BA
Product
Big-ip Advanced Firewall Manager
On CISA KEVExploited in the wildRansomware-linked
551
CVEs
11
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 35High 303Medium 162Low 0
Watch
Add Big-ip Advanced Firewall Manager to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-6626 | 6.1 | Jul 3 | On BIG-IP (AFM, Analytics, ASM) 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, and 11.5.1-11.6.3.4, A reflected cross-site scripting (XSS) vulnerability exists… Affected: 11.5.1 through 11.6.3; 12.1.0 before 12.1.4.1; 13.0.0 before 13.1.1.5; 14.0.0 before 14.0.0.5; 14.1.0 before 14.1.0.6 |
| CVE-2019-6625 | 6.1 | Jul 3 | On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, and 11.5.1-11.6.4, a reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page… Affected: 11.5.1 through 11.6.3; 12.1.0 before 12.1.4.1; 13.0.0 before 13.1.1.5; 14.0.0 before 14.0.0.5; 14.1.0 before 14.1.0.6 |
| CVE-2019-6600 | 6.1 | Mar 13 | In BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.3, 12.1.0-12.1.3.7, 11.6.1-11.6.3.2, or 11.5.1-11.5.8, when remote authentication is enabled for administrative users and all external… Affected: 11.5.1 through 11.5.8; 11.6.1 through 11.6.3.2; 12.1.0 through 12.1.3.7; 13.0.0 through 13.1.1.3; 14.0.0 through 14.0.0.2 |
| CVE-2019-8331 | 6.1 | Feb 20 | In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute Affected: 12.1.0 before 12.1.5.1; 13.0.0 before 13.1.3.4; 14.0.0 before 14.1.2.5; 15.0.0 before 15.1.0 |
| CVE-2019-6589 | 6.1 | Feb 14 | On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.3, 12.1.0-12.1.3.7, and 11.6.0-11.6.3.2, a reflected Cross Site Scripting (XSS) vulnerability is present in an undisclosed page of the… Affected: 11.6.0 through 11.6.3.2; 12.1.0 through 12.1.3.7; 13.0.0 through 13.1.1.3; 14.0.0 through 14.0.0.2 |
| CVE-2018-15315 | 6.1 | Oct 19 | On F5 BIG-IP 13.0.0-13.1.1.1 and 12.1.0-12.1.3.6, there is a reflected Cross Site Scripting (XSS) vulnerability in an undisclosed Configuration Utility page Affected: 12.1.0 through 12.1.3.6; 13.0.0 through 13.1.1.1 |
| CVE-2018-15314 | 6.1 | Oct 19 | On F5 BIG-IP AFM 13.0.0-13.1.1.1 and 12.1.0-12.1.3.6, there is a Reflected Cross Site Scripting vulnerability in undisclosed TMUI page Affected: 12.1.0 through 12.1.3.6; 13.0.0 through 13.1.1.1 |
| CVE-2018-15313 | 6.1 | Oct 19 | On F5 BIG-IP AFM 13.0.0-13.1.1.1 and 12.1.0-12.1.3.6, there is a Reflected Cross Site Scripting vulnerability in undisclosed TMUI page Affected: 12.1.0 through 12.1.3.6; 13.0.0 through 13.1.1.1 |
| CVE-2018-15312 | 6.1 | Oct 19 | On F5 BIG-IP 13.0.0-13.1.1.1 and 12.1.0-12.1.3.6, a reflected Cross-Site Scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that… Affected: 12.1.0 through 12.1.3.6; 13.0.0 through 13.1.1.1 |
| CVE-2018-5521 | 6.1 | Jun 1 | On F5 BIG-IP 12.1.0-12.1.3.1, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1, carefully crafted URLs can be used to reflect arbitrary content into GeoIP lookup responses, potentially… Affected: 11.5.1 through 11.5.5; 11.6.1 through 11.6.3; 12.1.0 through 12.1.3; 11.2.1 |
| CVE-2024-23976 | 6.0 | Feb 14 | When running in Appliance mode, an authenticated attacker assigned the Administrator role may be able to bypass Appliance mode restrictions utilizing iAppsLX templates on a BIG-IP… Affected: 15.1.0 before 15.1.9; 16.1.0 before 16.1.4; 17.1.0 |
| CVE-2025-58153 | 5.9 | Oct 15 | BIG-IP HSB vulnerability Affected: 15.1.0 before 15.1.10.8; 16.1.0 before 16.1.6.1; 17.5.0 |
| CVE-2024-28889 | 5.9 | May 8 | When an SSL profile with alert timeout is configured with a non-default value on a virtual server, undisclosed traffic along with conditions beyond the attacker's control can… Affected: 15.1.0 before 15.1.10.4; 16.1.0 before 16.1.4.3; 17.1.0 before 17.1.1.3 |
| CVE-2023-22302 | 5.9 | Feb 1 | In BIG-IP versions 17.0.x before 17.0.0.2, and 16.1.x beginning in 16.1.2.2 to before 16.1.3.3, when an HTTP profile is configured on a virtual server and conditions beyond the… Affected: 16.1.2.2 before 16.1.3.3; 17.0.0 before 17.0.0.2 |
| CVE-2022-28708 | 5.9 | May 5 | On F5 BIG-IP 16.1.x versions prior to 16.1.2.2 and 15.1.x versions prior to 15.1.5.1, when a BIG-IP DNS resolver-enabled, HTTP-Explicit or SOCKS profile is configured on a virtual… Affected: 15.1.0; 15.1.1; 15.1.2; 15.1.3; 15.1.4; 15.1.5; +3 more |
| CVE-2020-5935 | 5.9 | Oct 29 | On BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, FPS, GTM, Link Controller, PEM) versions 15.1.0-15.1.0.5, 14.1.0-14.1.2.3, and 13.1.0-13.1.3.3, when handling MQTT traffic… Affected: 13.1.0 before 13.1.3.4; 14.1.0 before 14.1.2.4; 15.0.0 before 15.1.1 |
| CVE-2020-5929 | 5.9 | Sep 25 | In versions 13.0.0-13.0.0 HF2, 12.1.0-12.1.2 HF1, and 11.6.1-11.6.2, BIG-IP platforms with Cavium Nitrox SSL hardware acceleration cards, a Virtual Server configured with a Client… Affected: 11.6.1 before 11.6.2; 12.1.0 before 12.1.2; 11.6.2; 12.1.2; 12.1.2; 13.0.0; +2 more |
| CVE-2020-5917 | 5.9 | Aug 26 | In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.2 and BIG-IQ versions 5.2.0-7.0.0, the host OpenSSH… Affected: 11.6.1 through 11.6.5; 12.1.0 before 12.1.5.2; 13.1.0 through 13.1.3; 14.1.0 before 14.1.2.4; 15.0.0 before 15.0.1.4; 15.1.0 before 15.1.0.5 |
| CVE-2013-3587 | 5.9 | Feb 21 | The HTTPS protocol, as used in unspecified web applications, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which makes it easier for… Affected: 11.3.0 through 11.6.1; 12.0.0 through 12.1.2; 13.0.0 |
| CVE-2020-5854 | 5.9 | Feb 6 | On BIG-IP 15.0.0-15.0.1.1, 14.1.0-14.1.2.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.6.0-11.6.5.1, the tmm crashes under certain circumstances when using the… Affected: 11.5.2 through 11.6.5; 12.1.0 before 12.1.5.1; 13.1.0 before 13.1.3.2; 14.0.0 before 14.0.1.1; 14.1.0 before 14.1.2.1; 15.0.0 before 15.1.0 |
| CVE-2019-6471 | 5.9 | Oct 9 | A race condition which may occur when discarding malformed packets can result in BIND exiting due to a REQUIRE assertion failure in dispatch.c Affected: 11.5.2 through 11.5.9; 11.6.1 through 11.6.4; 12.1.0 through 12.1.4; 13.1.0 through 13.1.1; 14.0.0; 14.1.0; +1 more |
| CVE-2019-6608 | 5.9 | Mar 28 | On BIG-IP 11.5.1-11.6.3, 12.1.0-12.1.3, 13.0.0-13.1.1.1, and 14.0.0-14.0.0.2, under certain conditions, the snmpd daemon may leak memory on a multi-blade BIG-IP vCMP guest when… Affected: 11.2.1 through 11.6.3; 12.1.0 through 12.1.3; 13.0.0 through 13.1.1.1; 14.0.0 through 14.0.0.2 |
| CVE-2019-1559 | 5.9 | Feb 27 | 0-byte record padding oracle Affected: 12.1.0 through 12.1.5; 13.0.0 through 13.1.3; 14.0.0 through 14.1.2; 15.0.0 through 15.1.0 |
| CVE-2019-6594 | 5.9 | Feb 26 | On BIG-IP 11.5.1-11.6.3.2, 12.1.3.4-12.1.3.7, 13.0.0 HF1-13.1.1.1, and 14.0.0-14.0.0.2, Multi-Path TCP (MPTCP) does not protect against multiple zero length DATA_FINs in the… Affected: 11.5.1 through 11.6.3.2; 12.1.3.4 through 12.1.3.7; 13.0.1 through 13.1.1.1; 14.0.0 through 14.0.0.2; 13.0.0; 13.0.0; +1 more |
| CVE-2019-6593 | 5.9 | Feb 26 | On BIG-IP 11.5.1-11.5.4, 11.6.1, and 12.1.0, a virtual server configured with a Client SSL profile may be vulnerable to a chosen ciphertext attack against CBC ciphers Affected: 11.5.1 through 11.5.4; 11.6.1; 12.1.0 |
| CVE-2018-15323 | 5.9 | Oct 31 | On BIG-IP 14.0.0-14.0.0.2 or 13.0.0-13.1.1.1, in certain circumstances, when processing traffic through a Virtual Server with an associated MQTT profile, the TMM process may… Affected: 13.0.0 through 13.1.1.1; 14.0.0 through 14.0.0.2 |
| CVE-2018-15311 | 5.9 | Oct 10 | When F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.3.5, 11.6.0-11.6.3.2, or 11.5.1-11.5.6 is processing specially crafted TCP traffic with the Large Receive Offload (LRO) feature… Affected: 11.5.1 through 11.5.6; 11.6.0.0 through 11.6.3.2; 12.1.0.0 through 12.1.3.5; 13.0.0.0 through 13.1.0.5 |
| CVE-2018-5522 | 5.9 | Jun 1 | On F5 BIG-IP 13.0.0, 12.0.0-12.1.2, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1, when processing DIAMETER transactions with carefully crafted attribute-value pairs, TMM may crash Affected: 11.5.0 through 11.5.5; 11.6.0 through 11.6.3; 12.0.0 through 12.1.2; 11.2.1; 13.0.0 |
| CVE-2014-4024 | 5.9 | Mar 19 | SSL virtual servers in F5 BIG-IP systems 10.x before 10.2.4 HF9, 11.x before 11.2.1 HF12, 11.3.0 before HF10, 11.4.0 before HF8, 11.4.1 before HF5, 11.5.0 before HF5, and 11.5.1… Affected: 11.3.0 through 11.5.1 |
| CVE-2018-5501 | 5.9 | Mar 1 | In some circumstances, on F5 BIG-IP systems running 13.0.0, 12.1.0 - 12.1.3.1, any 11.6.x or 11.5.x release, or 11.2.1, TCP DNS profile allows excessive buffering due to lack of… Affected: 11.5.1 through 11.5.4; 11.6.1 through 11.6.2; 12.1.0 through 12.1.3; 11.2.1; 13.0.0 |
| CVE-2018-5500 | 5.9 | Mar 1 | On F5 BIG-IP systems running 13.0.0, 12.1.0 - 12.1.3.1, or 11.6.1 - 11.6.2, every Multipath TCP (MCTCP) connection established leaks a small amount of memory Affected: 11.6.1 through 11.6.2; 12.1.0 through 12.1.3.1; 13.0.0 |
| CVE-2017-6136 | 5.9 | Dec 21 | In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and WebSafe software version 13.0.0 and 12.0.0 - 12.1.2, undisclosed traffic patterns sent to… Affected: 12.1.0 through 12.1.2; 13.0.0 |
| CVE-2017-6163 | 5.9 | Oct 27 | In F5 BIG-IP LTM, AAM, AFM, APM, ASM, Link Controller, PEM, PSM software version 12.0.0 to 12.1.2, 11.6.0 to 11.6.1, 11.4.0 to 11.5.4, when a virtual server uses the standard… Affected: 11.4.0 through 11.5.4; 11.6.0; 11.6.1; 12.0.0; 12.1.0; 12.1.1; +1 more |
| CVE-2017-6162 | 5.9 | Oct 27 | In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, Websafe software version 12.0.0 to 12.1.2, 11.6.0 to 11.6.1, 11.4.0 to 11.5.4,… Affected: 11.5.0 through 11.5.4; 11.2.1; 11.6.0; 11.6.1; 12.0.0; 12.1.0; +1 more |
| CVE-2017-6159 | 5.9 | Oct 27 | F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM, Websafe software version 12.0.0 to 12.1.2, 11.6.0 to 11.6.1 are vulnerable to a denial of service… Affected: 11.6.0; 11.6.1; 12.0.0; 12.1.0; 12.1.1; 12.1.2 |
| CVE-2017-6141 | 5.9 | Oct 20 | In F5 BIG-IP LTM, AAM, AFM, APM, ASM, Link Controller, PEM, and WebSafe 12.1.0 through 12.1.2, certain values in a TLS abbreviated handshake when using a client SSL profile with… Affected: 12.1.0; 12.1.1; 12.1.2 |
| CVE-2017-6147 | 5.9 | Sep 18 | In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, and WebSafe 12.1.2-HF1 and 13.0.0, an undisclosed type of responses may cause TMM to restart, causing… Affected: 12.1.2; 13.0.0 |
| CVE-2017-6137 | 5.9 | May 9 | In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, PSM, WebAccelerator, and WebSafe 11.6.1 HF1, 12.0.0 HF3, 12.0.0 HF4, and 12.1.0… Affected: 11.6.1; 12.0.0; 12.1.0; 12.1.1; 12.1.2 |
| CVE-2016-7468 | 5.9 | Mar 23 | An unauthenticated remote attacker may be able to disrupt services on F5 BIG-IP 11.4.1 - 11.5.4 devices with maliciously crafted network traffic Affected: 11.4.0; 11.4.1; 11.5.0; 11.5.1; 11.5.2; 11.5.3; +1 more |
| CVE-2016-9245 | 5.9 | Mar 7 | In F5 BIG-IP systems 12.1.0 - 12.1.2, malicious requests made to virtual servers with an HTTP profile can cause the TMM to restart Affected: 12.1.0; 12.1.1; 12.1.2 |
| CVE-2016-9247 | 5.9 | Jan 10 | Under certain conditions for BIG-IP systems using a virtual server with an associated FastL4 profile and TCP analytics profile, a specific sequence of packets may cause the… Affected: 12.1.0; 12.1.1 |
| CVE-2016-5024 | 5.9 | Jan 3 | Virtual servers in F5 BIG-IP systems 11.6.1 before 11.6.1 HF1 and 12.1.x before 12.1.2, when configured to parse RADIUS messages via an iRule, allow remote attackers to cause a… Affected: 11.6.1; 12.1.0; 12.1.1 |
| CVE-2015-8099 | 5.9 | May 13 | F5 BIG-IP LTM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.3.x, 11.4.x before 11.4.1 HF10, 11.5.x before 11.5.4, 11.6.x before 11.6.1, and 12.x before 12.0.0 HF1; BIG-IP… Affected: 11.3.0; 11.4.0; 11.4.1; 11.5.0; 11.5.1; 11.5.2; +12 more |
| CVE-2023-43485 | 5.5 | Oct 10 | When TACACS+ audit forwarding is configured on BIG-IP or BIG-IQ system, sharedsecret is logged in plaintext in the audit log. Note: Software versions which have reached End of… Affected: 13.1.0 through 13.1.5; 14.1.0 through 14.1.5; 15.1.0 before 15.1.9; 16.1.0 before 16.1.4 |
| CVE-2022-35272 | 5.5 | Aug 4 | BIG-IP HTTP MRF vulnerability CVE-2022-35272 Affected: 16.1.0 before 16.1.3.1; 17.0.0 |
| CVE-2020-5890 | 5.5 | Apr 30 | On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, and 12.1.0-12.1.5.1 and BIG-IQ 5.2.0-7.1.0, when creating a QKView, credentials for binding to LDAP servers used for… Affected: 12.1.0 through 12.1.5.1; 13.1.0 through 13.1.3.3; 14.0.0 before 14.1.2.4; 15.0.0 before 15.1.0.2 |
| CVE-2019-19151 | 5.5 | Dec 23 | On BIG-IP versions 15.0.0-15.1.0, 14.0.0-14.1.2.3, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, BIG-IQ versions 7.0.0, 6.0.0-6.1.0, and 5.0.0-5.4.0, iWorkflow version… Affected: 11.5.1 through 11.6.5; 12.1.0 through 12.1.5; 13.0.0 through 13.1.3; 14.0.0 through 14.1.2; 15.0.0 through 15.1.0 |
| CVE-2019-6663 | 5.5 | Nov 15 | The BIG-IP 15.0.0-15.0.1, 14.0.0-14.1.2.2, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.1-11.6.5.1, BIG-IQ 7.0.0, 6.0.0-6.1.0, and 5.2.0-5.4.0, iWorkflow 2.3.0, and Enterprise Manager… Affected: 11.5.2 through 11.6.5; 12.1.0 through 12.1.5; 13.0.0 through 13.1.3; 14.0.0 through 14.1.2; 15.0.0 through 15.0.1 |
| CVE-2019-6632 | 5.5 | Jul 3 | On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, under certain circumstances, attackers can decrypt configuration items that are encrypted because… Affected: 12.1.0 before 12.1.4.1; 13.0.0 before 13.1.1.5; 14.0.0 before 14.0.0.5; 14.1.0 before 14.1.0.6 |
| CVE-2018-15333 | 5.5 | Dec 28 | On versions 11.2.1. and greater, unrestricted Snapshot File Access allows BIG-IP system's user with any role, including Guest Role, to have access and download previously… Affected: 11.2.1 through 11.6.3; 12.1.0 through 12.1.4; 13.0.0 through 13.1.1; 14.0.0 through 14.1.0 |
The 500 most important CVEs for this product (exploited first, then by severity)