Monthly
A network-based, unauthenticated attacker can cause a temporary denial of service on Juniper Networks SRX Series devices running Junos OS when the SSL proxy feature is enabled. During a TLS session-resumption attempt, a specifically malformed TLS message triggers an improper handling of a missing special element in the SSL plugin, leading to an invalid pointer access and a Packet Forwarding Engine (PFE) crash that interrupts traffic forwarding until the PFE automatically recovers. Exploitation is conditional: it requires the non-default 'ssl-proxy' configuration, and the exact internal timing needed to hit the fault is outside the attacker's direct control, making the attack probabilistic rather than reliably repeatable; no public exploit identified at time of analysis and there is no impact to confidentiality or integrity, only availability. Vendor-released patches are available in the fixed Junos OS releases listed in advisory JSA112176.
.NET applications are vulnerable to spoofing attacks due to improper validation of a required security element, allowing unauthenticated remote attackers to forge or manipulate application data over the network. This vulnerability affects multiple .NET versions and currently has no available patch, exposing organizations to authentication bypass and data integrity risks. The attack requires no user interaction and can be exploited directly from the network.
Microsoft WS-Discovery Denial of Service Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A network-based, unauthenticated attacker can cause a temporary denial of service on Juniper Networks SRX Series devices running Junos OS when the SSL proxy feature is enabled. During a TLS session-resumption attempt, a specifically malformed TLS message triggers an improper handling of a missing special element in the SSL plugin, leading to an invalid pointer access and a Packet Forwarding Engine (PFE) crash that interrupts traffic forwarding until the PFE automatically recovers. Exploitation is conditional: it requires the non-default 'ssl-proxy' configuration, and the exact internal timing needed to hit the fault is outside the attacker's direct control, making the attack probabilistic rather than reliably repeatable; no public exploit identified at time of analysis and there is no impact to confidentiality or integrity, only availability. Vendor-released patches are available in the fixed Junos OS releases listed in advisory JSA112176.
.NET applications are vulnerable to spoofing attacks due to improper validation of a required security element, allowing unauthenticated remote attackers to forge or manipulate application data over the network. This vulnerability affects multiple .NET versions and currently has no available patch, exposing organizations to authentication bypass and data integrity risks. The attack requires no user interaction and can be exploited directly from the network.
Microsoft WS-Discovery Denial of Service Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.