CVE-2022-29071

This advisory documents an internally found vulnerability in the on premises deployment model of Arista CloudVision Portal CVP where under a certain set of conditions, user passwords can be leaked in the Audit and System logs. The impact of this vulnerability is that the CVP user login passwords...

Security Advisory 0079

Security Advisory 0079 . CSAF PDF Date: July 26th, 2022 Revision | Date | Changes ---|---|--- 1.0 | July 26th 2022 | Initial release CVE-2022-2907 The CVE-ID tracking this issue: CVE-2022-29071 CVSSv3.1 Base Score: 4.0 AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Common Weakness Enumeration CWE: CWE-200...

Directory Traversal Vulnerability in Huijitong Cloud Vision of Beijing Zhongchuang Vision Technology Co.

Huijitong CloudVision is an operation-level cloud video platform developed by Beijing Zhongchuang Vision Technology Co., Ltd, which can simultaneously satisfy the zero distance of enterprise communication and collaboration. A directory traversal vulnerability exists in Huijitong CloudVision, whic...

Arbitrary file reading vulnerability exists in Saida Technology's CloudVision video conferencing terminal

Anhui Saida Technology Co., Ltd. focuses on intelligent cloud video industry, based on the network of communication carriers, using a new generation of information technology to create a "cloud video application engine", focusing on big data application platforms, intelligent terminal product...

Security Advisory 0062

Security Advisory 0062 PDF Updated: March 29th, 2021 Revision | Date | Changes ---|---|--- 1.0 | March 16th, 2021 | Initial Release 1.1 | March 29th, 2021 | -Telegraf removed from affected EOS features - Influxdb removed from affected components in MOS - Added config for SSL profile with trust...

Weak Password Vulnerability in CloudVision C21

CloudVision C21 is a security product under China Mobile, HD video conferencing terminal. CloudVision C21 suffers from a weak password vulnerability, which can be exploited by an attacker to log in directly and obtain critical information...

CVE-2020-13100

Arista’s CloudVision eXchange CVX server before 4.21.12M, 4.22.x before 4.22.7M, 4.23.x before 4.23.5M, and 4.24.x before 4.24.2F allows remote attackers to cause a denial of service crash and restart in the ControllerOob agent via a malformed control-plane packet...

CVE-2020-13100

Arista’s CloudVision eXchange CVX server before 4.21.12M, 4.22.x before 4.22.7M, 4.23.x before 4.23.5M, and 4.24.x before 4.24.2F allows remote attackers to cause a denial of service crash and restart in the ControllerOob agent via a malformed control-plane packet...

CVE-2020-13100

Arista’s CloudVision eXchange CVX server before 4.21.12M, 4.22.x before 4.22.7M, 4.23.x before 4.23.5M, and 4.24.x before 4.24.2F allows remote attackers to cause a denial of service crash and restart in the ControllerOob agent via a malformed control-plane packet...

Security Advisory 0052

Security Advisory 0052 PDF Date: October 7th, 2020 Version: 1.0 Revision | Date | Changes ---|---|--- 1.0 | October 7th, 2020 | Initial Release The CVE-ID tracking this issue is: CVE-2020-13100 CVSSv3 Base Score: 7.5/10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Description This advisory...

CVE-2020-24333

A vulnerability in Arista’s CloudVision Portal CVP prior to 2020.2 allows users with “read-only” or greater access rights to the Configlet Management module to download files not intended for access, located on the CVP server, by accessing a specific API...

CVE-2020-24333

A vulnerability in Arista’s CloudVision Portal CVP prior to 2020.2 allows users with “read-only” or greater access rights to the Configlet Management module to download files not intended for access, located on the CVP server, by accessing a specific API...

Design/Logic Flaw

A vulnerability in Arista’s CloudVision Portal CVP prior to 2020.2 allows users with “read-only” or greater access rights to the Configlet Management module to download files not intended for access, located on the CVP server, by accessing a specific API...

CVE-2020-24333

A vulnerability in Arista’s CloudVision Portal CVP prior to 2020.2 allows users with “read-only” or greater access rights to the Configlet Management module to download files not intended for access, located on the CVP server, by accessing a specific API...

CVE-2020-24333

The CVE-2020-24333 issue affects Arista’s CloudVision Portal (CVP) prior to 2020.2, where users with read-only or higher access to the Configlet Management module can download files not intended for access via a specific API. The vulnerability’s impact is the exposure of server-hosted files to au...

Security Advisory 0050

Security Advisory 0050 PDF Date: September 9th, 2020 Version: 1.0 Revision | Date | Changes ---|---|--- 1.0 | September 9th, 2020 | Initial Release The CVE-ID tracking this issue is: CVE-2020-13881 CVSSv3.1 Base Score: 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Description This advisory...

Security Advisory 0051

Security Advisory 0051 PDF Date: September 9th, 2020 Version: 1.0 Revision | Date | Changes ---|---|--- 1.0 | September 9th, 2020 | Initial Release The CVE-ID tracking this issue is: CVE-2020-24333 CVSSv3.1 Base Score: 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Description This advisory...

Arista Networks CloudVision Portal Multiple Vulnerabilities (SA0043)

The version of Arista Networks CloudVision Portal running on the remote device is affected by the following vulnerabilities: - HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service DoS. An unauthenticated, remote attacker can exploit this, by sending...

Arista Networks Networks CloudVision Portal IP fragment DoS (SA0037)

The version of Arista Networks CloudVision Portal running on the remote device is affected by a denial of service DoS vulnerability. The Linux kernel is vulnerable to a DoS attack with low rates of specially modified packets targeting IP fragment re-assembly. An remote, unauthenticated attacker c...

Arista Networks CloudVision Portal Incorrect Permissions (SA0035)

The version of Arista Networks CloudVision Portal running on the remote device is affected by an incorrect permissions vulnerability. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. To retrieve patch level information...