Arista Warns of Critical SQL Injection in VeloCloud Orchestrator On-Premises Deployments

·2 views

Arista has disclosed CVE-2026-114625, a critical SQL injection flaw in VeloCloud Orchestrator, with CVSS 3.1 at 9.9 and CVSS 4.0 at 9.4. Fixes are available only in builds 5.2.3.18, 6.1.3.10 and 6.4.2.12 for the respective release trains, and the vendor has already patched hosted and dedicated orchestrators. Because on-premises deployments must be updated manually, organizations running these versions need to act, and earlier fixes from July and September 2026 do not cover this flaw. The vulnerability requires low-privilege authenticated access, so credential management is also relevant, and releases past end of support were not assessed. Interim steps include restricting access to the web interface and reviewing administrator activity until a patch can be applied.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Claude Code MCP Setup: Where Server Configuration Lives and How Scopes Conflict

Claude Code must know about an MCP server through configuration before it can connect to it. Definitions can be stored at project, user, or local scope, or be provided centrally by an organization, depending on who should use them. A project's shared .mcp.json file can declare a team's server without exposing personal credentials, while local scope keeps individual secrets private to one project. When the same server name appears in several scopes, Claude Code uses the complete entry from the highest-precedence source rather than merging fields. Organization-managed definitions override the other sources when duplicated.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Track Your Net Worth Monthly in Google Sheets With Assets, Debts, and a Growth Chart

Net worth, the gap between what you own and what you owe, is presented as a clearer indicator of financial direction than bank balance alone. The guide walks readers through building a monthly tracker in Google Sheets, with an accounts list tagged as assets or debts and a column for each month. Formulas total assets and debts, calculate net worth and its monthly change, and compute a debt ratio that the author suggests keeping below 50%. A line chart of net worth over time and a category breakdown with a pie chart are also described. The article closes with a promotion for the author's own paid and free budget templates.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why specific names beat generic ones, from a murder statue to IKEA

An essay argues that naming something gives people a handle on it, even when the thing is dangerous. It contrasts the nickname 'Peanut' for a deadly statue in a horror story with the template-generated names common among software companies. The author contends that generic, consultant-style names fit everyone and so tell no one anything. The piece cites IKEA's place-based and occupation-based naming as an example of specificity that scales, and suggests specific names are easier to remember and repeat.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

BlockVectra Data API TypeScript client v0.1.3 rejects missing API keys at startup

The BlockVectra Data API TypeScript client now throws an error when it is created with a missing, empty or whitespace-only key, catching configuration mistakes before the first request. Non-empty keys are passed through unchanged, with validity still checked by the API itself. Version 0.1.3 is distributed as a prebuilt GitHub package, not yet through npm's public registry, and includes JavaScript and TypeScript declarations. The release also adds an isDataApiError guard that identifies structured JSON error responses while preserving the original HTTP status. The developers note that the release passed unit tests and example checks, but the credentialed live API test was skipped.

0 comments Read more at DEV Community