CVE Vulnerability Catalog

Kibana contains an authorization bypass vulnerability in the Fleet package installation process. A user with delegated Fleet package-management privileges can claim a data stream identifier already in use by another tenant, redirecting the victim's data to infrastructure controlled by the attacker.

Uncontrolled resource consumption in Elasticsearch allows a low-privileged user to crash a node with a crafted query causing uncontrolled memory growth. The condition can be triggered repeatedly, including via queries in shared resources, causing persistent cluster unavailability.

On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client can crash the portal service with a crafted HTTP request. The service restarts automatically, but a sustained low-rate attack can cause persistent denial of service. Remote code execution is not possible.

On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client can crash the portal service with a crafted HTTP request. This results in temporary denial of service until the service restarts automatically. Remote code execution is not possible.

Arista Wi-Fi access points contain a memory corruption vulnerability in the wired uplink network endpoints. An unauthenticated attacker on the same network segment can crash the sensor service or potentially achieve remote code execution.

Arista Wi-Fi access points contain a vulnerability in the capture service. An unauthenticated attacker with network access can send a crafted packet to crash the service or potentially achieve remote code execution. This requires an uncommon non-default streaming mode.

On affected Arista access points configured with VXLAN tunnelling and L2-proxy (a specific configuration unique to the VESPA use-case), a wireless client associated to the tunnelled SSID can send a crafted packet, causing the access point to reveal memory contents in network traffic. No write primitive or remote code execution is possible.

Arista access points with WIPS active contain a vulnerability that allows an unauthenticated attacker within RF proximity to send a crafted frame to crash the sensor service, disabling WIPS monitoring, or potentially achieve remote code execution. No wireless association or authentication is required.

Arista Wi-Fi access points with captive portal or application firewall enabled on at least one SSID contain a vulnerability in the wireless gateway service. An unauthenticated network-adjacent attacker can send a crafted packet that triggers a stack overflow, resulting in a denial-of-service condition or potentially execute arbitrary code on the device.

An unauthenticated attacker located on an adjacent private network (or any attacker routed through a reverse proxy/load balancer that forwards client headers) can forge their source IP address and gain administrative session privileges on the CV-CUE backend.

An operating system (OS) command injection vulnerability in CloudVision CUE backup management may allow an authenticated Super User to submit a crafted backup request and execute arbitrary commands with the privileges of the affected service.

An access-control flaw in the CV-CUE backend may allow an unauthenticated network attacker to access functionality intended only for internal services. Successful exploitation may expose sensitive location information or disrupt affected services.

Improper validation of selected CloudVision CUE API request parameters may allow an authenticated network user to perform SQL injection against the backend, impacting its availability.

An IDOR vulnerability in a CloudVision CUE file-serving interface may allow an authenticated network user, under specific attack conditions, to access another user's transient data.

Improper neutralization of LDAP authentication input may allow an unauthenticated network attacker, under high-complexity conditions, to inject queries against the configured directory service.

An XML External Entity (XXE) injection vulnerability in the WiFi-server Spectralight application allows any authenticated user to send malicious requests, leading to arbitrary local file disclosure and partial denial of service.

A missing input validation vulnerability in the Fileserver upload API allows an authenticated attacker with file upload privileges to execute stored cross-site scripting (XSS). Successful exploitation could enable the attacker to hijack another CloudVision user's web session, potentially granting full access to their account and administrative permissions.

A stored cross-site scripting (XSS) vulnerability may allow an unauthenticated attacker with adjacent-network access to inject malicious content that executes when an authenticated user views affected content. Successful exploitation may allow the attacker to compromise the victim's authenticated browser session, access sensitive data, modify system state, or disrupt affected services.

A stored cross-site scripting (XSS) vulnerability may allow an authenticated, high-privilege administrator to store malicious content in a configuration. The content may execute in another authenticated user's browser when that user views or compares the affected configuration. Successful exploitation may allow the attacker to act through the victim's authenticated browser session to access sensitive data, modify configurations, or disrupt managed wireless services.

An authenticated remote attacker with specific permissions can read or write files on the platform filesystem beyond the intended scope through specially crafted requests and/or crafted file uploads to the Software Management Studio Software Repository.