F5 Enterprise Manager vulnerabilities

39 CVEs affecting F5 Enterprise Manager, 4 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-5854, published 2020-02-06.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2014-6271: GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability, published 2014-09-24. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-01-28. EPSS: 100% chance of exploitation in the next 30 days. GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment,…
CVE-2014-7169: GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability, published 2014-09-25. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-01-28. EPSS: 99.9% chance of exploitation in the next 30 days. GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or…
CVE-2014-0196: Linux Kernel Race Condition Vulnerability, published 2014-05-07. Medium severity, CVSS 5.5. Actively exploited: in CISA KEV since 2023-05-12. EPSS: 22.5% chance of exploitation in the next 30 days. The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial…
CVE-2018-14634: Linux Kernel Integer Overflow Vulnerability, published 2018-09-25. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2026-01-26. EPSS: 14.7% chance of exploitation in the next 30 days. An integer overflow flaw was found in the Linux kernel's create_elf_tables() function. An unprivileged local user with access to SUID (or otherwise privileged) binary could use this flaw to escalate…
CVE-2019-11479, published 2019-06-19. High severity, CVSS 7.5. EPSS: 91.7% chance of exploitation in the next 30 days. Jonathan Looney discovered that the Linux kernel default MSS is hard-coded to 48 bytes. This allows a remote peer to fragment TCP resend queues significantly more than if a larger MSS were enforced.…
CVE-2012-1493, published 2012-07-09. High severity, CVSS 7.8. EPSS: 63.1% chance of exploitation in the next 30 days. F5 BIG-IP appliances 9.x before 9.4.8-HF5, 10.x before 10.2.4, 11.0.x before 11.0.0-HF2, and 11.1.x before 11.1.0-HF3, and Enterprise Manager before 2.1.0-HF2, 2.2.x before 2.2.0-HF1, and 2.3.x…
CVE-2015-4047, published 2015-05-29. High severity, CVSS 7.8. EPSS: 9.7% chance of exploitation in the next 30 days. racoon/gssapi.c in IPsec-Tools 0.8.2 allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon crash) via a series of crafted UDP requests.
CVE-2014-2927, published 2014-10-15. High severity, CVSS 9.3. EPSS: 7.9% chance of exploitation in the next 30 days. The rsync daemon in F5 BIG-IP 11.6 before 11.6.0, 11.5.1 before HF3, 11.5.0 before HF4, 11.4.1 before HF4, 11.4.0 before HF7, 11.3.0 before HF9, and 11.2.1 before HF11 and Enterprise Manager 3.x…
CVE-2015-4040, published 2015-09-17. Medium severity, CVSS 4.0. EPSS: 6.8% chance of exploitation in the next 30 days. Directory traversal vulnerability in the configuration utility in F5 BIG-IP before 12.0.0 and Enterprise Manager 3.0.0 through 3.1.1 allows remote authenticated users to access arbitrary files in the…
CVE-2018-5743, published 2019-10-09. High severity, CVSS 7.5. EPSS: 6.5% chance of exploitation in the next 30 days. By design, BIND is intended to limit the number of TCP clients that can be connected at any given time. The number of allowed connections is a tunable parameter which, if unset, defaults to a…

Latest

CVE-2020-5854, published 2020-02-06. Medium severity, CVSS 5.9. EPSS: 0.8% chance of exploitation in the next 30 days. On BIG-IP 15.0.0-15.0.1.1, 14.1.0-14.1.2.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.6.0-11.6.5.1, the tmm crashes under certain circumstances when using the connector profile if a…
CVE-2014-5209, published 2020-01-08. Medium severity, CVSS 5.3. EPSS: 2.5% chance of exploitation in the next 30 days. An Information Disclosure vulnerability exists in NTP 4.2.7p25 private (mode 6/7) messages via a GET_RESTRICT control message, which could let a malicious user obtain sensitive information.
CVE-2019-19151, published 2019-12-23. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. On BIG-IP versions 15.0.0-15.1.0, 14.0.0-14.1.2.3, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, BIG-IQ versions 7.0.0, 6.0.0-6.1.0, and 5.0.0-5.4.0, iWorkflow version 2.3.0, and Enterprise…
CVE-2019-6665, published 2019-11-27. Critical severity, CVSS 9.4. EPSS: 1.1% chance of exploitation in the next 30 days. On BIG-IP ASM 15.0.0-15.0.1, 14.1.0-14.1.2, 14.0.0-14.0.1, and 13.1.0-13.1.3.1, BIG-IQ 6.0.0 and 5.2.0-5.4.0, iWorkflow 2.3.0, and Enterprise Manager 3.1.1, an attacker with access to the device…
CVE-2019-6663, published 2019-11-15. Medium severity, CVSS 5.5. EPSS: 0.6% chance of exploitation in the next 30 days. The BIG-IP 15.0.0-15.0.1, 14.0.0-14.1.2.2, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.1-11.6.5.1, BIG-IQ 7.0.0, 6.0.0-6.1.0, and 5.2.0-5.4.0, iWorkflow 2.3.0, and Enterprise Manager 3.1.1 configuration…
CVE-2018-12207, published 2019-11-14. Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days. Improper invalidation for page table updates by a virtual guest operating system for multiple Intel(R) Processors may allow an authenticated user to potentially enable denial of service of the host…
CVE-2019-6471, published 2019-10-09. Medium severity, CVSS 5.9. EPSS: 3.3% chance of exploitation in the next 30 days. A race condition which may occur when discarding malformed packets can result in BIND exiting due to a REQUIRE assertion failure in dispatch.c. Versions affected: BIND 9.11.0 -> 9.11.7, 9.12.0 ->…
CVE-2018-14880, published 2019-10-03. High severity, CVSS 7.5. EPSS: 5.3% chance of exploitation in the next 30 days. The OSPFv3 parser in tcpdump before 4.9.3 has a buffer over-read in print-ospf6.c:ospf6_print_lshdr().
CVE-2018-14468, published 2019-10-03. High severity, CVSS 7.5. EPSS: 4% chance of exploitation in the next 30 days. The FRF.16 parser in tcpdump before 4.9.3 has a buffer over-read in print-fr.c:mfr_print().