Big-ip Policy Enforcement Manager vulnerabilities

132 known vulnerabilities in Big-ip Policy Enforcement Manager from F5. 131 are rated high or critical, and 9 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  On BIG-IP version 16.1.x before 16.1.2, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.4, and…

  CVE-2022-23019Jan 25, 2022BIG-IP

  On BIG-IP version 16.1.x before 16.1.2, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.4, and all versions of 13.1.x and 12.1.x, when a message routing type virtual server is configured with both Diameter Session and Router Profiles, undisclosed traffic can caus

• 7.5 High severity

  BIG-IP: NULL Pointer Dereference

  CVE-2022-23017Jan 25, 2022BIG-IP

  On BIG-IP version 16.x before 16.1.0, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.5, and all versions of 13.1.x, when a virtual server is configured with a DNS profile with the Rapid Response Mode setting enabled and is configured on a BIG-IP system, undisclo

• 7.5 High severity

  BIG-IP: NULL Pointer Dereference

  CVE-2022-23016Jan 25, 2022BIG-IP

  On versions 16.1.x before 16.1.2 and 15.1.x before 15.1.4.1, when BIG-IP SSL Forward Proxy with TLS 1.3 is configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have

• 7.5 High severity

  BIG-IP: Uncontrolled Resource Consumption

  CVE-2022-23015Jan 25, 2022BIG-IP

  On BIG-IP versions 16.x before 16.1.0, 15.1.x before 15.1.4.1, and 14.1.2.6-14.1.4.4, when a Client SSL profile is configured on a virtual server with Client Certificate Authentication set to request/require and Session Ticket enabled and configured, processin

• 7.5 High severity

  BIG-IP: Double Free

  CVE-2022-23012Jan 25, 2022BIG-IP

  On BIG-IP versions 15.1.x before 15.1.4.1 and 14.1.x before 14.1.4.5, when the HTTP/2 profile is configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached En

• 7.5 High severity

  BIG-IP: Incorrect Calculation

  CVE-2022-23011Jan 25, 2022BIG-IP

  On certain hardware BIG-IP platforms, in version 15.1.x before 15.1.4 and 14.1.x before 14.1.3, virtual servers may stop responding while processing TCP traffic due to an issue in the SYN Cookie Protection feature. Note: Software versions which have reached En

• 7.5 High severity

  BIG-IP: Improper Resource Shutdown or Release

  CVE-2022-23010Jan 25, 2022BIG-IP

  On BIG-IP versions 16.x before 16.1.0, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.4, and all versions of 13.1.x, 12.1.x, and 11.6.x, when a FastL4 profile and an HTTP profile are configured on a virtual server, undisclosed requests can cause an increase in m

• 9.8 Critical severity

  F5 BIG-IP Traffic Management Microkernel Buffer Overflow Exploited

  CVE-2021-22991Mar 31, 2021BIG-IPEPSS 62.4%

  On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, undisclosed requests to a virtual server may be incorrectly handled by the Traffic Management Microkernel (TMM) URI nor

• 9.8 Critical severity

  F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Exploited

  CVE-2021-22986Mar 31, 2021BIG-IP; BIG-IQEPSS 99.9%

  On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3 amd BIG-IQ 7.1.0.x before 7.1.0.3 and 7.0.0.x before 7.0.0.2, the iControl REST interface has an unauthenticated remote

• 9.8 Critical severity

  F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Exploited

  CVE-2020-5902Jul 1, 2020BIG-IPEPSS 100%

  In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclo

• 7.8 High severity

  Linux Kernel Integer Overflow Exploited

  CVE-2018-14634Sep 25, 2018Linux FoundationEPSS 14.7%

  An integer overflow flaw was found in the Linux kernel's create_elf_tables() function. An unprivileged local user with access to SUID (or otherwise privileged) binary could use this flaw to escalate their privileges on the system. Kernel versions 2.6.x, 3.10.x

• 6.9 Medium severity

  Linux Kernel Race Condition Exploited

  CVE-2014-0196May 7, 2014LinuxEPSS 20.3%

  The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial of service (memory corruption and system crash) or gain privi