F5 Big Ip Websafe vulnerabilities, page 5
175 vulnerabilities
Known vulnerabilities in F5 Big Ip Websafe, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
MediumCVE-2017-6141f5 networks, inc. · f5 big-ip ltm, aam, afm, apm, asm, link controller, pem, websafe +8 moref5 networks, inc. f5 big-ip ltm, aam, afm, apm, asm, link controller, pem, websafeIn F5 BIG-IP LTM, AAM, AFM, APM, ASM, Link Controller, PEM, and WebSafe 12.1.0 through 12.1.2, certain values in a TLS abbreviated handshake when using a client SSL profile with the Session Ticket option enabled may cause disruption of service to the Traffic Management Microkernel (TMM). The Session Ticket option is disabled by default.EPSS1.06%MediumCVE-2017-6136f5 networks, inc. · big-ip ltm, aam, afm, analytics, apm, asm, dns, gtm, link controller, pem, websafe +11 moref5 networks, inc. big-ip ltm, aam, afm, analytics, apm, asm, dns, gtm, link controller, pem, websafeIn F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and WebSafe software version 13.0.0 and 12.0.0 - 12.1.2, undisclosed traffic patterns sent to BIG-IP virtual servers, with the TCP Fast Open and Tail Loss Probe options enabled in the associated TCP profile, may cause a disruption of service to the Traffic Management Microkernel (TMM).EPSS1.41%HighCVE-2017-6150f5 networks, inc. · big-ip ltm, aam, afm, analytics, apm, asm, dns, link controller, pem, websafe +10 moref5 networks, inc. big-ip ltm, aam, afm, analytics, apm, asm, dns, link controller, pem, websafeUnder certain conditions for F5 BIG-IP systems 13.0.0 or 12.1.0 - 12.1.3.1, using FastL4 profiles, when the Reassemble IP Fragments option is disabled (default), some specific large fragmented packets may restart the Traffic Management Microkernel (TMM).EPSS1.74%HighCVE-2017-6133f5 networks, inc. · big-ip ltm, aam, afm, analytics, apm, asm, dns, link controller, pem, websafe +10 moref5 networks, inc. big-ip ltm, aam, afm, analytics, apm, asm, dns, link controller, pem, websafeIn F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM and WebSafe software version 13.0.0 and 12.1.0 - 12.1.2, undisclosed HTTP requests may cause a denial of service.EPSS2.36%MediumCVE-2017-6158f5 networks, inc. · big-ip (ltm, aam, afm, analytics, apm, asm, dns, edge gateway, gtm, link controller, pem, webaccelerator, websafe) +13 moref5 networks, inc. big-ip (ltm, aam, afm, analytics, apm, asm, dns, edge gateway, gtm, link controller, pem, webaccelerator, websafe)In F5 BIG-IP 12.0.0-12.1.2, 11.6.0-11.6.1, 11.5.1-11.5.5, or 11.2.1 there is a vulnerability in TMM related to handling of invalid IP addresses.EPSS1.10%HighCVE-2017-6151f5 networks, inc. · big-ip (ltm, aam, afm, analytics, apm, asm, dns, edge gateway, gtm, link controller, pem, webaccelerator, websafe) +13 moref5 networks, inc. big-ip (ltm, aam, afm, analytics, apm, asm, dns, edge gateway, gtm, link controller, pem, webaccelerator, websafe)In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, WebAccelerator and WebSafe software version 13.0.0, undisclosed requests made to BIG-IP virtual servers which make use of the "HTTP/2 profile" may result in a disruption of service to TMM.EPSS1.64%HighCVE-2017-6164f5 networks, inc. · big-ip (ltm, aam, afm, analytics, apm, asm, dns, edge gateway, gtm, link controller, pem, webaccelerator, websafe) +13 moref5 networks, inc. big-ip (ltm, aam, afm, analytics, apm, asm, dns, edge gateway, gtm, link controller, pem, webaccelerator, websafe)In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, WebAccelerator and WebSafe software version 13.0.0, 12.0.0 - 12.1.2, 11.6.0 - 11.6.1 and 11.5.0 - 11.5.4, in some circumstances, Traffic Management Microkernel (TMM) does not properly handle certain malformed TLS1.2 records, which allows remote attackers to cause a denial-of-service (DoS) or possible remote command execution on the BIG-IP system.EPSS3.94%HighCVE-2017-6128f5 networks, inc. · big-ip ltm, aam, afm, analytics, apm, asm, edge gateway, gtm, link controller, pem, psm, webaccelerator, websafe +24 moref5 networks, inc. big-ip ltm, aam, afm, analytics, apm, asm, edge gateway, gtm, link controller, pem, psm, webaccelerator, websafeAn attacker may be able to cause a denial-of-service (DoS) attack against the sshd component in F5 BIG-IP, Enterprise Manager, BIG-IQ, and iWorkflow.EPSS1.40%MediumCVE-2017-6162f5 networks, inc. · big-ip ltm, aam, afm, analytics, apm, asm, dns, edge gateway, gtm, link controller, pem, websafe +8 moref5 networks, inc. big-ip ltm, aam, afm, analytics, apm, asm, dns, edge gateway, gtm, link controller, pem, websafeIn F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, Websafe software version 12.0.0 to 12.1.2, 11.6.0 to 11.6.1, 11.4.0 to 11.5.4, 11.2.1, in some cases TMM may crash when processing TCP traffic. This vulnerability affects TMM via a virtual server configured with TCP profile. Traffic processing is disrupted while Traffic Management Microkernel (TMM) restarts. If the affected BIG-IP system is configured to be part of a device group, it will trigger a failover to the peer device.EPSS1.67%CriticalCVE-2017-6165f5 networks, inc. · f5 big-ip ltm, aam, afm, analytics, apm, asm, dns, gtm, link controller, pem, websafe +11 moref5 networks, inc. f5 big-ip ltm, aam, afm, analytics, apm, asm, dns, gtm, link controller, pem, websafeIn F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM, and WebSafe 11.5.1 HF6 through 11.5.4 HF4, 11.6.0 through 11.6.1 HF1, and 12.0.0 through 12.1.2 on VIPRION platforms only, the script which synchronizes SafeNet External Network HSM configuration elements between blades in a clustered deployment will log the HSM partition password in cleartext to the "/var/log/ltm" log file.EPSS1.93%MediumCVE-2017-6159f5 networks, inc. · big-ip ltm, aam, afm, analytics, apm, asm, dns, gtm, link controller, pem, websafe +8 moref5 networks, inc. big-ip ltm, aam, afm, analytics, apm, asm, dns, gtm, link controller, pem, websafeF5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM, Websafe software version 12.0.0 to 12.1.2, 11.6.0 to 11.6.1 are vulnerable to a denial of service attack when the MPTCP option is enabled on a virtual server. Data plane is vulnerable when using the MPTCP option of a TCP profile. There is no control plane exposure. An attacker may be able to disrupt services by causing TMM to restart hence temporarily failing to process traffic.EPSS1.59%HighCVE-2017-6145f5 networks, inc. · f5 big-ip ltm, aam, afm, analytics, apm, asm, dns, link controller, pem, websafe +10 moref5 networks, inc. f5 big-ip ltm, aam, afm, analytics, apm, asm, dns, link controller, pem, websafeiControl REST in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, and WebSafe 12.0.0 through 12.1.2 and 13.0.0 includes a service to convert authorization BIGIPAuthCookie cookies to X-F5-Auth-Token tokens. This service does not properly re-validate cookies when making that conversion, allowing once-valid but now expired cookies to be converted to valid tokens.EPSS1.05%MediumCVE-2017-6137f5 networks, inc. · big-ip ltm, aam, afm, analytics, apm, asm, dns, edge gateway, gtm, link controller, pem, psm, webaccelerator, websafe +11 moref5 networks, inc. big-ip ltm, aam, afm, analytics, apm, asm, dns, edge gateway, gtm, link controller, pem, psm, webaccelerator, websafeIn F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, PSM, WebAccelerator, and WebSafe 11.6.1 HF1, 12.0.0 HF3, 12.0.0 HF4, and 12.1.0 through 12.1.2, undisclosed traffic patterns received while software SYN cookie protection is engaged may cause a disruption of service to the Traffic Management Microkernel (TMM) on specific platforms and configurations.EPSS1.09%MediumCVE-2017-6134f5 networks, inc. · big-ip ltm, aam, afm, analytics, apm, asm, dns, gtm, link controller, pem, websafe +11 moref5 networks, inc. big-ip ltm, aam, afm, analytics, apm, asm, dns, gtm, link controller, pem, websafeIn F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and WebSafe software version 13.0.0, 12.1.0 - 12.1.2 and 11.5.1 - 11.6.1, an undisclosed sequence of packets, sourced from an adjacent network may cause TMM to crash.EPSS0.87%MediumCVE-2017-6156f5 networks, inc. · big-ip (ltm, aam, afm, analytics, apm, asm, dns, edge gateway, gtm, link controller, pem, webaccelerator, websafe) +13 moref5 networks, inc. big-ip (ltm, aam, afm, analytics, apm, asm, dns, edge gateway, gtm, link controller, pem, webaccelerator, websafe)When the F5 BIG-IP 12.1.0-12.1.1, 11.6.0-11.6.1, 11.5.1-11.5.5, or 11.2.1 system is configured with a wildcard IPSec tunnel endpoint, it may allow a remote attacker to disrupt or impersonate the tunnels that have completed phase 1 IPSec negotiations. The attacker must possess the necessary credentials to negotiate the phase 1 of the IPSec exchange to exploit this vulnerability; in many environment this limits the attack surface to other endpoints under the same administration.EPSS0.91%HighCVE-2024-41727f5 · big-ip +21 moreBIG-IP TMM vulnerabilityIn BIG-IP tenants running on r2000 and r4000 series hardware, or BIG-IP Virtual Edition (VEs) using Intel E810 SR-IOV NIC, undisclosed traffic can cause an increase in memory resource utilization.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.EPSS0.48%MediumCVE-2024-41723f5 · big-ip +21 moreBIG-IP iControl REST vulnerabilityUndisclosed requests to BIG-IP iControl REST can lead to information leak of user account names. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.EPSS0.30%HighCVE-2024-41164f5 · big-ip +25 moreBIG-IP MPTCP vulnerabilityWhen TCP profile with Multipath TCP enabled (MPTCP) is configured on a Virtual Server, undisclosed traffic along with conditions beyond the attackers control can cause TMM to terminate.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.EPSS0.44%HighCVE-2024-31156f5 · big-ip +21 moreBIG-IP Configuration utility XSS vulnerabilityA stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.EPSS0.58%HighCVE-2024-39778f5 · big-ip +21 moreBIG-IP HSB vulnerabilityWhen a stateless virtual server is configured on BIG-IP system with a High-Speed Bridge (HSB), undisclosed requests can cause TMM to terminate.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.EPSS0.48%