F5 security advisories, May 2023

Every F5 security advisory published in May 2023, from F5 SIRT ([email protected] CNA) via NVD, with its severity, CVEs and CISA KEV status. Open a record for affected and fixed versions and the vendor's own link.

Advisories: 10
Critical: 0
High: 6
In CISA KEV: 0
CVEs: 10

F5 advisories published in May 2023

May 3, 2023
High [CVE-2023-29163] When UDP profile with idle timeout set to immediate or the value 0 is configured on a virtual server, undisclosed traffic
High7.5
May 3, 2023
High [CVE-2023-28742] When DNS is provisioned, an authenticated remote command execution vulnerability exists in DNS iQuery mesh.
High7.2
May 3, 2023
High [CVE-2023-28724] NGINX Management Suite default file permissions are set such that an authenticated attacker
High7.1
May 3, 2023
High [CVE-2023-28656] NGINX Management Suite may
High8.1
May 3, 2023
High [CVE-2023-27378] Multiple reflected cross-site scripting (XSS) vulnerabilities exist in undisclosed pages of the BIG-IP Configuration utility which
High7.5
May 3, 2023
High [CVE-2023-24461] improper certificate validation vulnerability exists in the BIG-IP Edge Client for Windows and macOS and may
High7.4
May 3, 2023
Medium [CVE-2023-29240] authenticated attacker granted a Viewer or Auditor role on a BIG-IQ
Medium5.4
May 3, 2023
Medium [CVE-2023-28406] directory traversal vulnerability exists in an undisclosed page of the BIG-IP Configuration utility which may
Medium4.3
May 3, 2023
Medium [CVE-2023-24594] When an SSL profile is configured on a Virtual Server, undisclosed traffic
Medium5.3
May 3, 2023
Medium [CVE-2023-22372] In the pre connection stage, an improper enforcement of message integrity vulnerability exists in BIG-IP Edge Client for Windows…
Medium5.9

Get an email when F5 publishes the next one.

See F5's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).

Alert me about F5

Dates are each advisory's publication date at the source, in UTC; a record with no source date is filed under the day VulniPulse first saw it.