Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 108

CVE-2023-38423

BIG-IP Configuration utility vulnerability

A cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Access Policy Manager Big-ip Advanced Firewall Manager Big-ip Advanced Web Application Firewall and 16 more
CVE-2023-38419

BIG-IP and BIG-IQ iControl SOAP vulnerability

An authenticated attacker with guest privileges or higher can cause the iControl SOAP process to terminate by sending undisclosed requests.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Access Policy Manager Big-ip Advanced Firewall Manager Big-ip Advanced Web Application Firewall and 17 more
CVE-2023-38138

BIG-IP Configuration utility vulnerability

A reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility which allows an attacker to run JavaScript in the context of the currently logged-in user.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Access Policy Manager Big-ip Advanced Firewall Manager Big-ip Advanced Web Application Firewall and 16 more
CVE-2019-10744

nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

CVSS 3.1 · 9.1 Critical EPSS 5.0% KEV · Not listed
Vendors
F5 Lodash Netapp and 2 more
Products
Big-ip Access Policy Manager Big-ip Advanced Firewall Manager Big-ip Analytics and 23 more
CVE-2024-41727

BIG-IP TMM vulnerability

In BIG-IP tenants running on r2000 and r4000 series hardware, or BIG-IP Virtual Edition (VEs) using Intel E810 SR-IOV NIC, undisclosed traffic can cause an increase in memory resource utilization.   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Access Policy Manager Big-ip Advanced Firewall Manager Big-ip Advanced Web Application Firewall and 20 more
CVE-2024-41164

BIG-IP MPTCP vulnerability

When TCP profile with Multipath TCP enabled (MPTCP) is configured on a Virtual Server, undisclosed traffic along with conditions beyond the attackers control can cause TMM to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Access Policy Manager Big-ip Advanced Firewall Manager Big-ip Advanced Web Application Firewall and 20 more