Skip to content
OpenAdvisories

Vendor

F5

586 known vulnerabilities.

Products

BIG-IP 264 BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator) 38 NGINX Plus 37 NGINX Open Source 35 BIG-IP APM 31 BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, WebAccelerator, WebSafe) 28 BIG-IP Next CNF 26 BIG-IP Next SPK 23 BIG-IQ 20 BIG-IP Next for Kubernetes 13 BIG-IP Edge Client 12 F5OS - Appliance 12 BIG-IP ASM 10 BIG-IQ Centralized Management 10 F5OS - Chassis 10 BIG-IP Next Central Manager 9 NGINX Ingress Controller 8 BIG-IP (AFM) 8 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM, WebSafe 7 NGINX JavaScript 6 NGINX Gateway Fabric 6 NGINX Instance Manager 5 Enterprise Manager 5 BIG-IP Next 4 BIG-IP APM Clients 4 F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, WebSafe 4 BIG-IP Guided Configuration (GC) 4 BIG-IP PEM 4 F5OS-A 4 NGINX Agent 3 BIG-IP DNS 3 BIG-IP Advanced WAF & ASM 3 IWorkflow 3 F5 Access 3 SSL Orchestrator 3 BIG-IP SPK 3 BIG-IP LTM, AAM, AFM, APM, ASM, Link Controller, PEM, Websafe 3 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, WebSafe 3 NGINX API Connectivity Manager 3 F5OS-C 3
All Critical High Medium Low Exploited only Public exploit

205 results · Clear filters · Feed

  • High 7.5
    CVE-2023-22323

    BIG-IP SSL OCSP Authentication profile vulnerability

    In BIP-IP versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all versions of 13.1.x, when OCSP authentication profile is configured on a virtual server, undisclosed requests can cause an increase in CP…

    F5 BIG-IP Network devices
  • High 7.5
    CVE-2023-22281

    BIG-IP AFM vulnerability

    On versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.8, 14.1.x before 14.1.5.3, and all versions of 13.1.x, when a BIG-IP AFM NAT policy with a destination NAT rule is configured on a FastL4 virtual server, undisclosed traffic can ca…

    F5 BIG-IP Network devices
  • High 8.7
    CVE-2022-41800 Public exploit Scanner template EPSS 77%

    Appliance mode iControl REST vulnerability

    In all versions of BIG-IP, when running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, utilizing an undisclosed iControl REST endpoint. A successful exploit can allow the attacker to…

    F5 BIG-IP Network devices
  • High 8.8
    CVE-2022-41622 Public exploit EPSS 92%

    iControl SOAP vulnerability

    In all versions,  BIG-IP and BIG-IQ are vulnerable to cross-site request forgery (CSRF) attacks through iControl SOAP.   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    F5 BIG-IP BIG-IQ Centralized Management Network devices
  • High 7.5
    CVE-2022-41836

    BIG-IP Advanced WAF and ASM bd vulnerability CVE-2022-41836

    When an 'Attack Signature False Positive Mode' enabled security policy is configured on a virtual server, undisclosed requests can cause the bd process to terminate.

    F5 BIG-IP Advanced WAF & ASM Network devices
  • High 7.3
    CVE-2022-41835

    F5OS vulnerability CVE-2022-41835

    In F5OS-A version 1.x before 1.1.0 and F5OS-C version 1.x before 1.5.0, excessive file permissions in F5OS allows an authenticated local attacker to execute limited set of commands in a container and impact the F5OS controller.

    F5 F5OS-A F5OS-C Network devices
  • High 7.5
    CVE-2022-41833

    BIG-IP iRule vulnerability CVE-2022-41833

    In all BIG-IP 13.1.x versions, when an iRule containing the HTTP::collect command is configured on a virtual server, undisclosed requests can cause Traffic Management Microkernel (TMM) to terminate.

    F5 BIG-IP Network devices
  • High 7.5
    CVE-2022-41832

    BIG-IP SIP vulnerability CVE-2022-41832

    In BIG-IP versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and 13.1.x before 13.1.5.1, when a SIP profile is configured on a virtual server, undisclosed messages can cause an increase in memory resource …

    F5 BIG-IP Network devices
  • High 7.5
    CVE-2022-41806

    BIG-IP AFM NAT64 Policy Vulnerability CVE-2022-41806

    In versions 16.1.x before 16.1.3.2 and 15.1.x before 15.1.5.1, when BIG-IP AFM Network Address Translation policy with IPv6/IPv4 translation rules is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization.

    F5 BIG-IP (AFM) Network devices
  • High 7.5
    CVE-2022-41787

    BIG-IP DNS Express vulnerability CVE-2022-41787

    In BIG-IP versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and 13.1.x before 13.1.5.1, when DNS profile is configured on a virtual server with DNS Express enabled, undisclosed DNS queries with DNSSEC can…

    F5 BIG-IP DNS BIG-IP LTM Network devices
  • High 7.0
    CVE-2022-41743

    NGINX ngx_http_hls_module vulnerability CVE-2022-41743

    NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngx_http_hls_module that might allow a local attacker to corrupt NGINX worker memory, resulting in its crash or potential other impact using a specially crafted audio or video fil…

    F5 NGINX Plus Network devices
  • High 7.1
    CVE-2022-41742

    NGINX ngx_http_mp4_module vulnerability CVE-2022-41742

    NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngx_http_mp4_module that might allow a local attacker to c…

    F5 NGINX Plus NGINX Open Source Subscription NGINX Network devices Debian Ubuntu Azure Linux Alpine
  • High 7.0
    CVE-2022-41741 Public exploit

    NGINX ngx_http_mp4_module vulnerability CVE-2022-41741

    NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngx_http_mp4_module that might allow a local attacker to c…

    F5 NGINX Plus NGINX NGINX Open Source Subscription Network devices Debian Ubuntu Azure Linux Alpine
  • High 7.5
    CVE-2022-41691

    BIG-IP Advanced WAF/ASM bd vulnerability CVE-2022-41691

    When a BIG-IP Advanced WAF/ASM security policy is configured on a virtual server, undisclosed requests can cause the bd process to terminate.

    F5 BIG-IP Advanced WAF & ASM Network devices
  • High 7.5
    CVE-2022-41624

    BIG-IP iRules vulnerability CVE-2022-41624

    In BIG-IP versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.2, 15.1.x before 15.1.7, 14.1.x before 14.1.5.2, and 13.1.x before 13.1.5.1, when a sideband iRule is configured on a virtual server, undisclosed traffic can cause an increase in memory resource …

    F5 BIG-IP Network devices
  • High 7.2
    CVE-2022-41617

    BIG-IP Advanced WAF and ASM iControl REST vulnerability CVE-2022-41617

    In versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and 13.1.x before 13.1.5.1, When the Advanced WAF / ASM module is provisioned, an authenticated remote code execution vulnerability exists in the BIG-IP iControl REST interfac…

    F5 BIG-IP Advanced WAF & ASM Network devices
  • High 7.2
    CVE-2022-35735

    BIG-IP monitor configuration vulnerability CVE-2022-35735

    In BIG-IP Versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and all versions of 13.1.x, an authenticated attacker with Resource Administrator or Manager privileges can create or modify existing monitor objects in the Configurati…

    F5 BIG-IP Network devices
  • High 8.1
    CVE-2022-35728

    iControl REST vulnerability CVE-2022-35728

    In BIG-IP Versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and all versions of 13.1.x, and BIG-IQ version 8.x before 8.2.0 and all versions of 7.x, an authenticated user's iControl REST token may remain …

    F5 BIG-IP BIG-IQ Centralized Management Network devices
  • High 7.5
    CVE-2022-35272

    BIG-IP HTTP MRF vulnerability CVE-2022-35272

    In BIG-IP Versions 17.0.x before 17.0.0.1 and 16.1.x before 16.1.3.1, when source-port preserve-strict is configured on an HTTP Message Routing Framework (MRF) virtual server, undisclosed traffic may cause the Traffic Management Microkernel (TMM) to produce a…

    F5 BIG-IP Network devices
  • High 7.5
    CVE-2022-35245

    BIG-IP APM access policy vulnerability CVE-2022-35245

    In BIG-IP Versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, and 14.1.x before 14.1.5.1, when a BIG-IP APM access policy is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Softwa…

    F5 BIG-IP APM Network devices
  • High 8.7
    CVE-2022-35243

    Authenticated iControl REST in Appliance mode vulnerability CVE-2022-35243

    In BIG-IP Versions 16.1.x before 16.1.3, 15.1.x before 15.1.5.1, 14.1.x before 14.1.5, and all versions of 13.1.x, when running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, using a…

    F5 BIG-IP Network devices
  • High 7.5
    CVE-2022-35240

    BIG-IP Message Routing MQTT vulnerability CVE-2022-35240

    In BIG-IP Versions 16.1.x before 16.1.2.2, 15.1.x before 15.1.6.1, and 14.1.x before 14.1.5, when the Message Routing (MR) Message Queuing Telemetry Transport (MQTT) profile is configured on a virtual server, undisclosed requests can cause an increase in memo…

    F5 BIG-IP Network devices
  • High 7.5
    CVE-2022-35236

    HTTP2 profile vulnerability CVE-2022-35236

    In BIG-IP Versions 16.1.x before 16.1.2.2, 15.1.x before 15.1.6.1, and 14.1.x before 14.1.5, when an HTTP2 profile is configured on a virtual server, undisclosed traffic can cause an increase in memory resource utilization. Note: Software versions which have …

    F5 BIG-IP Network devices
  • High 7.5
    CVE-2022-34862

    TMM vulnerability CVE-2022-34862

    In BIG-IP Versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, when an LTM virtual server is configured to perform normalization, undisclosed requests can cause the Traffic Management Microkernel (TMM) to …

    F5 BIG-IP Network devices
  • High 7.5
    CVE-2022-34655

    TMM vulnerability CVE-2022-34655

    In BIG-IP Versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.6.1, and 14.1.x before 14.1.5, when an iRule containing the HTTP::payload command is configured on a virtual server, undisclosed traffic can cause Traffic Management Microkernel (TMM) to terminate.…

    F5 BIG-IP Network devices
  • High 7.5
    CVE-2022-34651

    BIG-IP TLS 1.3 iRule vulnerability CVE-2022-34651

    In BIG-IP Versions 16.1.x before 16.1.3.1 and 15.1.x before 15.1.6.1, when an LTM Client or Server SSL profile with TLS 1.3 enabled is configured on a virtual server, along with an iRule that calls HTTP::respond, undisclosed requests can cause the Traffic Man…

    F5 BIG-IP Network devices
  • High 7.5
    CVE-2022-33203

    BIG-IP APM and F5 SSL Orchestrator vulnerability CVE-2022-33203

    In BIG-IP Versions 16.1.x before 16.1.3, 15.1.x before 15.1.6.1, and 14.1.x before 14.1.5, when a BIG-IP APM access policy with Service Connect agent is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization.…

    F5 BIG-IP APM Network devices
  • High 7.5
    CVE-2022-32455

    TMM vulnerability CVE-2022-32455

    In BIG-IP Versions 16.1.x before 16.1.2.2, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, when a BIG-IP LTM Client SSL profile is configured on a virtual server to perform client certificate authentication with session tickets enabl…

    F5 BIG-IP Network devices
  • High 7.5
    CVE-2022-29491

    On F5 BIG-IP LTM, Advanced WAF, ASM, or APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5, 14.1.x …

    F5 BIG-IP LTM, Advanced WAF, ASM, and APM Network devices
  • High 7.8
    CVE-2022-29263

    On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.…

    F5 BIG-IP APM BIG-IP APM Clients Network devices
  • High 7.5
    CVE-2022-28716

    On 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x vers…

    F5 BIG-IP Network devices
  • High 7.3
    CVE-2022-28714

    On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.…

    F5 BIG-IP APM BIG-IP APM Clients Network devices
  • High 8.0
    CVE-2022-28707

    On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, and 14.1.x versions prior to 14.1.4.…

    F5 BIG-IP Network devices
  • High 7.5
    CVE-2022-28705

    On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, a…

    F5 BIG-IP Network devices
  • High 7.5
    CVE-2022-28701

    On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, when the stream profile is configured on a virtual server, undisclosed …

    F5 BIG-IP Network devices
  • High 7.2
    CVE-2022-28695

    On F5 BIG-IP AFM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.…

    F5 BIG-IP (AFM) Network devices
  • High 7.5
    CVE-2022-28691

    On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5, 14.1.x versions prior to 14.1.4.6, and…

    F5 BIG-IP Network devices
  • High 8.7
    CVE-2022-27806

    On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP Advanced WAF, ASM, and ASM, and F5 B…

    F5 BIG-IP Guided Configuration (GC) BIG-IP (Advanced WAF, APM, ASM) Network devices
  • High 7.7
    CVE-2022-26415

    On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 1…

    F5 BIG-IP Network devices
  • High 7.5
    CVE-2022-26372

    On F5 BIG-IP 15.1.x versions prior to 15.1.0.2, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and…

    F5 BIG-IP Network devices