Known vulnerabilities in NGINX Controller

Vendor: F5 Networks
Software: NGINX Controller
Software CPE: cpe:2.3:a:f5_networks:nginx_controller:*:*:*:*:*:*:*:*
Website: https://f5.com/
Total vulnerabilities: 16
Public exploits: 0
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting NGINX Controller NGINX Controller is affected by 16 known vulnerabilities: 3 high, 8 medium, 5 low Critical High Medium Low

Vulnerabilities (16)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU53577 - Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
CVE-2021-23020		 CWE-338 Low
No
No
 3.10.0 25.05.2021 SB2021052547
SB2022092207
#VU53576 - Incorrect Default Permissions
CVE-2021-23021		 CWE-276 Low
No
No
 3.7.0 25.05.2021 SB2021052546
SB2022092207
#VU53575 - Cleartext Storage of Sensitive Information
CVE-2021-23019		 CWE-312 High
No
No
 3.15.0 25.05.2021 SB2021052545
SB2022092207
#VU49051 - Untrusted Search Path
CVE-2020-27730		 CWE-426 Low
No
No
 3.10.0 11.12.2020 SB2020121707
#VU34177 - Improper Certificate Validation
CVE-2020-5909		 CWE-295 Medium
No
No
 3.6.0 02.07.2020 SB2020070148
#VU34178 - Improper Authentication
CVE-2020-5910		 CWE-287 Medium
No
No
 3.6.0 02.07.2020 SB2020070148
#VU34179 - Improper input validation
CVE-2020-5911		 CWE-20 Medium
No
No
 3.6.0 02.07.2020 SB2020070148
#VU34183 - Cross-Site Request Forgery (CSRF)
CVE-2020-5900		 CWE-352 High
No
No
 3.6.0 01.07.2020 SB2020070148
#VU27575 - Incorrect Default Permissions
 CWE-276 Low
No
No
 3.4.0 06.05.2020 SB2020050623
#VU27574 - Insufficient Session Expiration
CVE-2020-5894		 CWE-613 Medium
No
No
 3.4.0 06.05.2020 SB2020050623
#VU27573 - Memory corruption
CVE-2020-5895		 CWE-119 High
No
No
 3.4.0 06.05.2020 SB2020050623
#VU27303 - Channel Accessible by Non-Endpoint ('Man-in-the-Middle')
CVE-2020-5867		 CWE-300 Medium
No
No
 3.3.0 24.04.2020 SB2020042407
#VU27302 - Exposure of sensitive information to an unauthorized actor
CVE-2020-5866		 CWE-200 Low
No
No
 3.3.0 24.04.2020 SB2020042407
#VU27301 - Channel Accessible by Non-Endpoint ('Man-in-the-Middle')
CVE-2020-5865		 CWE-300 Medium
No
No
 3.3.0 24.04.2020 SB2020042407
#VU27300 - Improper Certificate Validation
CVE-2020-5864		 CWE-295 Medium
No
No
 3.2.0 24.04.2020 SB2020042406
#VU26263 - Improper Authorization
CVE-2020-5863		 CWE-285 Medium
No
No
 3.2.0 20.03.2020 SB2020042406