Monthly
WAF rule bypass in ModSecurity 3.0.0-3.0.15 on i386 architecture allows network-accessible attackers to evade rules that use the t:utf8toUnicode transformation, potentially permitting injection attacks or other malicious payloads to reach protected applications undetected. The root cause is CWE-467 - sizeof() applied to a char pointer in utf8_to_unicode.cc yields the pointer width (4 bytes on i386) rather than the unicode buffer length, corrupting transformation output. No public exploit code or active exploitation has been identified at time of analysis; the fix is available in v3.0.16.
IBM DB2 High Performance Unload (HPU) contains a denial-of-service vulnerability that allows an authenticated remote user to crash the utility by triggering an incorrect pointer-size calculation. The flaw, tracked as CWE-467, has a CVSS score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), meaning it requires valid credentials, can be exploited over the network, and impacts only availability with no confidentiality or integrity loss. EPSS is 0.31% (21st percentile) and no public exploit code has been identified, so this is a moderate, availability-only issue that is not a priority for emergency patching.
The FPC (Flexible PIC Concentrator) of Juniper Networks Junos OS and Junos OS Evolved may restart after processing a specific IPv4 packet. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
WAF rule bypass in ModSecurity 3.0.0-3.0.15 on i386 architecture allows network-accessible attackers to evade rules that use the t:utf8toUnicode transformation, potentially permitting injection attacks or other malicious payloads to reach protected applications undetected. The root cause is CWE-467 - sizeof() applied to a char pointer in utf8_to_unicode.cc yields the pointer width (4 bytes on i386) rather than the unicode buffer length, corrupting transformation output. No public exploit code or active exploitation has been identified at time of analysis; the fix is available in v3.0.16.
IBM DB2 High Performance Unload (HPU) contains a denial-of-service vulnerability that allows an authenticated remote user to crash the utility by triggering an incorrect pointer-size calculation. The flaw, tracked as CWE-467, has a CVSS score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), meaning it requires valid credentials, can be exploited over the network, and impacts only availability with no confidentiality or integrity loss. EPSS is 0.31% (21st percentile) and no public exploit code has been identified, so this is a moderate, availability-only issue that is not a priority for emergency patching.
The FPC (Flexible PIC Concentrator) of Juniper Networks Junos OS and Junos OS Evolved may restart after processing a specific IPv4 packet. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.