Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: Rapid7 Velociraptor 0.6.5-2 Clear all filters
TI-2022-16105 CVE-2022-35632 · GHSA-3jm3-3rrq-j9qm

XSS in User Interface

Priority LOW 23

The Velociraptor GUI contains an editor suggestion feature that can display the description field of a VQL function, plugin or artifact.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00487 Published 2022-07-29 Fixed in 0.6.5-2 CWE-79
TI-2022-16104 CVE-2022-35631 · GHSA-3wmf-q566-h69q

Filesystem race on temporary files

Priority LOW 24

On MacOS and Linux, it may be possible to perform a symlink attack by replacing this predictable file name with a symlink to another file and have the Velociraptor client overwrite the other file.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00231 Published 2022-07-29 Fixed in 0.6.5-2 CWE-377
TI-2022-16103 CVE-2022-35630 · GHSA-fx6m-m589-p668

Unsafe HTML Injection in Artifact Collection Report

Priority LOW 28

A cross-site scripting (XSS) issue in generating a collection report made it possible for malicious clients to inject JavaScript code into the static HTML file.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00504 Published 2022-07-29 Fixed in 0.6.5-2 CWE-79
TI-2022-16102 CVE-2022-35629 · GHSA-77f9-jv8v-xrjp

Velociraptor Client ID Spoofing

Priority LOW 25

Due to a bug in the handling of the communication between the client and server, it was possible for one client, already registered with their own client ID, to send messages to the server claiming to come from another c…

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00466 Published 2022-07-29 Fixed in 0.6.5-2 CWE-287