F5 BIG-IP Enterprise Manager vulnerabilities

10 CVEs affecting F5 BIG-IP Enterprise Manager, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-6649, published 2019-09-20.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2015-3628, published 2015-12-07. High severity, CVSS 9.0. EPSS: 69.3% chance of exploitation in the next 30 days. The iControl API in F5 BIG-IP LTM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.3.0 before 11.5.3 HF2 and 11.6.0 before 11.6.0 HF6, BIG-IP AAM 11.4.0 before 11.5.3 HF2 and 11.6.0 before…
CVE-2018-5511, published 2018-04-13. High severity, CVSS 7.2. EPSS: 14.2% chance of exploitation in the next 30 days. On F5 BIG-IP 13.1.0-13.1.0.3 or 13.0.0, when authenticated administrative users execute commands in the Traffic Management User Interface (TMUI), also referred to as the BIG-IP Configuration utility,…
CVE-2014-0101, published 2014-03-11. High severity, CVSS 7.8. EPSS: 7.2% chance of exploitation in the next 30 days. The sctp_sf_do_5_1D_ce function in net/sctp/sm_statefuns.c in the Linux kernel through 3.13.6 does not validate certain auth_enable and auth_capable fields before making an sctp_sf_authenticate call,…
CVE-2012-3163, published 2012-10-17. High severity, CVSS 9.0. EPSS: 5.1% chance of exploitation in the next 30 days. Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.64 and earlier, and 5.5.26 and earlier, allows remote authenticated users to affect confidentiality, integrity, and…
CVE-2015-7394, published 2015-11-06. High severity, CVSS 9.0. EPSS: 3.9% chance of exploitation in the next 30 days. The datastor kernel module in F5 BIG-IP Analytics, APM, ASM, Link Controller, and LTM 11.1.0 before 12.0.0, BIG-IP AAM 11.4.0 before 12.0.0, BIG-IP AFM, PEM 11.3.0 before 12.0.0, BIG-IP Edge Gateway,…
CVE-2015-5516, published 2016-01-20. High severity, CVSS 7.5. EPSS: 2.9% chance of exploitation in the next 30 days. Memory leak in the last hop kernel module in F5 BIG-IP LTM, GTM, and Link Controller 10.1.x, 10.2.x before 10.2.4 HF13, 11.x before 11.2.1 HF15, 11.3.x, 11.4.x, 11.5.x before 11.5.3 HF2, and 11.6.x…
CVE-2015-8099, published 2016-05-13. Medium severity, CVSS 5.9. EPSS: 2% chance of exploitation in the next 30 days. F5 BIG-IP LTM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.3.x, 11.4.x before 11.4.1 HF10, 11.5.x before 11.5.4, 11.6.x before 11.6.1, and 12.x before 12.0.0 HF1; BIG-IP AAM 11.4.x before…
CVE-2019-6649, published 2019-09-20. Critical severity, CVSS 9.1. EPSS: 1.3% chance of exploitation in the next 30 days. F5 BIG-IP 15.0.0, 14.1.0-14.1.0.6, 14.0.0-14.0.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.1, 11.6.0-11.6.4, and 11.5.1-11.5.9 and Enterprise Manager 3.1.1 may expose sensitive information and allow the…
CVE-2014-6031, published 2017-06-08. Medium severity, CVSS 4.9. EPSS: 1.1% chance of exploitation in the next 30 days. Buffer overflow in the mcpq daemon in F5 BIG-IP systems 10.x before 10.2.4 HF12, 11.x before 11.2.1 HF15, 11.3.x, 11.4.x before 11.4.1 HF9, 11.5.x before 11.5.2 HF1, and 11.6.0 before HF4, and…
CVE-2018-5516, published 2018-05-02. Medium severity, CVSS 4.7. EPSS: 0.3% chance of exploitation in the next 30 days. On F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.2, or 11.2.1-11.6.3.1, Enterprise Manager 3.1.1, BIG-IQ Centralized Management 5.0.0-5.4.0 or 4.6.0, BIG-IQ Cloud and Orchestration 1.0.0, or F5 iWorkflow…