F5 Iworkflow vulnerabilities

17 CVEs affecting F5 Iworkflow, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-5854, published 2020-02-06.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-14634: Linux Kernel Integer Overflow Vulnerability, published 2018-09-25. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2026-01-26. EPSS: 14.7% chance of exploitation in the next 30 days. An integer overflow flaw was found in the Linux kernel's create_elf_tables() function. An unprivileged local user with access to SUID (or otherwise privileged) binary could use this flaw to escalate…
CVE-2019-11479, published 2019-06-19. High severity, CVSS 7.5. EPSS: 91.7% chance of exploitation in the next 30 days. Jonathan Looney discovered that the Linux kernel default MSS is hard-coded to 48 bytes. This allows a remote peer to fragment TCP resend queues significantly more than if a larger MSS were enforced.…
CVE-2018-5743, published 2019-10-09. High severity, CVSS 7.5. EPSS: 6.5% chance of exploitation in the next 30 days. By design, BIND is intended to limit the number of TCP clients that can be connected at any given time. The number of allowed connections is a tunable parameter which, if unset, defaults to a…
CVE-2018-14880, published 2019-10-03. High severity, CVSS 7.5. EPSS: 5.3% chance of exploitation in the next 30 days. The OSPFv3 parser in tcpdump before 4.9.3 has a buffer over-read in print-ospf6.c:ospf6_print_lshdr().
CVE-2019-10744, published 2019-07-26. Critical severity, CVSS 9.1. EPSS: 5% chance of exploitation in the next 30 days. Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor…
CVE-2018-14468, published 2019-10-03. High severity, CVSS 7.5. EPSS: 4% chance of exploitation in the next 30 days. The FRF.16 parser in tcpdump before 4.9.3 has a buffer over-read in print-fr.c:mfr_print().
CVE-2019-6471, published 2019-10-09. Medium severity, CVSS 5.9. EPSS: 3.3% chance of exploitation in the next 30 days. A race condition which may occur when discarding malformed packets can result in BIND exiting due to a REQUIRE assertion failure in dispatch.c. Versions affected: BIND 9.11.0 -> 9.11.7, 9.12.0 ->…
CVE-2014-5209, published 2020-01-08. Medium severity, CVSS 5.3. EPSS: 2.5% chance of exploitation in the next 30 days. An Information Disclosure vulnerability exists in NTP 4.2.7p25 private (mode 6/7) messages via a GET_RESTRICT control message, which could let a malicious user obtain sensitive information.
CVE-2018-15328, published 2018-12-12. High severity, CVSS 7.5. EPSS: 2.3% chance of exploitation in the next 30 days. On BIG-IP 14.0.x, 13.x, 12.x, and 11.x, Enterprise Manager 3.1.1, BIG-IQ 6.x, 5.x, and 4.x, and iWorkflow 2.x, the passphrases for SNMPv3 users and trap destinations that are used for authentication…
CVE-2019-6642, published 2019-07-01. High severity, CVSS 8.8. EPSS: 1.8% chance of exploitation in the next 30 days. In BIG-IP 15.0.0, 14.0.0-14.1.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.2, and 11.5.2-11.6.4, BIG-IQ 6.0.0-6.1.0 and 5.1.0-5.4.0, iWorkflow 2.3.0, and Enterprise Manager 3.1.1, authenticated users with the…

Latest

CVE-2020-5854, published 2020-02-06. Medium severity, CVSS 5.9. EPSS: 0.8% chance of exploitation in the next 30 days. On BIG-IP 15.0.0-15.0.1.1, 14.1.0-14.1.2.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.6.0-11.6.5.1, the tmm crashes under certain circumstances when using the connector profile if a…
CVE-2019-19151, published 2019-12-23. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. On BIG-IP versions 15.0.0-15.1.0, 14.0.0-14.1.2.3, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, BIG-IQ versions 7.0.0, 6.0.0-6.1.0, and 5.0.0-5.4.0, iWorkflow version 2.3.0, and Enterprise…
CVE-2019-6665, published 2019-11-27. Critical severity, CVSS 9.4. EPSS: 1.1% chance of exploitation in the next 30 days. On BIG-IP ASM 15.0.0-15.0.1, 14.1.0-14.1.2, 14.0.0-14.0.1, and 13.1.0-13.1.3.1, BIG-IQ 6.0.0 and 5.2.0-5.4.0, iWorkflow 2.3.0, and Enterprise Manager 3.1.1, an attacker with access to the device…
CVE-2019-6663, published 2019-11-15. Medium severity, CVSS 5.5. EPSS: 0.6% chance of exploitation in the next 30 days. The BIG-IP 15.0.0-15.0.1, 14.0.0-14.1.2.2, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.1-11.6.5.1, BIG-IQ 7.0.0, 6.0.0-6.1.0, and 5.2.0-5.4.0, iWorkflow 2.3.0, and Enterprise Manager 3.1.1 configuration…
CVE-2019-6651, published 2019-09-25. Medium severity, CVSS 5.3. EPSS: 1.1% chance of exploitation in the next 30 days. In BIG-IP 15.0.0, 14.1.0-14.1.0.6, 14.0.0-14.0.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.1, 11.5.1-11.6.4, BIG-IQ 7.0.0, 6.0.0-6.1.0,5.2.0-5.4.0, iWorkflow 2.3.0, and Enterprise Manager 3.1.1, the…