CVSS: 7.8EPSS: 0%CPEs: 38EXPL: 0CVE-2022-29263
https://notcve.org/view.php?id=CVE-2022-29263
05 May 2022 — On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, as well as F5 BIG-IP APM Clients 7.x versions prior to 7.2.1.5, the BIG-IP Edge Client Component Installer Service does not use best practice while saving temporary files. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated En F5 BIG-IP APM versiones 16.1.x anteriores a 16.1.2... • https://support.f5.com/csp/article/K33552735 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 7.8EPSS: 0%CPEs: 39EXPL: 0CVE-2022-28714
https://notcve.org/view.php?id=CVE-2022-28714
05 May 2022 — On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, as well as F5 BIG-IP APM Clients 7.x versions prior to 7.2.1.5, a DLL Hijacking vulnerability exists in the BIG-IP Edge Client Windows Installer. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated En F5 BIG-IP APM versiones 16.1.x anteriores a 16.1.2.2, en las versiones 15.1.... • https://support.f5.com/csp/article/K54460845 • CWE-427: Uncontrolled Search Path Element •
CVSS: 9.1EPSS: 0%CPEs: 55EXPL: 0CVE-2022-26415
https://notcve.org/view.php?id=CVE-2022-26415
05 May 2022 — On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x, when running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, utilizing an undisclosed iControl REST endpoint. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated En F5 BIG-IP versiones 16.1.x anteriores a 16.1.2.2, e... • https://support.f5.com/csp/article/K81952114 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 7.5EPSS: 0%CPEs: 341EXPL: 0CVE-2022-26372
https://notcve.org/view.php?id=CVE-2022-26372
05 May 2022 — On F5 BIG-IP 15.1.x versions prior to 15.1.0.2, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, when a DNS listener is configured on a virtual server with DNS queueing (default), undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En F5 BIG-IP versiones 15.1.x anteriores a 15.1.0.2, en las versiones 14.1.x anteriores a 14.1.4.6, en la... • https://support.f5.com/csp/article/K23454411 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 4.9EPSS: 0%CPEs: 343EXPL: 0CVE-2022-26340
https://notcve.org/view.php?id=CVE-2022-26340
05 May 2022 — On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, and F5 BIG-IQ Centralized Management all versions of 8.x and 7.x, an authenticated, high-privileged attacker with no bash access may be able to access Certificate and Key files using Secure Copy (SCP) protocol from a remote system. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluat... • https://support.f5.com/csp/article/K38271531 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 7.5EPSS: 0%CPEs: 341EXPL: 0CVE-2022-26071
https://notcve.org/view.php?id=CVE-2022-26071
05 May 2022 — On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, a flaw in the way reply ICMP packets are limited in the Traffic Management Microkernel (TMM) allows an attacker to quickly scan open UDP ports. This flaw allows an off-path remote attacker to effectively bypass source port UDP randomization. Note: Software versions which have reached End of Technical Support (EoTS) are n... • https://support.f5.com/csp/article/K41440465 • CWE-330: Use of Insufficiently Random Values •
CVSS: 4.3EPSS: 0%CPEs: 341EXPL: 0CVE-2022-1468
https://notcve.org/view.php?id=CVE-2022-1468
05 May 2022 — On all versions of 17.0.x, 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x on F5 BIG-IP, an authenticated iControl REST user with at least guest role privileges can cause processing delays to iControl REST requests via undisclosed requests. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated En todas las versiones de 17.0.x, 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x y 11.6.x de F5 BIG-IP, un usuario autenticado de iControl REST con al menos privilegios de rol de invi... • https://support.f5.com/csp/article/K15101402 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 4.3EPSS: 0%CPEs: 341EXPL: 0CVE-2022-1389
https://notcve.org/view.php?id=CVE-2022-1389
05 May 2022 — On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP (fixed in 17.0.0), a cross-site request forgery (CSRF) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility. This vulnerability allows an attacker to run a limited set of commands: ping, traceroute, and WOM diagnostics. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated En todas las versiones de 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x y 11.6.x de F5 BIG-IP (c... • https://support.f5.com/csp/article/K49905324 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 9.8EPSS: 46%CPEs: 66EXPL: 73CVE-2022-1388 – F5 BIG-IP Missing Authentication Vulnerability
https://notcve.org/view.php?id=CVE-2022-1388
05 May 2022 — On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated En F5 BIG-IP versiones 16.1.x anteriores a 16.1.2.2, versiones 15.1.x anteriores a 15.1.5.1, versiones 14.1.x anteriores a 14.1.4.6, versiones 13.1.x anteriores a 13.1.5 ... • https://packetstorm.news/files/id/167007 • CWE-306: Missing Authentication for Critical Function •
CVSS: 5.5EPSS: 0%CPEs: 33EXPL: 0CVE-2022-27636
https://notcve.org/view.php?id=CVE-2022-27636
05 May 2022 — On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, as well as F5 BIG-IP APM Clients 7.x versions prior to 7.2.1.5, BIG-IP Edge Client may log sensitive APM session-related information when VPN is launched on a Windows system. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated En F5 BIG-IP APM versiones 16.1.x anteriores a 16.... • https://support.f5.com/csp/article/K57110035 • CWE-532: Insertion of Sensitive Information into Log File •