2021-03-31 - CVE Archive

CVE-2021-22986 Mar 31, 15:15 CRITICAL POC KEV THREAT Emergency

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3 amd BIG-IQ 7.1.0.x before 7.1.0.3 and 7.0.0.x before. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

SSRF Amd Big Ip Advanced Web Application Firewall Big Ip Application Security Manager Big Ip Access Policy Manager +13

NVD Exploit-DB

CVSS 3.1

9.8

EPSS

99.9%

CVE-2021-22987 Mar 31, 17:15 CRITICAL Act Now

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3 when running in Appliance mode, the. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Information Disclosure Big Ip Advanced Web Application Firewall Big Ip Application Security Manager Big Ip Access Policy Manager Big Ip Advanced Firewall Manager +11

NVD

CVSS 3.1

9.9

EPSS

13.7%

CVE-2021-22991 Mar 31, 18:15 CRITICAL KEV THREAT Act Now

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, undisclosed requests to a virtual server may be. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

RCE Buffer Overflow Big Ip Advanced Web Application Firewall Big Ip Application Security Manager Big Ip Access Policy Manager +12

NVD

CVSS 3.1

9.8

EPSS

61.1%

CVE-2021-22992 Mar 31, 17:15 CRITICAL Act Now

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, a malicious HTTP response to an. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

RCE Buffer Overflow Big Ip Advanced Web Application Firewall Big Ip Application Security Manager Big Ip Access Policy Manager +12

NVD

CVSS 3.1

9.8

EPSS

72.7%

CVE-2021-23005 Mar 31, 18:15 CRITICAL Act Now

On all 7.x and 6.x versions (fixed in 8.0.0), when using a Quorum device for BIG-IQ high availability (HA) for automatic failover, BIG-IQ does not make use of Transport Layer Security (TLS) with the. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Information Disclosure Big Iq Centralized Management F5

NVD

CVSS 3.1

9.1

EPSS

1.0%

CVE-2021-22989 Mar 31, 17:15 CRITICAL Act Now

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, when running in Appliance mode. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Information Disclosure Big Ip Advanced Web Application Firewall Big Ip Application Security Manager Big Ip Access Policy Manager Big Ip Advanced Firewall Manager +11

NVD

CVSS 3.1

9.1

EPSS

8.8%