deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-1389
Published: 2022-05-05
Description: On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP (fixed in 17.0.0), a cross-site request forgery (CSRF) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility. This vulnerability allows an attacker to run a limited set of commands: ping, traceroute, and WOM diagnostics. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS Score: 3.1 (LOW)
CWE: CWE-352
References: https://support.f5.com/csp/article/K49905324; https://support.f5.com/csp/article/K49905324
CVE: CVE-2022-1468
Published: 2022-05-05
Description: On all versions of 17.0.x, 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x on F5 BIG-IP, an authenticated iControl REST user with at least guest role privileges can cause processing delays to iControl REST requests via undisclosed requests. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400
References: https://support.f5.com/csp/article/K15101402; https://support.f5.com/csp/article/K15101402
CVE: CVE-2022-25946
Published: 2022-05-05
Description: On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP Advanced WAF, ASM, and ASM, and F5 BIG-IP Guided Configuration (GC) all versions prior to 9.0, when running in Appliance mode, an authenticated attacker with Administrator role privilege may be able to bypass Appliance mode restrictions due to a missing integrity check in F5 BIG-IP Guided Configuration. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS Score: 8.7 (HIGH)
CWE: CWE-354
References: https://support.f5.com/csp/article/K52322100; https://support.f5.com/csp/article/K52322100
CVE: CVE-2022-25990
Published: 2022-05-05
Description: On 1.0.x versions prior to 1.0.1, systems running F5OS-A software may expose certain registry ports externally. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://support.f5.com/csp/article/K44233515; https://support.f5.com/csp/article/K44233515
CVE: CVE-2022-26071
Published: 2022-05-05
Description: On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, a flaw in the way reply ICMP packets are limited in the Traffic Management Microkernel (TMM) allows an attacker to quickly scan open UDP ports. This flaw allows an off-path remote attacker to effectively bypass source port UDP randomization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS Score: 7.4 (HIGH)
CWE: CWE-330
References: https://support.f5.com/csp/article/K41440465; https://support.f5.com/csp/article/K41440465
CVE: CVE-2022-26130
Published: 2022-05-05
Description: On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, when an Active mode-enabled FTP profile is configured on a virtual server, undisclosed traffic can cause the virtual server to stop processing active FTP data channel connections. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-754
References: https://support.f5.com/csp/article/K82034427; https://support.f5.com/csp/article/K82034427
CVE: CVE-2022-26340
Published: 2022-05-05
Description: On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, and F5 BIG-IQ Centralized Management all versions of 8.x and 7.x, an authenticated, high-privileged attacker with no bash access may be able to access Certificate and Key files using Secure Copy (SCP) protocol from a remote system. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-732
References: https://support.f5.com/csp/article/K38271531; https://support.f5.com/csp/article/K38271531
CVE: CVE-2022-26370
Published: 2022-05-05
Description: On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5, and 14.1.x versions prior to 14.1.4.6, when a Session Initiation Protocol (SIP) message routing framework (MRF) application layer gateway (ALG) profile is configured on a Message Routing virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-908
References: https://support.f5.com/csp/article/K51539421; https://support.f5.com/csp/article/K51539421
CVE: CVE-2022-26372
Published: 2022-05-05
Description: On F5 BIG-IP 15.1.x versions prior to 15.1.0.2, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, when a DNS listener is configured on a virtual server with DNS queueing (default), undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://support.f5.com/csp/article/K23454411; https://support.f5.com/csp/article/K23454411
CVE: CVE-2022-26415
Published: 2022-05-05
Description: On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x, when running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, utilizing an undisclosed iControl REST endpoint. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS Score: 7.7 (HIGH)
CWE: CWE-77
References: https://support.f5.com/csp/article/K81952114; https://support.f5.com/csp/article/K81952114
CVE: CVE-2022-26517
Published: 2022-05-05
Description: On F5 BIG-IP 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, when the BIG-IP CGNAT Large Scale NAT (LSN) pool is configured on a virtual server and packet filtering is enabled, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-682
References: https://support.f5.com/csp/article/K54082580; https://support.f5.com/csp/article/K54082580
CVE: CVE-2022-26835
Published: 2022-05-05
Description: On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, directory traversal vulnerabilities exist in undisclosed iControl REST endpoints and TMOS Shell (tmsh) commands in F5 BIG-IP Guided Configuration, which may allow an authenticated attacker with at least resource administrator role privileges to read arbitrary files. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: https://support.f5.com/csp/article/K53197140; https://support.f5.com/csp/article/K53197140
CVE: CVE-2022-26890
Published: 2022-05-05
Description: On F5 BIG-IP Advanced WAF, ASM, and APM 16.1.x versions prior to 16.1.2.1, 15.1.x versions prior to 15.1.5, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, when ASM or Advanced WAF, as well as APM, are configured on a virtual server, the ASM policy is configured with Session Awareness, and the "Use APM Username and Session ID" option is enabled, undisclosed requests can cause the bd process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS Score: 7.5 (HIGH)
CWE: CWE-670
References: https://support.f5.com/csp/article/K03442392; https://support.f5.com/csp/article/K03442392
CVE: CVE-2022-27181
Published: 2022-05-05
Description: On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, when APM is configured on a virtual server and the associated access profile is configured with APM AAA NTLM Auth, undisclosed requests can cause an increase in internal resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400
References: https://support.f5.com/csp/article/K93543114; https://support.f5.com/csp/article/K93543114
CVE: CVE-2022-27182
Published: 2022-05-05
Description: On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, and 14.1.x versions prior to 14.1.4.6, when BIG-IP packet filters are enabled and a virtual server is configured with the type set to Reject, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://support.f5.com/csp/article/K31856317; https://support.f5.com/csp/article/K31856317
CVE: CVE-2022-27189
Published: 2022-05-05
Description: On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, when an Internet Content Adaptation Protocol (ICAP) profile is configured on a virtual server, undisclosed traffic can cause an increase in Traffic Management Microkernel (TMM) memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS Score: 7.5 (HIGH)
CWE: CWE-681
References: https://support.f5.com/csp/article/K16187341; https://support.f5.com/csp/article/K16187341
CVE: CVE-2022-27230
Published: 2022-05-05
Description: On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP APM, and F5 BIG-IP Guided Configuration (GC) all versions prior to 9.0, a reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of F5 BIG-IP Guided Configuration that allows an attacker to execute JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS Score: 7.5 (HIGH)
CWE: CWE-79
References: https://support.f5.com/csp/article/K21317311; https://support.f5.com/csp/article/K21317311
CVE: CVE-2022-27495
Published: 2022-05-05
Description: On all versions 1.3.x (fixed in 1.4.0) NGINX Service Mesh control plane endpoints are exposed to the cluster overlay network. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-306
References: https://support.f5.com/csp/article/K94093538; https://support.f5.com/csp/article/K94093538
CVE: CVE-2022-27588
Published: 2022-05-05
Description: We have already fixed this vulnerability in the following versions of QVR: QVR 5.1.6 build 20220401 and later
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://www.qnap.com/en/security-advisory/qsa-22-07; https://www.qnap.com/en/security-advisory/qsa-22-07
CVE: CVE-2022-27634
Published: 2022-05-05
Description: On 16.1.x versions prior to 16.1.2.2 and 15.1.x versions prior to 15.1.5.1, BIG-IP APM does not properly validate configurations, allowing an authenticated attacker with high privileges to manipulate the APM policy leading to privilege escalation/remote code execution. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://support.f5.com/csp/article/K57555833; https://support.f5.com/csp/article/K57555833
CVE: CVE-2022-27636
Published: 2022-05-05
Description: On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, as well as F5 BIG-IP APM Clients 7.x versions prior to 7.2.1.5, BIG-IP Edge Client may log sensitive APM session-related information when VPN is launched on a Windows system. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://support.f5.com/csp/article/K57110035; https://support.f5.com/csp/article/K57110035
CVE: CVE-2022-27659
Published: 2022-05-05
Description: On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, and 14.1.x versions prior to 14.1.4.6, an authenticated attacker can modify or delete Dashboards created by other BIG-IP users in the Traffic Management User Interface (TMUI). Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-269
References: https://support.f5.com/csp/article/K41877405; https://support.f5.com/csp/article/K41877405
CVE: CVE-2022-27662
Published: 2022-05-05
Description: On F5 Traffix SDC 5.2.x versions prior to 5.2.2 and 5.1.x versions prior to 5.1.35, a stored Cross-Site Template Injection vulnerability exists in an undisclosed page of the Traffix SDC Configuration utility that allows an attacker to execute template language-specific instructions in the context of the server. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-1336
References: https://support.f5.com/csp/article/K24248011; https://support.f5.com/csp/article/K24248011
CVE: CVE-2022-27806
Published: 2022-05-05
Description: On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP Advanced WAF, ASM, and ASM, and F5 BIG-IP Guided Configuration (GC) all versions prior to 9.0, when running in Appliance mode, an authenticated attacker assigned the Administrator role may be able to bypass Appliance mode restrictions, utilizing command injection vulnerabilities in undisclosed URIs in F5 BIG-IP Guided Configuration. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS Score: 8.7 (HIGH)
CWE: CWE-77
References: https://support.f5.com/csp/article/K68647001; https://support.f5.com/csp/article/K68647001
CVE: CVE-2022-27875
Published: 2022-05-05
Description: On F5 Access for Android 3.x versions prior to 3.0.8, a Task Hijacking vulnerability exists in the F5 Access for Android application, which may allow an attacker to steal sensitive user information. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://support.f5.com/csp/article/K40019131; https://support.f5.com/csp/article/K40019131
CVE: CVE-2022-27878
Published: 2022-05-05
Description: On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP, and F5 BIG-IP Guided Configuration (GC) all versions prior to 9.0, a stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to execute JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79
References: https://support.f5.com/csp/article/K92807525; https://support.f5.com/csp/article/K92807525
CVE: CVE-2022-27880
Published: 2022-05-05
Description: On F5 Traffix SDC 5.2.x versions prior to 5.2.2 and 5.1.x versions prior to 5.1.35, a stored Cross-Site Scripting (XSS) vulnerability exists in an undisclosed page of the Traffix SDC Configuration utility that allows an attacker to execute JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://support.f5.com/csp/article/K17341495; https://support.f5.com/csp/article/K17341495
CVE: CVE-2022-28079
Published: 2022-05-05
Description: College Management System v1.0 was discovered to contain a SQL injection vulnerability via the course_code parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/167131/College-Management-System-1.0-SQL-Injection.html; https://code-projects.org/college-management-system-in-php-with-source-code/; https://github.com/erengozaydin/College-Management-System-course_code-SQL-Injection-Authenticated
CVE: CVE-2022-28080
Published: 2022-05-05
Description: Royal Event Management System v1.0 was discovered to contain a SQL injection vulnerability via the todate parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/167123/Royal-Event-Management-System-1.0-SQL-Injection.html; https://github.com/erengozaydin/Royal-Event-Management-System-todate-SQL-Injection-Authenticated; https://www.sourcecodester.com/php/15238/event-management-system-project-php-source-code.html
CVE: CVE-2022-28120
Published: 2022-05-05
Description: Beijing Runnier Network Technology Co., Ltd Open virtual simulation experiment teaching management platform software 2.0 has a file upload vulnerability, which can be exploited by an attacker to gain control of the server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://www.cnvd.org.cn/flaw/show/CNVD-2021-39055; https://www.cnvd.org.cn/flaw/show/CNVD-2021-39055
CVE: CVE-2022-28530
Published: 2022-05-05
Description: Sourcecodester Covid-19 Directory on Vaccination System 1.0 is vulnerable to SQL Injection via cmdcategory.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://packetstormsecurity.com/files/166481/Covid-19-Directory-On-Vaccination-System-1.0-SQL-Injection.html; https://packetstormsecurity.com/files/166481/Covid-19-Directory-On-Vaccination-System-1.0-SQL-Injection.html
CVE: CVE-2022-28533
Published: 2022-05-05
Description: Sourcecodester Medical Hub Directory Site 1.0 is vulnerable to SQL Injection via /mhds/clinic/view_details.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://packetstormsecurity.com/files/166539; https://packetstormsecurity.com/files/166539
CVE: CVE-2022-28606
Published: 2022-05-05
Description: An arbitrary file upload vulnerability exists in Wenzhou Huoyin Information Technology Co., Ltd. BossCMS 1.0, which can be exploited by an attacker to gain control of the server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://www.bosscms.net/; https://www.cnvd.org.cn/flaw/show/CNVD-2022-04804; https://www.cnvd.org.cn/patchInfo/show/313666
CVE: CVE-2022-28691
Published: 2022-05-05
Description: On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, when a Real Time Streaming Protocol (RTSP) profile is configured on a virtual server, undisclosed traffic can cause an increase in Traffic Management Microkernel (TMM) resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://support.f5.com/csp/article/K37155600; https://support.f5.com/csp/article/K37155600
CVE: CVE-2022-28695
Published: 2022-05-05
Description: On F5 BIG-IP AFM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, an authenticated attacker with high privileges can upload a maliciously crafted file to the BIG-IP AFM Configuration utility, which allows an attacker to run arbitrary commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: https://support.f5.com/csp/article/K08510472; https://support.f5.com/csp/article/K08510472
CVE: CVE-2022-28701
Published: 2022-05-05
Description: On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, when the stream profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://support.f5.com/csp/article/K99123750; https://support.f5.com/csp/article/K99123750
CVE: CVE-2022-28705
Published: 2022-05-05
Description: On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, on platforms with an ePVA and the pva.fwdaccel BigDB variable enabled, undisclosed requests to a virtual server with a FastL4 profile that has ePVA acceleration enabled can cause the Traffic Management Microkernel (TMM) process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://support.f5.com/csp/article/K52340447; https://support.f5.com/csp/article/K52340447
CVE: CVE-2022-28706
Published: 2022-05-05
Description: On F5 BIG-IP 16.1.x versions prior to 16.1.2 and 15.1.x versions prior to 15.1.5.1, when the DNS resolver configuration is used, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-754
References: https://support.f5.com/csp/article/K03755971; https://support.f5.com/csp/article/K03755971
CVE: CVE-2022-28707
Published: 2022-05-05
Description: On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, and 14.1.x versions prior to 14.1.4.6, a stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility (also referred to as the BIG-IP TMUI) that allows an attacker to execute JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS Score: 8.0 (HIGH)
CWE: CWE-79
References: https://support.f5.com/csp/article/K70300233; https://support.f5.com/csp/article/K70300233
CVE: CVE-2022-28708
Published: 2022-05-05
Description: On F5 BIG-IP 16.1.x versions prior to 16.1.2.2 and 15.1.x versions prior to 15.1.5.1, when a BIG-IP DNS resolver-enabled, HTTP-Explicit or SOCKS profile is configured on a virtual server, an undisclosed DNS response can cause the Traffic Management Microkernel (TMM) process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://support.f5.com/csp/article/K85054496; https://support.f5.com/csp/article/K85054496
CVE: CVE-2022-28714
Published: 2022-05-05
Description: On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, as well as F5 BIG-IP APM Clients 7.x versions prior to 7.2.1.5, a DLL Hijacking vulnerability exists in the BIG-IP Edge Client Windows Installer. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS Score: 7.3 (HIGH)
CWE: CWE-427
References: https://support.f5.com/csp/article/K54460845; https://support.f5.com/csp/article/K54460845
CVE: CVE-2022-28716
Published: 2022-05-05
Description: On 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x 11.6.x, a DOM-based cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP AFM, CGNAT, and PEM Configuration utility that allows an attacker to execute JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS Score: 7.5 (HIGH)
CWE: CWE-79
References: https://support.f5.com/csp/article/K25451853; https://support.f5.com/csp/article/K25451853