F5 Networks, Inc. BIG-IP (APM)
19 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2019-6596 | 14.0.0-14.0.0.2, 13.0.0-13.1.1.1, 12.1.0-12.1.3.6, 11.6.1-11.6.3.2, 11.5.1-11.5.8 | In BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.1, 12.1.0-12.1.3.6, 11.6.1-11.6.3.2, or 11.5.1-11.5.8, when processing fragmented ClientHello messa | HIGH 7.5 | 1.4 % | ||
| CVE-2019-6595 | 11.5.x,11.6.x | Cross-site scripting (XSS) vulnerability in F5 BIG-IP Access Policy Manager (APM) 11.5.x and 11.6.x Admin Web UI. | MEDIUM 6.1 | 0.9 % | ||
| CVE-2019-6591 | 14.0.0-14.0.0.4, 13.0.0-13.1.1.3, 12.1.0-12.1.3.7 | On BIG-IP APM 14.0.0 to 14.0.0.4, 13.0.0 to 13.1.1.3 and 12.1.0 to 12.1.3.7, a reflected cross-site scripting (XSS) vulnerability exists in | MEDIUM 5.4 | 0.6 % | ||
| CVE-2018-15335 | 13.0.0-13.1.x | When APM 13.0.0-13.1.x is deployed as an OAuth Resource Server, APM becomes a client application to an external OAuth authorization server. | MEDIUM 5.9 | 1.4 % | ||
| CVE-2018-15334 | All versions 11.2.1+ | A cross-site request forgery (CSRF) vulnerability in the APM webtop 11.2.1 or greater may allow attacker to force an APM webtop session to l | MEDIUM 4.3 | 0.7 % | ||
| CVE-2018-15326 | 14.0.0-14.0.0.2, 13.0.0-13.1.0.7, 12.1.0-12.1.3.5, 11.6.0-11.6.3.2 | In some situations on BIG-IP APM 14.0.0-14.0.0.2, 13.0.0-13.1.0.7, 12.1.0-12.1.3.5, or 11.6.0-11.6.3.2, the CRLDP Auth access policy agent m | HIGH 7.5 | 0.6 % | ||
| CVE-2018-15324 | 14.0.0-14.0.0.2, 13.0.0-13.1.1.1 | On BIG-IP APM 14.0.0-14.0.0.2 or 13.0.0-13.1.1.1, TMM may restart when processing a specially crafted request with APM portal access. | MEDIUM 5.9 | 1.3 % | ||
| CVE-2018-15316 | 13.0.0-13.1.1.1 | In F5 BIG-IP APM 13.0.0-13.1.1.1, APM Client 7.1.5-7.1.6, and/or Edge Client 7101-7160, the BIG-IP APM Edge Client component loads the polic | MEDIUM 5.5 | 0.6 % | ||
| CVE-2018-5549 | 11.6.0-11.6.3.1, 12.1.0-12.1.3.3, 13.0.0, 13.1.0-13.1.0.3 | On BIG-IP APM 11.6.0-11.6.3.1, 12.1.0-12.1.3.3, 13.0.0, and 13.1.0-13.1.0.3, APMD may core when processing SAML Assertion or response contai | HIGH 7.5 | 1.8 % | ||
| CVE-2018-5548 | 11.6.0-11.6.3 | On BIG-IP APM 11.6.0-11.6.3, an insecure AES ECB mode is used for orig_uri parameter in an undisclosed /vdesk link of APM virtual server con | MEDIUM 6.1 | 1.4 % | ||
| CVE-2018-15310 | 11.5.1-11.5.7, 11.6.0-11.6.3, 12.1.0-12.1.3 | A vulnerability in BIG-IP APM portal access 11.5.1-11.5.7, 11.6.0-11.6.3, and 12.1.0-12.1.3 discloses the BIG-IP software version in rewritt | MEDIUM 4.3 | 0.9 % | ||
| CVE-2018-5544 | 13.0.0-13.1.1 ; 12.1.0-12.1.3 | When the F5 BIG-IP APM 13.0.0-13.1.1 or 12.1.0-12.1.3 renders certain pages (pages with a logon agent or a confirm box), the BIG-IP APM may | HIGH 7.5 | 2.4 % | ||
| CVE-2018-5536 | 13.0.0-13.1.0.7 ; 12.1.0-12.1.3.5 | A remote attacker via undisclosed measures, may be able to exploit an F5 BIG-IP APM 13.0.0-13.1.0.7 or 12.1.0-12.1.3.5 virtual server config | HIGH 7.5 | 2.3 % | ||
| CVE-2018-5528 | 13.1.0.4-13.1.0.7, 13.0.1 | Under certain conditions, TMM may restart and produce a core file while processing APM data on BIG-IP 13.0.1 or 13.1.0.4-13.1.0.7. | MEDIUM 5.3 | 1.2 % | ||
| CVE-2017-6139 | 13.0.0 ; 12.1.2 | In F5 BIG-IP APM software version 13.0.0 and 12.1.2, under rare conditions, the BIG-IP APM system appends log details when responding to cli | MEDIUM 5.9 | 1.7 % | ||
| CVE-2017-6129 | 13.0.0 ; 12.1.2 | In F5 BIG-IP APM software version 13.0.0 and 12.1.2, in some circumstances, APM tunneled VPN flows can cause a VPN/PPP connflow to be premat | HIGH 7.5 | 1.6 % | ||
| CVE-2017-0301 | 11.5.0, 11.5.1, 11.5.2, 11.5.3, 11.5.4 ; 11.6.0, 11.6.1 ; 12.0.0, 12.1.0, 12.1.1, 12.1.2 | In F5 BIG-IP APM software versions 11.5.0, 11.5.1, 11.5.2, 11.5.3, 11.5.4, 11.6.0, 11.6.1, 12.0.0, 12.1.0, 12.1.1 and 12.1.2 BIG-IP APM port | HIGH 7.6 | 0.5 % | ||
| CVE-2017-0302 | 13.0.0 ; 12.0.0 - 12.1.2 | In F5 BIG-IP APM 12.0.0 through 12.1.2 and 13.0.0, an authenticated user with an established access session to the BIG-IP APM system may be | MEDIUM 5.3 | 0.7 % | ||
| CVE-2016-9257 | 12.0.0 through 12.1.2 | In F5 BIG-IP APM 12.0.0 through 12.1.2, non-authenticated users may be able to inject JavaScript into a request that will then be rendered a | MEDIUM 6.1 | 0.8 % |