F5 Big-Ip Fraud Protection Service vulnerabilities

399 known vulnerabilities affecting f5/big-ip_fraud_protection_service.

Total CVEs

399

CISA KEV

actively exploited

Public exploits

Exploited in wild

Severity breakdown

CRITICAL26HIGH233MEDIUM138LOW2

Vulnerabilities

SortPage 16 of 20

CVE-2022-27878P4MEDIUMCVSS 6.8v13.1.0v13.1.1+16 more2022-05-05

CVE-2022-27878 [MEDIUM] CWE-79 CVE-2022-27878: On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP, and F5 BIG-IP Gu On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP, and F5 BIG-IP Guided Configuration (GC) all versions prior to 9.0, a stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to execute JavaScript in the context of the currently logged-

nvd

CVE-2020-5903P4MEDIUMCVSS 6.1≥ 12.1.0, ≤ 12.1.5≥ 13.1.0, ≤ 13.1.3+2 more2020-07-01

CVE-2020-5903 [MEDIUM] CWE-79 CVE-2020-5903: In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, a Cross-Site In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, a Cross-Site Scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility.

nvd

CVE-2021-22994P4MEDIUMCVSS 6.1≥ 11.6.1, < 11.6.5.3≥ 12.1.0, < 12.1.5.3+4 more2021-03-31

CVE-2021-22994 [MEDIUM] CVE-2021-22994: On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x befo On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, undisclosed endpoints in iControl REST allow for a reflected XSS attack, which could lead to a complete compromise of the BIG-IP system if the victim user is granted the admin role. This vulnera

nvd

CVE-2023-22418P4MEDIUMCVSS 6.1≥ 13.1.0, ≤ 13.1.5≥ 15.1.0, < 15.1.7+2 more2023-02-01

CVE-2023-22418 [MEDIUM] CWE-601 CVE-2023-22418: On versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.7, 14.1.x before 14.1 On versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.7, 14.1.x before 14.1.5.3, and all versions of 13.1.x, an open redirect vulnerability exists on virtual servers enabled with a BIG-IP APM access policy. This vulnerability allows an unauthenticated malicious attacker to build an open redirect URI. Note: Software versions

nvd

CVE-2022-28708P4MEDIUMCVSS 5.9v15.1.0v15.1.1+7 more2022-05-05

CVE-2022-28708 [MEDIUM] CWE-20 CVE-2022-28708: On F5 BIG-IP 16.1.x versions prior to 16.1.2.2 and 15.1.x versions prior to 15.1.5.1, when a BIG-IP On F5 BIG-IP 16.1.x versions prior to 16.1.2.2 and 15.1.x versions prior to 15.1.5.1, when a BIG-IP DNS resolver-enabled, HTTP-Explicit or SOCKS profile is configured on a virtual server, an undisclosed DNS response can cause the Traffic Management Microkernel (TMM) process to terminate. Note: Software versions which have reached End of Technical Supp

nvd

CVE-2024-28889P4MEDIUMCVSS 5.9≥ 15.1.0, < 15.1.10.4≥ 16.1.0, < 16.1.4.3+1 more2024-05-08

CVE-2024-28889 [MEDIUM] CWE-825 CVE-2024-28889: When an SSL profile with alert timeout is configured with a non-default value on a virtual server When an SSL profile with alert timeout is configured with a non-default value on a virtual server, undisclosed traffic along with conditions beyond the attacker's control can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

nvd

CVE-2018-5524P4MEDIUMCVSS 5.3≥ 11.6.1, ≤ 11.6.3≥ 12.1.0, ≤ 12.1.3+1 more2018-06-01

CVE-2018-5524 [MEDIUM] CVE-2018-5524: Under certain conditions, on F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.3.1, or 11.6.1 HF2-11.6.3.1, vir Under certain conditions, on F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.3.1, or 11.6.1 HF2-11.6.3.1, virtual servers configured with Client SSL or Server SSL profiles which make use of network hardware security module (HSM) functionality are exposed and impacted by this issue.

nvd

CVE-2017-6153P4MEDIUMCVSS 5.3≥ 11.5.1, ≤ 11.5.5≥ 11.6.1, ≤ 11.6.3+4 more2018-06-01

CVE-2017-6153 [MEDIUM] CWE-400 CVE-2017-6153: Features in F5 BIG-IP 13.0.0-13.1.0.3, 12.1.0-12.1.3.1, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1 sy Features in F5 BIG-IP 13.0.0-13.1.0.3, 12.1.0-12.1.3.1, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1 system that utilizes inflate functionality directly, via an iRule, or via the inflate code from PEM module are subjected to a service disruption via a "Zip Bomb" attack.

nvd

CVE-2019-6647P4MEDIUMCVSS 5.3≥ 11.5.1, ≤ 11.6.4≥ 12.1.0, ≤ 12.1.4+3 more2019-09-04

CVE-2019-6647 [MEDIUM] CWE-401 CVE-2019-6647: On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.2, 12.1.0-12.1.4.1, 11.5.2-11.6.4, when proc On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.2, 12.1.0-12.1.4.1, 11.5.2-11.6.4, when processing authentication attempts for control-plane users MCPD leaks a small amount of memory. Under rare conditions attackers with access to the management interface could eventually deplete memory on the system.

nvd

CVE-2022-23027P4MEDIUMCVSS 5.3≥ 12.1.5.3, ≤ 12.1.6≥ 13.1.3.6, ≤ 13.1.4+2 more2022-01-25

CVE-2022-23027 [MEDIUM] CWE-697 CVE-2022-23027: On BIG-IP versions 15.1.x before 15.1.4, 14.1.x before 14.1.4.4, 13.1.x beginning in 13.1.3.6, 12.1. On BIG-IP versions 15.1.x before 15.1.4, 14.1.x before 14.1.4.4, 13.1.x beginning in 13.1.3.6, 12.1.5.3-12.1.6, and 11.6.5.2, when a FastL4 profile and an HTTP, FIX, and/or hash persistence profile are configured on the same virtual server, undisclosed requests can cause the virtual server to stop processing new client connections. Note: Software ve

nvd

CVE-2026-34019P4MEDIUMCVSS 5.3≥ 17.1.0, ≤ 17.1.2v17.5.0+1 more2026-05-13

CVE-2026-34019 [MEDIUM] CWE-410 CVE-2026-34019: When Bidirectional Forwarding Detection (BFD) is configured in Static and Dynamic routing protocols, When Bidirectional Forwarding Detection (BFD) is configured in Static and Dynamic routing protocols, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to stop processing BFD packets and cause the configured routing protocol to fail over. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

nvd

CVE-2025-58424P4MEDIUMCVSS 5.3≥ 15.1.0, < 15.1.10.8≥ 16.1.0, < 16.1.6+1 more2025-10-15

CVE-2025-58424 [MEDIUM] CWE-340 CVE-2025-58424: On BIG-IP systems, undisclosed traffic can cause data corruption and unauthorized data modification On BIG-IP systems, undisclosed traffic can cause data corruption and unauthorized data modification in protocols which do not have message integrity protection. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

nvd

CVE-2019-6600P4MEDIUMCVSS 6.1≥ 11.5.1, ≤ 11.5.8≥ 11.6.1, ≤ 11.6.3.2+3 more2019-03-13

CVE-2019-6600 [MEDIUM] CWE-79 CVE-2019-6600: In BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.3, 12.1.0-12.1.3.7, 11.6.1-11.6.3.2, or 11.5.1-11.5.8, when In BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.3, 12.1.0-12.1.3.7, 11.6.1-11.6.3.2, or 11.5.1-11.5.8, when remote authentication is enabled for administrative users and all external users are granted the "guest" role, unsanitized values can be reflected to the client via the login page. This can lead to a cross-site scripting attack against unauthenticated c

nvd

CVE-2021-23041P4MEDIUMCVSS 6.1≥ 12.1.0, ≤ 12.1.6≥ 13.1.0, < 13.1.4.1+3 more2021-09-14

CVE-2021-23041 [MEDIUM] CWE-79 CVE-2021-23041: On BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4.2, 13.1.x befor On BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4.2, 13.1.x before 13.1.4.1, and all versions of 12.1.x, a DOM based cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to execute JavaScript in the context of the current logged-in user. N

nvd

CVE-2020-5854P4MEDIUMCVSS 5.9≥ 11.5.2, ≤ 11.6.5≥ 12.1.0, < 12.1.5.1+4 more2020-02-06

CVE-2020-5854 [MEDIUM] CVE-2020-5854: On BIG-IP 15.0.0-15.0.1.1, 14.1.0-14.1.2.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.6. On BIG-IP 15.0.0-15.0.1.1, 14.1.0-14.1.2.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.6.0-11.6.5.1, the tmm crashes under certain circumstances when using the connector profile if a specific sequence of connections are made.

nvd

CVE-2021-23007P4MEDIUMCVSS 5.3v14.1.4v16.0.1.12021-03-31

CVE-2021-23007 [MEDIUM] CVE-2021-23007: On BIG-IP versions 14.1.4 and 16.0.1.1, when the Traffic Management Microkernel (TMM) process handle On BIG-IP versions 14.1.4 and 16.0.1.1, when the Traffic Management Microkernel (TMM) process handles certain undisclosed traffic, it may start dropping all fragmented IP traffic. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.

nvd

CVE-2021-22998P4MEDIUMCVSS 5.3≥ 11.6.1, < 11.6.5.3≥ 12.1.0, < 12.1.5.3+4 more2021-03-31

CVE-2021-22998 [MEDIUM] CVE-2021-22998: On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x befo On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, SYN flood protection thresholds are not enforced in secure network address translation (SNAT) listeners. Note: Software versions which have reached End of Software Development (EoSD) are not eva

nvd

CVE-2022-23030P4MEDIUMCVSS 5.3≥ 13.1.0, ≤ 13.1.4≥ 14.1.0, ≤ 14.1.4+2 more2022-01-25

CVE-2022-23030 [MEDIUM] CWE-400 CVE-2022-23030: On version 16.1.x before 16.1.2, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.5, and all versions of On version 16.1.x before 16.1.2, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.5, and all versions of 13.1.x, when the BIG-IP Virtual Edition (VE) uses the ixlv driver (which is used in SR-IOV mode and requires Intel X710/XL710/XXV710 family of network adapters on the Hypervisor) and TCP Segmentation Offload configuration is enabled, undisclosed requ

nvd

CVE-2022-23029P4MEDIUMCVSS 5.3≥ 11.6.1, ≤ 11.6.5≥ 12.1.0, ≤ 12.1.6+3 more2022-01-25

CVE-2022-23029 [MEDIUM] CWE-367 CVE-2022-23029: On BIG-IP version 16.x before 16.1.0, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.4, and all versio On BIG-IP version 16.x before 16.1.0, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.4, and all versions of 13.1.x, 12.1.x, and 11.6.x, when a FastL4 profile is configured on a virtual server, undisclosed traffic can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not eva

nvd

CVE-2020-5915P4MEDIUMCVSS 6.1≥ 11.6.1, < 11.6.5.2≥ 12.1.0, < 12.1.5.2+4 more2020-08-26

CVE-2020-5915 [MEDIUM] CWE-79 CVE-2020-5915: In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5 In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, an undisclosed TMUI page contains a vulnerability which allows a stored XSS when BIG-IP systems are setup in a device trust.

nvd

← Previous16 / 20Next →