F5 Big-Ip Fraud Protection Service vulnerabilities

399 known vulnerabilities affecting f5/big-ip_fraud_protection_service.

Total CVEs

399

CISA KEV

actively exploited

Public exploits

Exploited in wild

Severity breakdown

CRITICAL26HIGH233MEDIUM138LOW2

Vulnerabilities

SortPage 13 of 20

CVE-2018-15320P3HIGHCVSS 7.5≥ 13.0.0, ≤ 13.1.1.1≥ 14.0.0, ≤ 14.0.0.22018-10-31

CVE-2018-15320 [HIGH] CVE-2018-15320: On BIG-IP 14.0.0-14.0.0.2 or 13.0.0-13.1.1.1, undisclosed traffic patterns may lead to denial of ser On BIG-IP 14.0.0-14.0.0.2 or 13.0.0-13.1.1.1, undisclosed traffic patterns may lead to denial of service conditions for the BIG-IP system. The configuration which exposes this condition is the BIG-IP self IP address which is part of a VLAN group and has the Port Lockdown setting configured with anything other than "allow-all".

nvd

CVE-2020-5872P3HIGHCVSS 7.5≥ 12.1.0, ≤ 12.1.4.1≥ 13.1.0, ≤ 13.1.3.1+2 more2020-04-30

CVE-2020-5872 [HIGH] CVE-2020-5872: On BIG-IP 14.1.0-14.1.2.3, 14.0.0-14.0.1, 13.1.0-13.1.3.1, and 12.1.0-12.1.4.1, when processing TLS On BIG-IP 14.1.0-14.1.2.3, 14.0.0-14.0.1, 13.1.0-13.1.3.1, and 12.1.0-12.1.4.1, when processing TLS traffic with hardware cryptographic acceleration enabled on platforms with Intel QAT hardware, the Traffic Management Microkernel (TMM) may stop responding and cause a failover event.

nvd

CVE-2020-5883P3HIGHCVSS 7.5≥ 13.1.0, ≤ 13.1.3.1≥ 14.0.0, ≤ 14.0.1+2 more2020-04-30

CVE-2020-5883 [HIGH] CWE-401 CVE-2020-5883: On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2.3, 14.0.0-14.0.1, and 13.1.0-13.1.3.1, when a virtual server On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2.3, 14.0.0-14.0.1, and 13.1.0-13.1.3.1, when a virtual server is configured with HTTP explicit proxy and has an attached HTTP_PROXY_REQUEST iRule, POST requests sent to the virtual server cause an xdata memory leak.

nvd

CVE-2020-5926P3HIGHCVSS 7.5≥ 14.1.0, < 14.1.2.7≥ 15.0.0, < 15.0.1.4+1 more2020-08-26

CVE-2020-5926 [HIGH] CWE-404 CVE-2020-5926: In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, and 14.1.0-14.1.2.6, a BIG-IP virtual server wi In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, and 14.1.0-14.1.2.6, a BIG-IP virtual server with a Session Initiation Protocol (SIP) ALG profile, parsing SIP messages that contain a multi-part MIME payload with certain boundary strings can cause TMM to free memory to the wrong cache.

nvd

CVE-2020-5861P3HIGHCVSS 7.5≥ 12.1.0, ≤ 12.1.52020-03-27

CVE-2020-5861 [HIGH] CWE-119 CVE-2020-5861: On BIG-IP 12.1.0-12.1.5, the TMM process may produce a core file in some cases when Ram Cache incorr On BIG-IP 12.1.0-12.1.5, the TMM process may produce a core file in some cases when Ram Cache incorrectly optimizes stored data resulting in memory errors.

nvd

CVE-2019-6676P3HIGHCVSS 7.5≥ 13.1.0, < 13.1.3.2≥ 14.0.0, < 14.1.2.3+1 more2019-12-23

CVE-2019-6676 [HIGH] CVE-2019-6676: On versions 15.0.0-15.0.1, 14.0.0-14.1.2.2, and 13.1.0-13.1.3.1, TMM may restart on BIG-IP Virtual E On versions 15.0.0-15.0.1, 14.0.0-14.1.2.2, and 13.1.0-13.1.3.1, TMM may restart on BIG-IP Virtual Edition (VE) when using virtio direct descriptors and packets 2 KB or larger.

nvd

CVE-2019-6683P3HIGHCVSS 7.5≥ 11.5.2, ≤ 11.6.5≥ 12.1.0, ≤ 12.1.5+4 more2019-12-23

CVE-2019-6683 [HIGH] CWE-400 CVE-2019-6683: On versions 15.0.0-15.0.1.1, 14.1.0-14.1.2.2, 14.0.0-14.0.1, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11. On versions 15.0.0-15.0.1.1, 14.1.0-14.1.2.2, 14.0.0-14.0.1, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, BIG-IP virtual servers with Loose Initiation enabled on a FastL4 profile may be subject to excessive flow usage under undisclosed conditions.

nvd

CVE-2019-6664P3HIGHCVSS 7.5≥ 14.1.0, < 14.1.2v15.0.02019-11-15

CVE-2019-6664 [HIGH] CVE-2019-6664: On BIG-IP 15.0.0 and 14.1.0-14.1.0.6, under certain conditions, network protections on the managemen On BIG-IP 15.0.0 and 14.1.0-14.1.0.6, under certain conditions, network protections on the management port do not follow current best practices.

nvd

CVE-2019-6617P3MEDIUMCVSS 6.5≥ 11.5.2, < 11.5.9≥ 11.6.1, < 11.6.4+3 more2019-05-03

CVE-2019-6617 [MEDIUM] CWE-269 CVE-2019-6617: On BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8, a use On BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8, a user with the Resource Administrator role is able to overwrite sensitive low-level files (such as /etc/passwd) using SFTP to modify user permissions, without Advanced Shell access. This is contrary to our definition for the Resource Administrator (RA) role

nvd

CVE-2019-12295P3HIGHCVSS 7.5≥ 12.1.3.6, < 12.1.5.3≥ 13.1.1.2, < 13.1.3.5+4 more2019-05-23

CVE-2019-12295 [HIGH] CWE-674 CVE-2019-12295: In Wireshark 3.0.0 to 3.0.1, 2.6.0 to 2.6.8, and 2.4.0 to 2.4.14, the dissection engine could crash. In Wireshark 3.0.0 to 3.0.1, 2.6.0 to 2.6.8, and 2.4.0 to 2.4.14, the dissection engine could crash. This was addressed in epan/packet.c by restricting the number of layers and consequently limiting recursion.

nvd

CVE-2026-40462P3MEDIUMCVSS 6.5≥ 17.1.0, ≤ 17.1.3≥ 17.5.0, ≤ 17.5.1+2 more2026-05-13

CVE-2026-40462 [MEDIUM] CWE-732 CVE-2026-40462: Incorrect permission assignment vulnerabilities exist in iControl REST and TMOS shell (tmsh) undiscl Incorrect permission assignment vulnerabilities exist in iControl REST and TMOS shell (tmsh) undisclosed command which may allow an authenticated attacker to view sensitive information. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

nvd

CVE-2020-5945P3HIGHCVSS 8.4≥ 14.1.0, < 14.1.2.8≥ 15.1.0, < 15.1.1+1 more2020-11-05

CVE-2020-5945 [HIGH] CWE-79 CVE-2020-5945: In BIG-IP versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.2.7, undisclosed TMUI page cont In BIG-IP versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.2.7, undisclosed TMUI page contains a stored cross site scripting vulnerability (XSS). The issue allows a minor privilege escalation for resource admin to escalate to full admin.

nvd

CVE-2025-24320P3HIGHCVSS 8.0≥ 15.1.0, < 15.1.10.6≥ 16.1.0, < 16.1.5.2+1 more2025-02-05

CVE-2025-24320 [HIGH] CVE-2025-24320: A stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Config A stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user. This vulnerability is due to an incomplete fix for CVE-2024-31156 https://my.f5.com/manage/s/article/K000138636 . Note: Software versions which have reach

nvd

CVE-2020-5875P3HIGHCVSS 7.5≥ 14.1.0, ≤ 14.1.2.3≥ 15.0.0, ≤ 15.0.12020-04-30

CVE-2020-5875 [HIGH] CVE-2020-5875: On BIG-IP 15.0.0-15.0.1 and 14.1.0-14.1.2.3, under certain conditions, the Traffic Management Microk On BIG-IP 15.0.0-15.0.1 and 14.1.0-14.1.2.3, under certain conditions, the Traffic Management Microkernel (TMM) may generate a core file and restart while processing SSL traffic with an HTTP/2 full proxy.

nvd

CVE-2020-5862P3HIGHCVSS 7.5≥ 14.1.0, ≤ 14.1.2≥ 15.0.0, ≤ 15.0.1.1+1 more2020-03-27

CVE-2020-5862 [HIGH] CWE-20 CVE-2020-5862: On BIG-IP 15.1.0-15.1.0.1, 15.0.0-15.0.1.1, and 14.1.0-14.1.2.2, under certain conditions, TMM may c On BIG-IP 15.1.0-15.1.0.1, 15.0.0-15.0.1.1, and 14.1.0-14.1.2.2, under certain conditions, TMM may crash or stop processing new traffic with the DPDK/ENA driver on AWS systems while sending traffic. This issue does not affect any other platforms, hardware or virtual, or any other cloud provider since the affected driver is specific to AWS.

nvd

CVE-2020-5871P3HIGHCVSS 7.5≥ 14.1.0, ≤ 14.1.2.32020-04-30

CVE-2020-5871 [HIGH] CVE-2020-5871: On BIG-IP 14.1.0-14.1.2.3, undisclosed requests can lead to a denial of service (DoS) when sent to B On BIG-IP 14.1.0-14.1.2.3, undisclosed requests can lead to a denial of service (DoS) when sent to BIG-IP HTTP/2 virtual servers. The problem can occur when ciphers, which have been blacklisted by the HTTP/2 RFC, are used on backend servers. This is a data-plane issue. There is no control-plane exposure.

nvd

CVE-2020-5878P3HIGHCVSS 7.5≥ 14.1.0, ≤ 14.1.2.3≥ 15.0.0, ≤ 15.0.1.1+1 more2020-04-30

CVE-2020-5878 [HIGH] CVE-2020-5878: On versions 15.1.0-15.1.0.1, 15.0.0-15.0.1.1, and 14.1.0-14.1.2.3, Traffic Management Microkernel (T On versions 15.1.0-15.1.0.1, 15.0.0-15.0.1.1, and 14.1.0-14.1.2.3, Traffic Management Microkernel (TMM) may restart on BIG-IP Virtual Edition (VE) while processing unusual IP traffic.

nvd

CVE-2020-5857P3HIGHCVSS 7.5≥ 11.5.2, ≤ 11.6.5≥ 12.1.0, ≤ 12.1.5+3 more2020-03-27

CVE-2020-5857 [HIGH] CVE-2020-5857: On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2.2, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, undis On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2.2, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, undisclosed HTTP behavior may lead to a denial of service.

nvd

CVE-2020-5856P3HIGHCVSS 7.5≥ 14.1.0, < 14.1.2.3≥ 15.0.0, < 15.1.02020-02-06

CVE-2020-5856 [HIGH] CVE-2020-5856: On BIG-IP 15.0.0-15.0.1.1 and 14.1.0-14.1.2.2, while processing specifically crafted traffic using t On BIG-IP 15.0.0-15.0.1.1 and 14.1.0-14.1.2.2, while processing specifically crafted traffic using the default 'xnet' driver, Virtual Edition instances hosted in Amazon Web Services (AWS) may experience a TMM restart.

nvd

CVE-2019-6671P3HIGHCVSS 7.5≥ 13.1.0, ≤ 13.1.3.1≥ 14.0.0, ≤ 14.0.1+2 more2019-11-27

CVE-2019-6671 [HIGH] CWE-401 CVE-2019-6671: On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2, 14.0.0-14.0.1, and 13.1.0-13.1.3.1, under certain conditions On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2, 14.0.0-14.0.1, and 13.1.0-13.1.3.1, under certain conditions tmm may leak memory when processing packet fragments, leading to resource starvation.

nvd

← Previous13 / 20Next →