Search
Search Results (5 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-86107 | 1 Arista | 2 Velocloud, Velocloud Gateway | 2026-09-17 | 5.9 Medium |
| The VeloCloud Edge and Gateway exhibit an out-of-bounds write vulnerability when processing tunneled IP fragments between authenticated overlay neighbors. This vulnerability impacts the VeloCloud VCMP tunnel protocol only. A successful exploit can cause the affected process to terminate and restart, leading to a temporary disruption of traffic. Hosts on the internet that are unauthenticated and unable to form an overlay peer relationship can not trigger the vulnerable logic. | ||||
| CVE-2026-86106 | 1 Arista | 1 Velocloud Edge | 2026-09-17 | 9.6 Critical |
| An unauthenticated actor with network access to the private HA interconnect may trigger sensitive HA peer functions without verification. This could result in elevated command execution on Edge units where HA is enabled. | ||||
| CVE-2026-31431 | 10 Amazon, Arista, Canonical and 7 more | 60 Amazon Linux, Cloudvision Agni, Cloudvision Portal and 57 more | 2026-09-08 | 7.8 High |
| In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly. | ||||
| CVE-2026-16812 | 2 Arista, Arista Networks | 2 Velocloud Orchestrator, Velocloud Orchestrator On-prem | 2026-07-27 | 10 Critical |
| VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. This functionality was intended to be for internal use only and is not intended to be remotely accessible. Hosted and Dedicated versions of VCO have already been patched in advance of this notice going out. This issue was discovered externally and is known to be actively exploited. | ||||
| CVE-2020-3973 | 2 Arista, Linux | 2 Velocloud Orchestrator, Linux Kernel | 2024-11-21 | 8.8 High |
| The VeloCloud Orchestrator does not apply correct input validation which allows for blind SQL-injection. A malicious actor with tenant access to Velocloud Orchestrator could enter specially crafted SQL queries and obtain data to which they are not privileged. | ||||
Page 1 of 1.