An authenticated attacker with guest privileges or higher can cause the iControl SOAP process to terminate by sending undisclosed requests.

Multiple reflected cross-site scripting (XSS) vulnerabilities exist in undisclosed pages of the BIG-IP Configuration utility that allow an attacker to run JavaScript in the context of the currently logged-in user.

A directory traversal vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that may allow an authenticated attacker to read files with an .xml extension. Access to restricted information is limited and the attacker does not control what information is obtained.

A reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user.

A cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user.

When a UDP profile with Idle Timeout set to Immediate or the value 0 is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.