# cve.now: F5 Networks, Inc.

The newest entries naming F5 Networks, Inc. as an affected vendor (up to 200), of 154 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2019-6649](https://cve.now/CVE-2019-6649.md): F5 BIG-IP 15.0.0, 14.1.0-14.1.0.6, 14.0.0-14.0.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.1, 11.6.0-11.6.4, and 11.5.1-11.5.9 and Enterprise Manage (no CVSS)
- [CVE-2019-6650](https://cve.now/CVE-2019-6650.md): F5 BIG-IP ASM 15.0.0, 14.1.0-14.1.0.6, 14.0.0-14.0.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.1, 11.6.0-11.6.4, and 11.5.1-11.5.9 may expose sensit (no CVSS)
- [CVE-2019-6601](https://cve.now/CVE-2019-6601.md): In BIG-IP 13.0.0, 12.1.0-12.1.3.7, 11.6.1-11.6.3.2, or 11.5.1-11.5.8, the Application Acceleration Manager (AAM) wamd process used in proces (no CVSS)
- [CVE-2019-6600](https://cve.now/CVE-2019-6600.md): In BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.3, 12.1.0-12.1.3.7, 11.6.1-11.6.3.2, or 11.5.1-11.5.8, when remote authentication is enabled for ad (no CVSS)
- [CVE-2019-6599](https://cve.now/CVE-2019-6599.md): In BIG-IP 11.6.1-11.6.3.2 or 11.5.1-11.5.8, or Enterprise Manager 3.1.1, improper escaping of values in an undisclosed page of the configura (no CVSS)
- [CVE-2019-6598](https://cve.now/CVE-2019-6598.md): In BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.0.7, 12.1.0-12.1.3.5, 11.6.1-11.6.3.2, or 11.5.1-11.5.8 or Enterprise Manager 3.1.1, malformed reques (no CVSS)
- [CVE-2019-6597](https://cve.now/CVE-2019-6597.md): In BIG-IP 13.0.0-13.1.1.1, 12.1.0-12.1.3.7, 11.6.1-11.6.3.2, or 11.5.1-11.5.8 or Enterprise Manager 3.1.1, when authenticated administrative (no CVSS)
- [CVE-2019-6596](https://cve.now/CVE-2019-6596.md): In BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.1, 12.1.0-12.1.3.6, 11.6.1-11.6.3.2, or 11.5.1-11.5.8, when processing fragmented ClientHello messa (no CVSS)
- [CVE-2019-6595](https://cve.now/CVE-2019-6595.md): Cross-site scripting (XSS) vulnerability in F5 BIG-IP Access Policy Manager (APM) 11.5.x and 11.6.x Admin Web UI. (no CVSS)
- [CVE-2019-6594](https://cve.now/CVE-2019-6594.md): On BIG-IP 11.5.1-11.6.3.2, 12.1.3.4-12.1.3.7, 13.0.0 HF1-13.1.1.1, and 14.0.0-14.0.0.2, Multi-Path TCP (MPTCP) does not protect against mult (no CVSS)
- [CVE-2019-6593](https://cve.now/CVE-2019-6593.md): On BIG-IP 11.5.1-11.5.4, 11.6.1, and 12.1.0, a virtual server configured with a Client SSL profile may be vulnerable to a chosen ciphertext (no CVSS)
- [CVE-2019-6592](https://cve.now/CVE-2019-6592.md): On BIG-IP 14.1.0-14.1.0.1, TMM may restart and produce a core file when validating SSL certificates in client SSL or server SSL profiles. (no CVSS)
- [CVE-2019-6589](https://cve.now/CVE-2019-6589.md): On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.3, 12.1.0-12.1.3.7, and 11.6.0-11.6.3.2, a reflected Cross Site Scripting (XSS) vulnerability is pr (no CVSS)
- [CVE-2019-6590](https://cve.now/CVE-2019-6590.md): On BIG-IP LTM 13.0.0 to 13.0.1 and 12.1.0 to 12.1.3.6, under certain conditions, the TMM may consume excessive resources when processing SSL (no CVSS)
- [CVE-2019-6591](https://cve.now/CVE-2019-6591.md): On BIG-IP APM 14.0.0 to 14.0.0.4, 13.0.0 to 13.1.1.3 and 12.1.0 to 12.1.3.7, a reflected cross-site scripting (XSS) vulnerability exists in (no CVSS)
- [CVE-2018-15335](https://cve.now/CVE-2018-15335.md): When APM 13.0.0-13.1.x is deployed as an OAuth Resource Server, APM becomes a client application to an external OAuth authorization server. (no CVSS)
- [CVE-2018-15334](https://cve.now/CVE-2018-15334.md): A cross-site request forgery (CSRF) vulnerability in the APM webtop 11.2.1 or greater may allow attacker to force an APM webtop session to l (no CVSS)
- [CVE-2018-15333](https://cve.now/CVE-2018-15333.md): On versions 11.2.1. (no CVSS)
- [CVE-2018-15331](https://cve.now/CVE-2018-15331.md): On BIG-IP AAM 13.0.0 or 12.1.0-12.1.3.7, the dcdb\_convert utility used by BIG-IP AAM fails to drop group permissions when executing helper s (no CVSS)
- [CVE-2018-15330](https://cve.now/CVE-2018-15330.md): On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.1, or 12.1.0-12.1.3.7, when a virtual server using the inflate functionality to process a gzip bomb (no CVSS)
- [CVE-2018-15329](https://cve.now/CVE-2018-15329.md): On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.1, or 12.1.0-12.1.3.7, or Enterprise Manager 3.1.1, when authenticated administrative users run com (no CVSS)
- [CVE-2018-15328](https://cve.now/CVE-2018-15328.md): On BIG-IP 14.0.x, 13.x, 12.x, and 11.x, Enterprise Manager 3.1.1, BIG-IQ 6.x, 5.x, and 4.x, and iWorkflow 2.x, the passphrases for SNMPv3 us (no CVSS)
- [CVE-2018-15332](https://cve.now/CVE-2018-15332.md): The svpn component of the F5 BIG-IP APM client prior to version 7.1.7.2 for Linux and macOS runs as a privileged process and can allow an un (no CVSS)
- [CVE-2018-15327](https://cve.now/CVE-2018-15327.md): In BIG-IP 14.0.0-14.0.0.2 or 13.0.0-13.1.1.1 or Enterprise Manager 3.1.1, when authenticated administrative users run commands in the Traffi (no CVSS)
- [CVE-2018-15326](https://cve.now/CVE-2018-15326.md): In some situations on BIG-IP APM 14.0.0-14.0.0.2, 13.0.0-13.1.0.7, 12.1.0-12.1.3.5, or 11.6.0-11.6.3.2, the CRLDP Auth access policy agent m (no CVSS)
- [CVE-2018-15325](https://cve.now/CVE-2018-15325.md): In BIG-IP 14.0.0-14.0.0.2 or 13.0.0-13.1.1.1, iControl and TMSH usage by authenticated users may leak a small amount of memory when executin (no CVSS)
- [CVE-2018-15324](https://cve.now/CVE-2018-15324.md): On BIG-IP APM 14.0.0-14.0.0.2 or 13.0.0-13.1.1.1, TMM may restart when processing a specially crafted request with APM portal access. (no CVSS)
- [CVE-2018-15323](https://cve.now/CVE-2018-15323.md): On BIG-IP 14.0.0-14.0.0.2 or 13.0.0-13.1.1.1, in certain circumstances, when processing traffic through a Virtual Server with an associated (no CVSS)
- [CVE-2018-15322](https://cve.now/CVE-2018-15322.md): On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.0.7, 12.1.0-12.1.3.5, 11.6.0-11.6.3.2, or 11.2.1-11.5.6, BIG-IQ Centralized Management 6.0.0-6.0.1, 5 (no CVSS)
- [CVE-2018-15321](https://cve.now/CVE-2018-15321.md): When BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.0.5, 12.1.0-12.1.3.5, 11.6.0-11.6.3.2, or 11.2.1-11.5.6, BIG-IQ Centralized Management 5.0.0-5.4.0 (no CVSS)
- [CVE-2018-15320](https://cve.now/CVE-2018-15320.md): On BIG-IP 14.0.0-14.0.0.2 or 13.0.0-13.1.1.1, undisclosed traffic patterns may lead to denial of service conditions for the BIG-IP system. (no CVSS)
- [CVE-2018-15319](https://cve.now/CVE-2018-15319.md): On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.1, or 12.1.0-12.1.3.6, malicious requests made to virtual servers with an HTTP profile can cause th (no CVSS)
- [CVE-2018-15318](https://cve.now/CVE-2018-15318.md): In BIG-IP 14.0.0-14.0.0.2, 13.1.0.4-13.1.1.1, or 12.1.3.4-12.1.3.6, If an MPTCP connection receives an abort signal while the initial flow i (no CVSS)
- [CVE-2018-15317](https://cve.now/CVE-2018-15317.md): In BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.5, 12.1.0-12.1.4.1, and 11.2.1-11.6.3.2, an attacker sending specially crafted SSL records to a SSL (no CVSS)
- [CVE-2018-15316](https://cve.now/CVE-2018-15316.md): In F5 BIG-IP APM 13.0.0-13.1.1.1, APM Client 7.1.5-7.1.6, and/or Edge Client 7101-7160, the BIG-IP APM Edge Client component loads the polic (no CVSS)
- [CVE-2018-15315](https://cve.now/CVE-2018-15315.md): On F5 BIG-IP 13.0.0-13.1.1.1 and 12.1.0-12.1.3.6, there is a reflected Cross Site Scripting (XSS) vulnerability in an undisclosed Configurat (no CVSS)
- [CVE-2018-15314](https://cve.now/CVE-2018-15314.md): On F5 BIG-IP AFM 13.0.0-13.1.1.1 and 12.1.0-12.1.3.6, there is a Reflected Cross Site Scripting vulnerability in undisclosed TMUI page. (no CVSS)
- [CVE-2018-15313](https://cve.now/CVE-2018-15313.md): On F5 BIG-IP AFM 13.0.0-13.1.1.1 and 12.1.0-12.1.3.6, there is a Reflected Cross Site Scripting vulnerability in undisclosed TMUI page. (no CVSS)
- [CVE-2018-15312](https://cve.now/CVE-2018-15312.md): On F5 BIG-IP 13.0.0-13.1.1.1 and 12.1.0-12.1.3.6, a reflected Cross-Site Scripting (XSS) vulnerability exists in an undisclosed page of the (no CVSS)
- [CVE-2018-15311](https://cve.now/CVE-2018-15311.md): When F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.3.5, 11.6.0-11.6.3.2, or 11.5.1-11.5.6 is processing specially crafted TCP traffic with the Larg (no CVSS)
- [CVE-2016-7475](https://cve.now/CVE-2016-7475.md): Under some circumstances on BIG-IP 12.0.0-12.1.0, 11.6.0-11.6.1, or 11.4.0-11.5.4 HF1, the Traffic Management Microkernel (TMM) may not prop (no CVSS)
- [CVE-2018-5549](https://cve.now/CVE-2018-5549.md): On BIG-IP APM 11.6.0-11.6.3.1, 12.1.0-12.1.3.3, 13.0.0, and 13.1.0-13.1.0.3, APMD may core when processing SAML Assertion or response contai (no CVSS)
- [CVE-2018-5548](https://cve.now/CVE-2018-5548.md): On BIG-IP APM 11.6.0-11.6.3, an insecure AES ECB mode is used for orig\_uri parameter in an undisclosed /vdesk link of APM virtual server con (no CVSS)
- [CVE-2018-5545](https://cve.now/CVE-2018-5545.md): On F5 WebSafe Alert Server 1.0.0-4.2.6, a malicious, authenticated user can execute code on the alert server by using a maliciously crafted (no CVSS)
- [CVE-2018-15310](https://cve.now/CVE-2018-15310.md): A vulnerability in BIG-IP APM portal access 11.5.1-11.5.7, 11.6.0-11.6.3, and 12.1.0-12.1.3 discloses the BIG-IP software version in rewritt (no CVSS)
- [CVE-2018-5547](https://cve.now/CVE-2018-5547.md): Windows Logon Integration feature of F5 BIG-IP APM client prior to version 7.1.7.1 for Windows by default uses Legacy logon mode which uses (no CVSS)
- [CVE-2018-5546](https://cve.now/CVE-2018-5546.md): The svpn and policyserver components of the F5 BIG-IP APM client prior to version 7.1.7.1 for Linux and macOS runs as a privileged process a (no CVSS)
- [CVE-2018-5544](https://cve.now/CVE-2018-5544.md): When the F5 BIG-IP APM 13.0.0-13.1.1 or 12.1.0-12.1.3 renders certain pages (pages with a logon agent or a confirm box), the BIG-IP APM may (no CVSS)
- [CVE-2018-5543](https://cve.now/CVE-2018-5543.md): The F5 BIG-IP Controller for Kubernetes 1.0.0-1.5.0 (k8s-bigip-crtl) passes BIG-IP username and password as command line parameters, which m (no CVSS)
- [CVE-2018-5542](https://cve.now/CVE-2018-5542.md): F5 BIG-IP 13.0.0-13.0.1, 12.1.0-12.1.3.6, or 11.2.1-11.6.3.2 HTTPS health monitors do not validate the identity of the monitored server. (no CVSS)
- [CVE-2018-5541](https://cve.now/CVE-2018-5541.md): When F5 BIG-IP ASM 13.0.0-13.1.0.1, 12.1.0-12.1.3.5, 11.6.0-11.6.3.1, or 11.5.1-11.5.6 is processing HTTP requests, an unusually large numbe (no CVSS)
- [CVE-2018-5539](https://cve.now/CVE-2018-5539.md): Under certain conditions, on F5 BIG-IP ASM 13.0.0-13.1.0.7, 12.1.0-12.1.3.5, 11.6.0-11.6.3.1, 11.5.1-11.5.6, or 11.2.1, when processing CSRF (no CVSS)
- [CVE-2018-5538](https://cve.now/CVE-2018-5538.md): On F5 BIG-IP DNS 13.1.0-13.1.0.7, 12.1.3-12.1.3.5, DNS Express / DNS Zones accept NOTIFY messages on the management interface from source IP (no CVSS)
- [CVE-2018-5537](https://cve.now/CVE-2018-5537.md): A remote attacker may be able to disrupt services on F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.3.5, 11.6.0-11.6.3.1, or 11.2.1-11.5.6 if the TM (no CVSS)
- [CVE-2018-5536](https://cve.now/CVE-2018-5536.md): A remote attacker via undisclosed measures, may be able to exploit an F5 BIG-IP APM 13.0.0-13.1.0.7 or 12.1.0-12.1.3.5 virtual server config (no CVSS)
- [CVE-2018-5531](https://cve.now/CVE-2018-5531.md): Through undisclosed methods, on F5 BIG-IP 13.0.0-13.1.0.7, 12.1.0-12.1.3.5, 11.6.0-11.6.3.1, or 11.2.1-11.5.6, adjacent network attackers ca (no CVSS)
- [CVE-2018-5530](https://cve.now/CVE-2018-5530.md): F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.3.5, or 11.6.0-11.6.3.1 virtual servers with HTTP/2 profiles enabled are vulnerable to "HPACK Bomb". (no CVSS)
- [CVE-2018-5540](https://cve.now/CVE-2018-5540.md): On F5 BIG-IP 13.0.0-13.0.1, 12.1.0-12.1.3.3, 11.6.0-11.6.3.1, or 11.5.1-11.5.6, Enterprise Manager 3.1.1, BIG-IQ Centralized Management 5.0. (no CVSS)
- [CVE-2018-5535](https://cve.now/CVE-2018-5535.md): On F5 BIG-IP 14.0.0, 13.0.0-13.1.0, 12.1.0-12.1.3, or 11.5.1-11.6.3 specifically crafted HTTP responses, when processed by a Virtual Server (no CVSS)
- [CVE-2018-5534](https://cve.now/CVE-2018-5534.md): Under certain conditions on F5 BIG-IP 13.1.0-13.1.0.5, 13.0.0, 12.1.0-12.1.3.1, 11.6.0-11.6.3.1, or 11.5.0-11.5.6, TMM may core while proces (no CVSS)
- [CVE-2018-5533](https://cve.now/CVE-2018-5533.md): Under certain conditions on F5 BIG-IP 13.0.0, 12.1.0-12.1.2, 11.6.0-11.6.3.1, or 11.5.0-11.5.6, TMM may core while processing SSL forward pr (no CVSS)
- [CVE-2018-5532](https://cve.now/CVE-2018-5532.md): On F5 BIG-IP 13.0.0, 12.1.0-12.1.2, 11.6.0-11.6.3.1, or 11.2.1-11.5.6 a domain name cached within the DNS Cache of TMM may continue to be re (no CVSS)
- [CVE-2018-5529](https://cve.now/CVE-2018-5529.md): The svpn component of the F5 BIG-IP APM client prior to version 7.1.7 for Linux and Mac OS X runs as a privileged process and can allow an u (no CVSS)
- [CVE-2018-5528](https://cve.now/CVE-2018-5528.md): Under certain conditions, TMM may restart and produce a core file while processing APM data on BIG-IP 13.0.1 or 13.1.0.4-13.1.0.7. (no CVSS)
- [CVE-2018-5527](https://cve.now/CVE-2018-5527.md): On BIG-IP 13.1.0-13.1.0.7, a remote attacker using undisclosed methods against virtual servers configured with a Client SSL or Server SSL pr (no CVSS)
- [CVE-2018-5526](https://cve.now/CVE-2018-5526.md): Under certain conditions, on F5 BIG-IP ASM 13.1.0-13.1.0.5, Behavioral DOS (BADOS) protection may fail during an attack. (no CVSS)
- [CVE-2018-5525](https://cve.now/CVE-2018-5525.md): A local file vulnerability exists in the F5 BIG-IP Configuration utility on versions 13.0.0, 12.1.0-12.1.2, 11.6.1-11.6.3.1, 11.5.1-11.5.5, (no CVSS)
- [CVE-2018-5524](https://cve.now/CVE-2018-5524.md): Under certain conditions, on F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.3.1, or 11.6.1 HF2-11.6.3.1, virtual servers configured with Client SSL (no CVSS)
- [CVE-2018-5523](https://cve.now/CVE-2018-5523.md): On F5 BIG-IP 13.1.0-13.1.0.3, 13.0.0, 12.1.0-12.1.3.1, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1 and Enterprise Manager 3.1.1, when authenti (no CVSS)
- [CVE-2018-5522](https://cve.now/CVE-2018-5522.md): On F5 BIG-IP 13.0.0, 12.0.0-12.1.2, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1, when processing DIAMETER transactions with carefully crafted (no CVSS)
- [CVE-2018-5521](https://cve.now/CVE-2018-5521.md): On F5 BIG-IP 12.1.0-12.1.3.1, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1, carefully crafted URLs can be used to reflect arbitrary content int (no CVSS)
- [CVE-2018-5513](https://cve.now/CVE-2018-5513.md): On F5 BIG-IP 13.1.0-13.1.0.3, 13.0.0, 12.1.0-12.1.3.3, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1, a malformed TLS handshake causes TMM to cr (no CVSS)
- [CVE-2017-6153](https://cve.now/CVE-2017-6153.md): Features in F5 BIG-IP 13.0.0-13.1.0.3, 12.1.0-12.1.3.1, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1 system that utilizes inflate functionality (no CVSS)
- [CVE-2018-5520](https://cve.now/CVE-2018-5520.md): On an F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.3.1, or 11.2.1-11.6.3.1 system configured in Appliance mode, the TMOS Shell (tmsh) may allow an (no CVSS)
- [CVE-2018-5519](https://cve.now/CVE-2018-5519.md): On F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.3.3, or 11.2.1-11.6.3.1, administrative users by way of undisclosed methods can exploit the ssldum (no CVSS)
- [CVE-2018-5518](https://cve.now/CVE-2018-5518.md): On F5 BIG-IP 13.0.0-13.1.0.5 or 12.0.0-12.1.3.3, malicious root users with access to a VCMP guest can cause a disruption of service on adjac (no CVSS)
- [CVE-2018-5517](https://cve.now/CVE-2018-5517.md): On F5 BIG-IP 13.1.0-13.1.0.5, malformed TCP packets sent to a self IP address or a FastL4 virtual server may cause an interruption of servic (no CVSS)
- [CVE-2018-5516](https://cve.now/CVE-2018-5516.md): On F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.2, or 11.2.1-11.6.3.1, Enterprise Manager 3.1.1, BIG-IQ Centralized Management 5.0.0-5.4.0 or 4.6. (no CVSS)
- [CVE-2018-5515](https://cve.now/CVE-2018-5515.md): On F5 BIG-IP 13.0.0-13.1.0.5, using RADIUS authentication responses from a RADIUS server with IPv6 addresses may cause TMM to crash, leading (no CVSS)
- [CVE-2018-5514](https://cve.now/CVE-2018-5514.md): On F5 BIG-IP 13.1.0-13.1.0.5, maliciously crafted HTTP/2 request frames can lead to denial of service. (no CVSS)
- [CVE-2018-5512](https://cve.now/CVE-2018-5512.md): On F5 BIG-IP 13.1.0-13.1.0.5, when Large Receive Offload (LRO) and SYN cookies are enabled (default settings), undisclosed traffic patterns (no CVSS)
- [CVE-2018-5511](https://cve.now/CVE-2018-5511.md): On F5 BIG-IP 13.1.0-13.1.0.3 or 13.0.0, when authenticated administrative users execute commands in the Traffic Management User Interface (T (no CVSS)
- [CVE-2018-5510](https://cve.now/CVE-2018-5510.md): On F5 BIG-IP 11.5.4 HF4-11.5.5, the Traffic Management Microkernel (TMM) may restart when processing a specific sequence of packets on IPv6 (no CVSS)
- [CVE-2018-5508](https://cve.now/CVE-2018-5508.md): On F5 BIG-IP PEM versions 13.0.0, 12.0.0-12.1.3.1, 11.6.0-11.6.2, 11.5.1-11.5.5, or 11.2.1, under certain conditions, TMM may crash when pro (no CVSS)
- [CVE-2018-5507](https://cve.now/CVE-2018-5507.md): On F5 BIG-IP versions 13.0.0, 12.1.0-12.1.3.1, 11.6.1-11.6.2, or 11.5.1-11.5.5, vCMP guests running on VIPRION 2100, 4200 and 4300 series bl (no CVSS)
- [CVE-2018-5506](https://cve.now/CVE-2018-5506.md): In F5 BIG-IP 13.0.0, 12.1.0-12.1.2, 11.6.1, 11.5.1-11.5.5, or 11.2.1 the Apache modules apache\_auth\_token\_mod and mod\_auth\_f5\_auth\_token.cpp (no CVSS)
- [CVE-2017-6158](https://cve.now/CVE-2017-6158.md): In F5 BIG-IP 12.0.0-12.1.2, 11.6.0-11.6.1, 11.5.1-11.5.5, or 11.2.1 there is a vulnerability in TMM related to handling of invalid IP addres (no CVSS)
- [CVE-2017-6156](https://cve.now/CVE-2017-6156.md): When the F5 BIG-IP 12.1.0-12.1.1, 11.6.0-11.6.1, 11.5.1-11.5.5, or 11.2.1 system is configured with a wildcard IPSec tunnel endpoint, it may (no CVSS)
- [CVE-2017-6155](https://cve.now/CVE-2017-6155.md): On F5 BIG-IP 13.0.0, 12.0.0-12.1.3.1, 11.6.0-11.6.2, 11.4.1-11.5.5, or 11.2.1, malformed SPDY or HTTP/2 requests may result in a disruption (no CVSS)
- [CVE-2017-6148](https://cve.now/CVE-2017-6148.md): Responses to SOCKS proxy requests made through F5 BIG-IP version 13.0.0, 12.0.0-12.1.3.1, 11.6.1-11.6.2, or 11.5.1-11.5.5 may cause a disrup (no CVSS)
- [CVE-2017-6143](https://cve.now/CVE-2017-6143.md): X509 certificate verification was not correctly implemented in the IP Intelligence Subscription and IP Intelligence feed-list features, and (no CVSS)
- [CVE-2016-7472](https://cve.now/CVE-2016-7472.md): F5 BIG-IP ASM version 12.1.0 - 12.1.1 may allow remote attackers to cause a denial of service (DoS) via a crafted HTTP request. (no CVSS)
- [CVE-2018-5509](https://cve.now/CVE-2018-5509.md): On F5 BIG-IP versions 13.0.0 or 12.1.0 - 12.1.3.1, when a specifically configured virtual server receives traffic of an undisclosed nature, (no CVSS)
- [CVE-2018-5505](https://cve.now/CVE-2018-5505.md): On F5 BIG-IP versions 13.1.0 - 13.1.0.3, when ASM and AVR are both provisioned, TMM may restart while processing DNS requests when the virtu (no CVSS)
- [CVE-2018-5504](https://cve.now/CVE-2018-5504.md): In some circumstances, the Traffic Management Microkernel (TMM) does not properly handle certain malformed Websockets requests/responses, wh (no CVSS)
- [CVE-2018-5503](https://cve.now/CVE-2018-5503.md): On F5 BIG-IP versions 13.0.0 - 13.1.0.3 or 12.0.0 - 12.1.3.1, TMM may restart when processing a specifically crafted page through a virtual (no CVSS)
- [CVE-2018-5502](https://cve.now/CVE-2018-5502.md): On F5 BIG-IP versions 13.0.0 - 13.1.0.3, attackers may be able to disrupt services on the BIG-IP system with maliciously crafted client cert (no CVSS)
- [CVE-2017-6152](https://cve.now/CVE-2017-6152.md): A local user on F5 BIG-IQ Centralized Management 5.1.0-5.2.0 with the Access Manager role has privileges to change the passwords of other us (no CVSS)
- [CVE-2018-5501](https://cve.now/CVE-2018-5501.md): In some circumstances, on F5 BIG-IP systems running 13.0.0, 12.1.0 - 12.1.3.1, any 11.6.x or 11.5.x release, or 11.2.1, TCP DNS profile allo (no CVSS)
- [CVE-2018-5500](https://cve.now/CVE-2018-5500.md): On F5 BIG-IP systems running 13.0.0, 12.1.0 - 12.1.3.1, or 11.6.1 - 11.6.2, every Multipath TCP (MCTCP) connection established leaks a small (no CVSS)
- [CVE-2017-6154](https://cve.now/CVE-2017-6154.md): On F5 BIG-IP systems running 13.0.0, 12.1.0 - 12.1.3.1, or 11.6.1 - 11.6.2, the BIG-IP ASM bd daemon may core dump memory under some circums (no CVSS)
- [CVE-2017-6150](https://cve.now/CVE-2017-6150.md): Under certain conditions for F5 BIG-IP systems 13.0.0 or 12.1.0 - 12.1.3.1, using FastL4 profiles, when the Reassemble IP Fragments option i (no CVSS)
- [CVE-2017-6169](https://cve.now/CVE-2017-6169.md): In versions 13.0.0, 12.0.0-12.1.3, or 11.6.0-11.6.2, an F5 BIG-IP virtual server using the URL categorization feature may cause the Traffic (no CVSS)
- [CVE-2017-6142](https://cve.now/CVE-2017-6142.md): X509 certificate verification was not correctly implemented in the early access "user id" feature in the F5 BIG-IP Advanced Firewall Manager (no CVSS)
- [CVE-2017-6167](https://cve.now/CVE-2017-6167.md): In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM and WebSafe software version 13.0.0 and 12.1.0 - 12.1.2, race con (no CVSS)
- [CVE-2017-6164](https://cve.now/CVE-2017-6164.md): In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, WebAccelerator and WebSafe software version 1 (no CVSS)
- [CVE-2017-6151](https://cve.now/CVE-2017-6151.md): In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, WebAccelerator and WebSafe software version 1 (no CVSS)
- [CVE-2017-6140](https://cve.now/CVE-2017-6140.md): On the BIG-IP 2000s, 2200s, 4000s, 4200v, i5600, i5800, i7600, i7800, i10600,i10800, and VIPRION 4450 blades, running version 11.5.0, 11.5.1 (no CVSS)
- [CVE-2017-6139](https://cve.now/CVE-2017-6139.md): In F5 BIG-IP APM software version 13.0.0 and 12.1.2, under rare conditions, the BIG-IP APM system appends log details when responding to cli (no CVSS)
- [CVE-2017-6138](https://cve.now/CVE-2017-6138.md): In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and WebSafe software version 13.0.0 and 12.1.0 - 12.1.2, mal (no CVSS)
- [CVE-2017-6136](https://cve.now/CVE-2017-6136.md): In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and WebSafe software version 13.0.0 and 12.0.0 - 12.1.2, und (no CVSS)
- [CVE-2017-6135](https://cve.now/CVE-2017-6135.md): In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and WebSafe software version 13.0.0, a slow memory leak as a (no CVSS)
- [CVE-2017-6134](https://cve.now/CVE-2017-6134.md): In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and WebSafe software version 13.0.0, 12.1.0 - 12.1.2 and 11. (no CVSS)
- [CVE-2017-6133](https://cve.now/CVE-2017-6133.md): In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM and WebSafe software version 13.0.0 and 12.1.0 - 12.1.2, undisclo (no CVSS)
- [CVE-2017-6132](https://cve.now/CVE-2017-6132.md): In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and Websafe software version 13.0.0, 12.0.0 to 12.1.2, 11.6. (no CVSS)
- [CVE-2017-6129](https://cve.now/CVE-2017-6129.md): In F5 BIG-IP APM software version 13.0.0 and 12.1.2, in some circumstances, APM tunneled VPN flows can cause a VPN/PPP connflow to be premat (no CVSS)
- [CVE-2017-0304](https://cve.now/CVE-2017-0304.md): A SQL injection vulnerability exists in the BIG-IP AFM management UI on versions 12.0.0, 12.1.0, 12.1.1, 12.1.2 and 13.0.0 that may allow a (no CVSS)
- [CVE-2017-0301](https://cve.now/CVE-2017-0301.md): In F5 BIG-IP APM software versions 11.5.0, 11.5.1, 11.5.2, 11.5.3, 11.5.4, 11.6.0, 11.6.1, 12.0.0, 12.1.0, 12.1.1 and 12.1.2 BIG-IP APM port (no CVSS)
- [CVE-2017-6166](https://cve.now/CVE-2017-6166.md): In BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, and WebSafe software 12.0.0 to 12.1.1, in some cases the Traffic Ma (no CVSS)
- [CVE-2017-6163](https://cve.now/CVE-2017-6163.md): In F5 BIG-IP LTM, AAM, AFM, APM, ASM, Link Controller, PEM, PSM software version 12.0.0 to 12.1.2, 11.6.0 to 11.6.1, 11.4.0 to 11.5.4, when (no CVSS)
- [CVE-2017-6162](https://cve.now/CVE-2017-6162.md): In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, Websafe software version 12.0.0 to 12.1.2, 11 (no CVSS)
- [CVE-2017-6161](https://cve.now/CVE-2017-6161.md): In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, WebAccelerator software version 12.0.0 - 12.1 (no CVSS)
- [CVE-2017-6160](https://cve.now/CVE-2017-6160.md): In F5 BIG-IP AAM and PEM software version 12.0.0 to 12.1.1, 11.6.0 to 11.6.1, 11.4.1 to 11.5.4, a remote attacker may create maliciously cra (no CVSS)
- [CVE-2017-6159](https://cve.now/CVE-2017-6159.md): F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM, Websafe software version 12.0.0 to 12.1.2, 11.6.0 to 11.6.1 ar (no CVSS)
- [CVE-2017-6157](https://cve.now/CVE-2017-6157.md): In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and Websafe software version 12.0.0 to 12.1.1, 11.6.0 to 11. (no CVSS)
- [CVE-2017-0303](https://cve.now/CVE-2017-0303.md): In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and Websafe software version 13.0.0, 12.0.0 to 12.1.2 and 11 (no CVSS)
- [CVE-2017-6165](https://cve.now/CVE-2017-6165.md): In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM, and WebSafe 11.5.1 HF6 through 11.5.4 HF4, 11.6.0 through 1 (no CVSS)
- [CVE-2017-6145](https://cve.now/CVE-2017-6145.md): iControl REST in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, and WebSafe 12.0.0 through 12.1.2 and 13.0.0 inclu (no CVSS)
- [CVE-2017-6144](https://cve.now/CVE-2017-6144.md): In F5 BIG-IP PEM 12.1.0 through 12.1.2 when downloading the Type Allocation Code (TAC) database file via HTTPS, the server's certificate is (no CVSS)
- [CVE-2017-6141](https://cve.now/CVE-2017-6141.md): In F5 BIG-IP LTM, AAM, AFM, APM, ASM, Link Controller, PEM, and WebSafe 12.1.0 through 12.1.2, certain values in a TLS abbreviated handshake (no CVSS)
- [CVE-2017-6147](https://cve.now/CVE-2017-6147.md): In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, and WebSafe 12.1.2-HF1 and 13.0.0, an undisclosed type of respon (no CVSS)
- [CVE-2016-7469](https://cve.now/CVE-2016-7469.md): A stored cross-site scripting (XSS) vulnerability in the Configuration utility device name change page in BIG-IP LTM, AAM, AFM, Analytics, A (no CVSS)
- [CVE-2017-6131](https://cve.now/CVE-2017-6131.md): In some circumstances, an F5 BIG-IP version 12.0.0 to 12.1.2 and 13.0.0 Azure cloud instance may contain a default administrative password w (no CVSS)
- [CVE-2016-7476](https://cve.now/CVE-2016-7476.md): The Traffic Management Microkernel (TMM) in F5 BIG-IP LTM, AAM, AFM, APM, ASM, GTM, Link Controller, PEM, PSM, and WebSafe 11.6.0 before 11. (no CVSS)
- [CVE-2016-9250](https://cve.now/CVE-2016-9250.md): In F5 BIG-IP 11.2.1, 11.4.0 through 11.6.1, and 12.0.0 through 12.1.2, an unauthenticated user with access to the control plane may be able (no CVSS)
- [CVE-2017-6137](https://cve.now/CVE-2017-6137.md): In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, PSM, WebAccelerator, and WebSafe 11.6.1 HF1, (no CVSS)
- [CVE-2017-0302](https://cve.now/CVE-2017-0302.md): In F5 BIG-IP APM 12.0.0 through 12.1.2 and 13.0.0, an authenticated user with an established access session to the BIG-IP APM system may be (no CVSS)
- [CVE-2016-9257](https://cve.now/CVE-2016-9257.md): In F5 BIG-IP APM 12.0.0 through 12.1.2, non-authenticated users may be able to inject JavaScript into a request that will then be rendered a (no CVSS)
- [CVE-2016-9256](https://cve.now/CVE-2016-9256.md): In F5 BIG-IP 12.1.0 through 12.1.2, permissions enforced by iControl can lag behind the actual permissions assigned to a user if the role\_ma (no CVSS)
- [CVE-2016-9253](https://cve.now/CVE-2016-9253.md): In F5 BIG-IP 12.1.0 through 12.1.2, specific websocket traffic patterns may cause a disruption of service for virtual servers configured to (no CVSS)
- [CVE-2016-9251](https://cve.now/CVE-2016-9251.md): In F5 BIG-IP 12.0.0 through 12.1.2, an authenticated attacker may be able to cause an escalation of privileges through a crafted iControl RE (no CVSS)
- [CVE-2017-6128](https://cve.now/CVE-2017-6128.md): An attacker may be able to cause a denial-of-service (DoS) attack against the sshd component in F5 BIG-IP, Enterprise Manager, BIG-IQ, and i (no CVSS)
- [CVE-2016-7467](https://cve.now/CVE-2016-7467.md): The TMM SSO plugin in F5 BIG-IP APM 12.0.0 - 12.1.1, 11.6.0 - 11.6.1 HF1, 11.5.4 - 11.5.4 HF2, when configured as a SAML Identity Provider w (no CVSS)
- [CVE-2017-6130](https://cve.now/CVE-2017-6130.md): F5 SSL Intercept iApp 1.5.0 - 1.5.7 and SSL Orchestrator 2.0 is vulnerable to a Server-Side Request Forgery (SSRF) attack when deployed usin (no CVSS)
- [CVE-2017-0305](https://cve.now/CVE-2017-0305.md): F5 SSL Intercept iApp version 1.5.0 - 1.5.7 is vulnerable to an unauthenticated, remote attack that may allow modification of the BIG-IP sys (no CVSS)
- [CVE-2016-9252](https://cve.now/CVE-2016-9252.md): The Traffic Management Microkernel (TMM) in F5 BIG-IP before 11.5.4 HF3, 11.6.x before 11.6.1 HF2 and 12.x before 12.1.2 does not properly h (no CVSS)
- [CVE-2016-7474](https://cve.now/CVE-2016-7474.md): In some cases the MCPD binary cache in F5 BIG-IP devices may allow a user with Advanced Shell access, or privileges to generate a qkview, to (no CVSS)
- [CVE-2016-7468](https://cve.now/CVE-2016-7468.md): An unauthenticated remote attacker may be able to disrupt services on F5 BIG-IP 11.4.1 - 11.5.4 devices with maliciously crafted network tra (no CVSS)
- [CVE-2016-9245](https://cve.now/CVE-2016-9245.md): In F5 BIG-IP systems 12.1.0 - 12.1.2, malicious requests made to virtual servers with an HTTP profile can cause the TMM to restart. (no CVSS)
- [CVE-2016-6249](https://cve.now/CVE-2016-6249.md): F5 BIG-IP 12.0.0 and 11.5.0 - 11.6.1 REST requests which timeout during user account authentication may log sensitive attributes such as pas (no CVSS)
- [CVE-2016-9244](https://cve.now/CVE-2016-9244.md): A BIG-IP virtual server configured with a Client SSL profile that has the non-default Session Tickets option enabled may leak up to 31 bytes (no CVSS)
- [CVE-2016-9249](https://cve.now/CVE-2016-9249.md): An undisclosed traffic pattern received by a BIG-IP Virtual Server with TCP Fast Open enabled may cause the Traffic Management Microkernel ( (no CVSS)
- [CVE-2016-9247](https://cve.now/CVE-2016-9247.md): Under certain conditions for BIG-IP systems using a virtual server with an associated FastL4 profile and TCP analytics profile, a specific s (no CVSS)
- [CVE-2016-5024](https://cve.now/CVE-2016-5024.md): Virtual servers in F5 BIG-IP systems 11.6.1 before 11.6.1 HF1 and 12.1.x before 12.1.2, when configured to parse RADIUS messages via an iRul (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/f5-networks
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.