Attacks on Arista VeloCloud and Collabora/Nextcloud observed
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
CISA has added two actively exploited flaws to its known-exploited list: a SQL injection in Arista VeloCloud Orchestrator On-Premise, fixed in 5.2.3.18, 6.1.3.10 and 6.4.2.12, and an unauthenticated command injection in the Collabora Online Built-in CODE Server for Nextcloud, fixed in 26.4.303. Disabling the Nextcloud app does not mitigate the Collabora flaw, and the fixed app needs Nextcloud 30 or later. Issue-tracker reports of web shells suggest attacks since mid-September, though that is unverified. Until VCO is patched, restrict access and block the IPs Arista published.