Known vulnerabilities in BIG-IP 15.0.1.0.33.11-ENG Hotfix

Software: BIG-IP
Version: 15.0.1.0.33.11-ENG Hotfix
Software CPE: cpe:2.3:h:f5_networks:big-ip:*:*:*:*:*:*:*:*
Total vulnerabilities: 115
Public exploits: 10
Known exploited (KEV): 2
Highest CVSSv4 Score: 9.4

Vulnerabilities by Severity

Severity distribution of vulnerabilities affecting BIG-IP version 15.0.1.0.33.11-ENG Hotfix BIG-IP 15.0.1.0.33.11-ENG Hotfix is affected by 115 vulnerabilities: 2 critical, 5 high, 66 medium, 42 low Critical High Medium Low

Vulnerabilities (115)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU124687 - Improper input validation
CVE-2025-53521
CWE-20 Critical
No
Exploited
15.1.10.8, 16.1.6.1, 17.1.3, 17.5.1.3 30.03.2026 SB2025101655
#VU117359 - Incomplete cleanup
CVE-2025-59781
CWE-459 Medium
No
No
15.1.10.8, 16.1.6, 17.1.2.2 17.10.2025 SB2025101759
#VU114086 - Resource exhaustion
CVE-2025-54500
CWE-400 Medium
No
No
16.1.6.0.27.3, 17.1.2.2.0.259.12, 17.5.1.0.80.7 14.08.2025 SB2025081450
SB2025081451
SB2025081452
#VU114083 - NULL Pointer Dereference
CVE-2025-52585
CWE-476 Medium
No
No
16.1.6, 17.1.2.2 14.08.2025 SB2025081428
#VU112734 - Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')
CVE-2024-42516
CWE-113 Low
No
No
- 10.07.2025 SB2025071040
SB2025071710
SB2025071764
and 33 more
#VU112733 - Server-Side Request Forgery (SSRF)
CVE-2024-43204
CWE-918 Low
No
No
- 10.07.2025 SB2025071040
SB2025071710
SB2025071764
and 27 more
#VU88151 - Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')
CVE-2023-38709
CWE-113 Medium
No
No
- 04.04.2024 SB2024040458
SB2024040502
SB2024040903
and 62 more
#VU87337 - Improper Restriction of XML External Entity Reference ('XXE')
CVE-2024-28757
CWE-611 Medium
No
No
17.1.2.2 11.03.2024 SB2024031135
SB2024031143
SB2024031144
and 72 more
#VU86707 - Server-Side Request Forgery (SSRF)
CVE-2024-24806
CWE-918 Medium
No
No
- 22.02.2024 SB2024022210
SB2024022214
SB2024022225
and 54 more
#VU82299 - Heap-based Buffer Overflow
CVE-2023-45853
CWE-122 Medium
No
No
- 23.10.2023 SB2023102325
SB2023102633
SB2023102634
and 40 more
#VU61246 - Use After Free
CVE-2021-4083
CWE-416 Low
No
No
17.5.1 10.03.2022 SB2022031029
SB2022031033
SB2022031034
and 55 more
#VU53231 - Integer overflow
CVE-2021-32027
CWE-190 Medium
No
No
17.1.1 13.05.2021 SB2021051316
SB2021051605
SB2021052507
and 43 more
#VU27052 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2020-11022
CWE-79 Low
Public exploit available
No
- 21.04.2020 SB2020042126
SB2020052033
SB2020052103
and 181 more
#VU25002 - Session Fixation
CVE-2019-17563
CWE-384 Low
No
No
- 06.02.2020 SB2019121315
SB2020011492
SB2020011519
and 16 more
#VU31958 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CVE-2019-18348
CWE-74 Medium
No
No
- 23.10.2019 SB2019102324
SB2020052312
SB2020042173
and 13 more
#VU18829 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
CVE-2019-9740
CWE-93 Medium
No
No
17.1.2.1, 17.5.1 19.06.2019 SB2019031318
SB2019062812
SB2019072603
and 32 more
#VU18828 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
CVE-2019-9947
CWE-93 Medium
No
No
- 19.06.2019 SB2019031318
SB2019062812
SB2019072603
and 22 more
#VU17105 - Improper input validation
CVE-2016-10739
CWE-20 Low
No
No
- 22.01.2019 SB2019012201
SB2019042102
SB2019080723
and 9 more
#VU6663 - Out-of-bounds read
CVE-2016-9840
CWE-125 Low
No
No
- 24.05.2017 SB2017052312
SB2017052405
SB2017052406
and 47 more
#VU6664 - Out-of-bounds read
CVE-2016-9841
CWE-125 Low
No
No
- 24.05.2017 SB2017052312
SB2017052405
SB2017052406
and 34 more


Showing elements 1 - 20 out of 115