2025

Creativeitem Academy LMS up to and including 6.14 uses a hardcoded default JWT secret for token signing. This predictabl

Creativeitem Academy LMS up to and including 5.13 uses predictable password reset tokens based on Base64 encoded templat

In NetX Duo version before 6.4.4, the component of Eclipse Foundation ThreadX, there was an incorrect bound check result

A vulnerability was reported in the Lenovo LeCloud client application that, under certain conditions, could allow inform

A potential DLL hijacking vulnerability was discovered in the Lenovo PC Manager during an internal security assessment t

When a client SSL profile is configured on a virtual server, undisclosed requests can cause an increase in memory resour

When a per-request policy is configured on a BIG-IP APM portal access virtual server, undisclosed traffic can cause the

A vulnerability exists in the iHealth command that may allow an authenticated attacker with at least a resource administ

A vulnerability exists in F5OS-A and F5OS-C systems that may allow an authenticated attacker with local access to escala

Undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  This issue may occur when a Datagr

When a BIG-IP Advanced WAF or ASM security policy is configured with a URL greater than 1024 characters in length for th

When Diffie-Hellman (DH) group Elliptic Curve Cryptography (ECC) Brainpool curves are configured in an SSL profile's Cip

An out-of-bounds write vulnerability exists in F5OS-A and F5OS-C that could lead to memory corruption.  Note: Softw

When a highly-privileged, authenticated attacker attempts to initialize the rSeries FIPS module using a password with sp

When DNS cache is configured on a BIG-IP or BIG-IP Next CNF virtual server, undisclosed DNS queries can cause an increas

When the Allowed IP Addresses feature is configured on the F5OS-C partition control plane, undisclosed traffic can cause

A validation vulnerability exists in an undisclosed URL in the Configuration utility.  Note: Software versions which hav

A vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command that may allow an authentica

When a BIG-IP AFM denial-of-service (DoS) protection profile is configured on a virtual server, undisclosed requests can

A stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that

On the BIG-IP system, undisclosed endpoints that contain static non-sensitive information are accessible to an unauthent

When BIG-IP Advanced WAF is configured on a virtual server with Server-Side Request Forgery (SSRF) protection or when an

On BIG-IP systems, undisclosed traffic can cause data corruption and unauthorized data modification in protocols which d

Under undisclosed traffic conditions along with conditions beyond the attacker's control, hardware systems with a High-S

When HTTP/2 Ingress is configured, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. 

When the database variable tm.tcpudptxchecksum is configured as non-default value Software-only on a BIG-IP system, undi

Creativeitem Academy LMS up to and including 5.13 does not regenerate session IDs upon successful authentication, enabli

On BIG-IP Next CNF, BIG-IP Next SPK, and BIG-IP Next for Kubernetes systems, repeated undisclosed API calls can cause th

When the BIG-IP Advanced WAF and ASM security policy and a server-side HTTP/2 profile are configured on a virtual server

When BIG-IP SSL Orchestrator explicit forward proxy is configured on a virtual server and the proxy connect feature is e

When a BIG-IP Advanced WAF or BIG-IP ASM Security Policy is configured with a JSON content profile that has a malformed

When a BIG-IP APM OAuth access profile (Resource Server or Resource Client) is configured on a virtual server, undisclos

When an iRule is configured on a virtual server via the declarative API, upon re-instantiation, the cleanup process can

A directory traversal vulnerability exists in TMUI that allows a highly privileged authenticated attacker to access file

When a classification profile is configured on a virtual server without an HTTP or HTTP/2 profile, undisclosed requests

When running in Appliance mode, a highly privileged authenticated attacker with access to SCP and SFTP may be able to by

When a virtual server, network address translation (NAT) object, or secure network address translation (SNAT) object use

When a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Ex

When an iRule using an ILX::call command is configured on a virtual server, undisclosed traffic can cause the Traffic Ma

When a TCP profile with Multipath TCP (MPTCP) enabled is configured on a virtual server, undisclosed traffic along with

When SNMP is configured on F5OS Appliance and Chassis systems, undisclosed requests can cause an increase in SNMP memory

When the BIG-IP system is configured as both a Security Assertion Markup Language (SAML) service provider (SP) and Ident

When an iRule containing the HTTP::respond command is configured on a virtual server, undisclosed requests can cause an

When BIG-IP SSL Orchestrator is enabled, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to termi

A flaw was found in Samba, in the vfs_streams_xattr module, where uninitialized heap memory could be written into altern

Stored Cross-site Scripting (XSS) in Oct8ne Chatbot v2.3. This vulnerability allows an attacker to execute JavaScript co

In NetX Duo version before 6.4.4, the component of Eclipse Foundation ThreadX, there was a potential out of bound read i

In Eclipse Foundation NextX Duo before 6.4.4, a module of ThreadX, the _nx_secure_tls_process_clienthello() function was

The Orion SMS OTP Verification plugin for WordPress is vulnerable to privilege escalation via account takeover in all ve

The Oceanpayment CreditCard Gateway plugin for WordPress is vulnerable to unauthenticated and unauthorized modification