Browse CVEs

MEDIUM 6.5 CVE-2019-13617 njs through 0.3.3, used in NGINX, has a heap-based buffer over-read in nxt_vsprintf in nxt/nxt_sprintf.c during error handling, as demonstrated by an… Njs after 0.3.3 Fix from $1,6002019-07-16 HIGH 8.4 CVE-2019-6636 On BIG-IP (AFM, ASM) 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, and 11.5.1-11.6.4, a stored cross-site scripting vulnerability… Big Ip Advanced Firewall Manager 12.1.4.1 / 13.1.1.5+ Fix from $1,9502019-07-03 MEDIUM 6.5 CVE-2019-6634 On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, a high volume of malformed analytics report requests leads to instabi… Big Ip Local Traffic Manager 12.1.4.1 / 13.1.1.5+ Fix from $1,6002019-07-03 MEDIUM 6.5 CVE-2019-6637 On BIG-IP (ASM) 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, Application logic abuse of ASM REST endpoints can lead to insta… Big Ip Application Security Manager 12.1.4.1 / 13.1.1.5+ Fix from $1,6002019-07-03 MEDIUM 6.5 CVE-2019-6638 On BIG-IP 14.1.0-14.1.0.5 and 14.0.0-14.0.0.4, Malformed http requests made to an undisclosed iControl REST endpoint can lead to infinite loop of the… Big Ip Local Traffic Manager 14.0.0.5 / 14.1.0.6+ Fix from $1,6002019-07-03 MEDIUM 6.5 CVE-2019-6641 On BIG-IP 12.1.0-12.1.4.1, undisclosed requests can cause iControl REST processes to crash. The attack can only come from an authenticated user; all … Big Ip Access Policy Manager after 12.1.4 Fix from $1,6002019-07-03 MEDIUM 5.3 CVE-2019-6640 On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.1-11.5.8, SNMP exposes sensitive configuration … Big Ip Local Traffic Manager 11.5.9 / 11.6.3+ Fix from $1,6002019-07-03 MEDIUM 5.5 CVE-2019-6632 On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, under certain circumstances, attackers can decrypt configuration item… Big Ip Local Traffic Manager 12.1.4.1 / 13.1.1.5+ Fix from $1,6002019-07-03 HIGH 7.5 CVE-2019-6628 On BIG-IP PEM 14.1.0-14.1.0.5 and 14.0.0-14.0.0.4, under certain conditions, the TMM process may terminate and restart while processing BIG-IP PEM tr… Big Ip Policy Enforcement Manager after 14.1.0.5 Fix from $1,9502019-07-03 HIGH 7.5 CVE-2019-6629 On BIG-IP 14.1.0-14.1.0.5, undisclosed SSL traffic to a virtual server configured with a Client SSL profile may cause TMM to fail and restart. The Cl… Big Ip Local Traffic Manager after 14.1.0.5 Fix from $1,9502019-07-03 HIGH 7.5 CVE-2019-6630 On F5 SSL Orchestrator 14.1.0-14.1.0.5 and 14.0.0-14.0.0.4, undisclosed traffic flow may cause TMM to restart under certain circumstances. Ssl Orchestrator 14.0.0.5 / 14.1.0.6+ Fix from $1,9502019-07-03 HIGH 7.5 CVE-2019-6631 On BIG-IP 11.5.1-11.6.4, iRules performing HTTP header manipulation may cause an interruption to service when processing traffic handled by a Virtual… Big Ip Local Traffic Manager after 11.6.4 Fix from $1,9502019-07-03 MEDIUM 6.1 CVE-2019-6625 On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, and 11.5.1-11.6.4, a reflected cross-site scripting (XSS) vulnerability e… Big Ip Local Traffic Manager 12.1.4.1 / 13.1.1.5+ Fix from $1,6002019-07-03 MEDIUM 6.1 CVE-2019-6626 On BIG-IP (AFM, Analytics, ASM) 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, and 11.5.1-11.6.3.4, A reflected cross-site scripti… Big Ip Advanced Firewall Manager 12.1.4.1 / 13.1.1.5+ Fix from $1,6002019-07-03 MEDIUM 5.9 CVE-2019-6627 On F5 SSL Orchestrator 14.1.0-14.1.0.5, on rare occasions, specific to a certain race condition, TMM may restart when SSL Forward Proxy enforces the … Ssl Orchestrator 14.1.0.6+ Fix from $1,6002019-07-03 HIGH 7.5 CVE-2019-6623 On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, undisclosed traffic sent to BIG-IP iSession virtual server may cause … Big Ip Access Policy Manager after 14.1.0.5 Fix from $1,9502019-07-02 HIGH 7.5 CVE-2019-6624 On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, an undisclosed traffic pattern sent to a BIG-IP UDP virtual server ma… Big Ip Access Policy Manager after 14.1.0.5 Fix from $1,9502019-07-02 HIGH 7.2 CVE-2019-6620 On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.5, 13.0.0-13.1.1.4, 12.1.0-12.1.4.1, and 11.5.1-11.6.4 and BIG-IQ 6.0.0-6.1.0 and 5.1.0-5.4.0, an undisclose… Big Ip Access Policy Manager 13.1.1.5 / 14.1.0.6+ Fix from $1,9502019-07-02 HIGH 7.2 CVE-2019-6621 On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4.1, 11.6.1-11.6.3.4, and 11.5.2-11.5.8 and BIG-IQ 7.0.0-7.1.0.2, 6.0.0-6.1.… Big Ip Access Policy Manager 11.5.8 / 11.5.9+ Fix from $1,9502019-07-02 HIGH 7.2 CVE-2019-6622 On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.5, 13.0.0-13.1.1.4, 12.1.0-12.1.4.1, and 11.5.1-11.6.4, an undisclosed iControl REST worker is vulnerable to… Big Ip Access Policy Manager after 14.1.0.5 Fix from $1,9502019-07-02 HIGH 8.8 CVE-2019-6642 In BIG-IP 15.0.0, 14.0.0-14.1.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.2, and 11.5.2-11.6.4, BIG-IQ 6.0.0-6.1.0 and 5.1.0-5.4.0, iWorkflow 2.3.0, and Ente… Big Ip Access Policy Manager after 14.1.0.5 Fix from $1,9502019-07-01 MEDIUM 6.1 CVE-2016-5235 A Cross Site Scripting (XSS) vulnerability in versions of F5 WebSafe Dashboard 3.9.x and earlier, aka F5 WebSafe Alert Server, allows an unauthentica… Websafe Alert Server 4.0.0+ Fix from $1,6002019-07-01 MEDIUM 5.4 CVE-2016-5236 Cross-Site-Scripting (XSS) vulnerabilities in F5 WebSafe Dashboard 3.9.5 and earlier, aka F5 WebSafe Alert Server, allow privileged authenticated use… Websafe Alert Server after 3.9.5 Fix from $1,6002019-07-01 CRITICAL 9.8 CVE-2019-13067 njs through 0.3.3, used in NGINX, has a buffer over-read in nxt_utf8_decode in nxt/nxt_utf8.c. This issue occurs after the fix for CVE-2019-12207 is … Njs after 0.3.3 Fix from $2,3002019-06-30 CRITICAL 9.8 CVE-2019-12206 njs through 0.3.1, used in NGINX, has a heap-based buffer overflow in nxt_utf8_encode in nxt_utf8.c. Njs after 0.3.1 Fix from $2,3002019-05-20 CRITICAL 9.8 CVE-2019-12207 njs through 0.3.1, used in NGINX, has a heap-based buffer over-read in nxt_utf8_decode in nxt/nxt_utf8.c. Njs after 0.3.1 Fix from $2,3002019-05-20 CRITICAL 9.8 CVE-2019-12208 njs through 0.3.1, used in NGINX, has a heap-based buffer overflow in njs_function_native_call in njs/njs_function.c. Njs after 0.3.1 Fix from $2,3002019-05-20 CRITICAL 9.8 CVE-2019-11838 njs through 0.3.1, used in NGINX, has a heap-based buffer overflow in Array.prototype.splice after a resize, related to njs_array_prototype_splice in… Njs after 0.3.1 Fix from $2,3002019-05-09 CRITICAL 9.8 CVE-2019-11839 njs through 0.3.1, used in NGINX, has a heap-based buffer overflow in Array.prototype.push after a resize, related to njs_array_prototype_push in njs… Njs after 0.3.1 Fix from $2,3002019-05-09 HIGH 7.5 CVE-2019-11837 njs through 0.3.1, used in NGINX, has a segmentation fault in String.prototype.toBytes for negative arguments, related to nxt_utf8_next in nxt/nxt_ut… Njs after 0.3.1 Fix from $1,9502019-05-09