.01.04.275.0, SPS_SoC-X_04.00.04.100.0 and SPS_SoC-A_04.00.04.191.0 may allow a privileged user to potentially enable denial of service via local access.

nvd

CVE-2020-5928P4LOWCVSS 3.1≥ 11.5.2, < 11.6.5≥ 12.1.0, < 12.1.5.2+4 more2020-08-26

CVE-2020-5928 [LOW] CWE-352 CVE-2020-5928: In versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.6, 13.1.0-13.1.3.4, 12.1.0-12.1.5.1, and In versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.6, 13.1.0-13.1.3.4, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, BIG-IP ASM Configuration utility CSRF protection token can be reused multiple times.

nvd

← Previous29 / 30Next →