F5

Records1058All Threatist records

Exploited (KEV)14In CISA KEV

CVSS critical89CVSS 9.0–10.0

CVSS high585CVSS 7.0–8.9

Exploited now

F5 records in CISA KEV

TI-2026-63338 F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability CRITICAL 99KEV 2026-09-22 TI-2025-33465 F5 BIG-IP Stack-Based Buffer Overflow Vulnerability CRITICAL 99KEV 2026-03-27 TI-2018-10499 Linux Kernel Integer Overflow Vulnerability CRITICAL 93KEV 2026-01-26 TI-2023-25230 F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability CRITICAL 100KEV 2023-10-31 TI-2023-25231 F5 BIG-IP Configuration Utility SQL Injection Vulnerability CRITICAL 97KEV 2023-10-31 TI-2023-23979 HTTP/2 Rapid Reset Attack Vulnerability CRITICAL 90KEV 2023-10-10

Components

Products in the NVD configurations · select one to filter the records

Big-ip Access Policy Manager 630 records CRITICAL Big-ip Application Security Manager 581 records CRITICAL Big-ip Advanced Firewall Manager 552 records CRITICAL Big-ip Local Traffic Manager 541 records CRITICAL Big-ip Policy Enforcement Manager 533 records CRITICAL Big-ip Link Controller 525 records CRITICAL Big-ip Application Acceleration Manager 524 records CRITICAL Big-ip Analytics 511 records CRITICAL

Records

10 records in Firepass · all components

TI-2014-02348 CVE-2014-2927 · GHSA-5ffj-x2ff-2jp7

The rsync daemon in F5 BIG-IP 11.6 before 11.6.0, 11.5.1 before HF3, 11.5.0 before HF4…

MEDIUM 51

The rsync daemon in F5 BIG-IP 11.6 before 11.6.0, 11.5.1 before HF3, 11.5.0 before HF4, 11.4.1 before HF4, 11.4.0 before HF7, 11.3.0 before HF9, and 11.2.1 before HF11 and Enterprise Manager 3.x before 3.1.1 HF2, when co…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.0792 Published 2014-10-15 No fix listed CWE-287

TI-2013-00085 CVE-2013-0150 · GHSA-wxch-2vvj-p58q

Directory traversal vulnerability in an unspecified signed Java applet in the client-side…

MEDIUM 49

Directory traversal vulnerability in an unspecified signed Java applet in the client-side components in F5 BIG-IP APM 10.1.0 through 10.2.4 and 11.0.0 through 11.3.0, FirePass 6.0.0 through 6.1.0 and 7.0.0, and other pro…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.06316 Published 2013-08-09 No fix listed CWE-22

TI-2011-02818 CVE-2011-3188 · GHSA-93rr-wh56-p8fw

The (1) IPv4 and (2) IPv6 implementations in the Linux kernel before 3.1 use a modified…

MEDIUM 47

The (1) IPv4 and (2) IPv6 implementations in the Linux kernel before 3.1 use a modified MD4 algorithm to generate sequence numbers and Fragment Identification values, which makes it easier for remote attackers to cause a…

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.05028 Published 2012-05-24 Partial fix

TI-2007-00182 CVE-2007-0187 · GHSA-4hgg-446h-pr53

F5 FirePass 5.4 through 5.5.2 and 6.0 allows remote attackers to access restricted URLs…

LOW 39

F5 FirePass 5.4 through 5.5.2 and 6.0 allows remote attackers to access restricted URLs via (1) a trailing null byte, (2) multiple leading slashes, (3) Unicode encoding, (4) URL-encoded directory traversal or same-direct…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.03761 Published 2007-01-11 No fix listed

TI-2012-01565 CVE-2012-1777 · GHSA-vwr9-323f-jc7g

SQL injection vulnerability in my.activation.php3 in F5 FirePass 6.0.0 through 6.1.0 and…

LOW 37

SQL injection vulnerability in my.activation.php3 in F5 FirePass 6.0.0 through 6.1.0 and 7.0.0 allows remote attackers to execute arbitrary SQL commands via the state parameter.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.02301 Published 2012-04-04 No fix listed CWE-89

TI-2013-03133 CVE-2013-3587 · GHSA-hh3m-fgxm-fq25

Information disclosure in HTTPS protocol

LOW 35

The HTTPS protocol, as used in unspecified web applications, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which makes it easier for man-in-the-middle attackers to obtain pl…

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.06049 Published 2020-02-21 Will not fix CWE-200

TI-2012-01826 CVE-2012-2053 · GHSA-q9xm-p27h-h3gp

The sudoers file in the Linux system configuration in F5 FirePass 6.0.0 through 6.1.0 and…

LOW 32

The sudoers file in the Linux system configuration in F5 FirePass 6.0.0 through 6.1.0 and 7.0.0 does not require a password for executing commands as root, which allows local users to gain privileges via the sudo program…

CVSS 2.0HIGH 7.2 Local No auth Interaction — EPSS 0.0048 Published 2012-04-04 No fix listed CWE-264

TI-2007-00183 CVE-2007-0188 · GHSA-c9fx-9g6g-3jxc

F5 FirePass 5.4 through 5.5.1 does not properly enforce host access restrictions when a…

LOW 32

F5 FirePass 5.4 through 5.5.1 does not properly enforce host access restrictions when a client uses a single integer (dword) representation of an IP address ("dotless IP address"), which allows remote authenticated users…

CVSS 2.0MEDIUM 6.5 Network Low privileges Interaction — EPSS 0.01363 Published 2007-01-11 No fix listed

TI-2007-00190 CVE-2007-0195 · GHSA-w5v6-gw7h-cxrj

my.activation.php3 in F5 FirePass 5.4 through 5.5.1 and 6.0 displays different error…

LOW 26

my.activation.php3 in F5 FirePass 5.4 through 5.5.1 and 6.0 displays different error messages for failed login attempts with a valid username than for those with an invalid username, which allows remote attackers to conf…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.01499 Published 2007-01-11 No fix listed

TI-2013-05135 CVE-2013-6024 · GHSA-g8v6-98vr-2hm4

The Edge Client components in F5 BIG-IP APM 10.x, 11.x, 12.x, 13.x, and 14.x, BIG-IP Edge…

LOW 20

The Edge Client components in F5 BIG-IP APM 10.x, 11.x, 12.x, 13.x, and 14.x, BIG-IP Edge Gateway 10.x and 11.x, and FirePass 7.0.0 allow attackers to obtain sensitive information from process memory via unspecified vect…

CVSS 2.0MEDIUM 4.4 Local Low privileges Interaction — EPSS 0.00357 Published 2014-02-10 No fix listed CWE-200

Open these records in search →

Critical	89
High	585
Medium	370
Low	14
No CVSS	0