Vserver
Monthly
Velneo vServer can be knocked into a denial-of-service state by unauthenticated network traffic that exploits improper validation of an array index (CWE-129) in the server's request handling. Only installations running the 36.x branch before 36.6 or the 37.x branch before 37.2 are affected, and the assessed impact is availability-only (CVSS 4.0 8.7, VA:H with VC:N/VI:N) - there is no demonstrated path to data disclosure, tampering, or code execution from this flaw alone. Vendor fixes are published in Velneo's security advisories, and no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Authenticated low-privilege users of Velneo vServer can disclose server-side files readable by the vServer process through improper link resolution before file access, a symlink/link-following flaw. The issue affects vServer releases from 32.3 before 36.6 and from 37.1 before 37.2; exploitation requires a valid low-privileged account and a specific precondition to induce server-side path resolution of an attacker-influenced link. The vendor CVSS 4.0 base score is 6.0 and the independent assessment is moderate with confidentiality-only impact; no public exploit was identified at time of analysis, and a vendor patch is available through Velneo security advisories.
Velneo vServer can be knocked into a denial-of-service state by unauthenticated network traffic that exploits improper validation of an array index (CWE-129) in the server's request handling. Only installations running the 36.x branch before 36.6 or the 37.x branch before 37.2 are affected, and the assessed impact is availability-only (CVSS 4.0 8.7, VA:H with VC:N/VI:N) - there is no demonstrated path to data disclosure, tampering, or code execution from this flaw alone. Vendor fixes are published in Velneo's security advisories, and no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Authenticated low-privilege users of Velneo vServer can disclose server-side files readable by the vServer process through improper link resolution before file access, a symlink/link-following flaw. The issue affects vServer releases from 32.3 before 36.6 and from 37.1 before 37.2; exploitation requires a valid low-privileged account and a specific precondition to induce server-side path resolution of an attacker-influenced link. The vendor CVSS 4.0 base score is 6.0 and the independent assessment is moderate with confidentiality-only impact; no public exploit was identified at time of analysis, and a vendor patch is available through Velneo security advisories.