Advisories · Technology
Rapid7 Velociraptor.
Every CVE that names Rapid7 Velociraptor among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.5 Medium
Velociraptor privilege escalation via SysmonLogForward client monitoring artifact
- Rapid7 Velociraptor
- Broken access control
- CVSS 6.5 Medium
Velociraptor Server Metadata update with Insufficient Permission Check
- Rapid7 Velociraptor
- Broken access control
- CVSS 4.9 Medium
WatchEvent API streams another organization's live events
- Rapid7 Velociraptor
- Broken access control
- CVSS 6.5 Medium
Velociraptor Authenticated Denial of Service
- Rapid7 Velociraptor
- Denial of service
- CVSS 3.6 Low
Velociraptor Prefetch parser out of bounds
- Rapid7 Velociraptor
- Memory corruption
- CWE-20
- CVSS 9.9 CriticalCritical · CVSS 9+
Velociraptor Investigator reaches SuperUser via hunt EffectivePrincipal
- Rapid7 Velociraptor
- CWE-164
- CWE-1269
- CVSS 7.7 High
Velociraptor VQL injection during notebook restore from backup
- Rapid7 Velociraptor
- Code injection
- CVSS 9.9 CriticalCritical · CVSS 9+
Velociraptor Required Permissions bypass by using client monitoring queries
- Rapid7 Velociraptor
- Broken access control
- CVSS 8.9 High
Velociraptor Analyst overwrites live built-in artifacts through verify()
- Rapid7 Velociraptor
- Code injection
- Broken access control
- CVSS 8.1 High
Velociraptor Stored XSS in URL column types
- Rapid7 Velociraptor
- CWE-177
- CVSS 6.5 Medium
Velociraptor STACK Type Download Path Bypasses Denied Prefix Check
- Rapid7 Velociraptor
- Broken access control
- CVSS 3.5 Low
Velociraptor DoS triggered by Divide by Zero panic
- Rapid7 Velociraptor
- Denial of service
- CVSS 6.5 Medium
Velociraptor Hunt Deletion With Insufficient Permission Check
- Rapid7 Velociraptor
- Broken access control
- CVSS 6.1 Medium
Velociraptor CSV Formula Injection in Export Pipeline
- Rapid7 Velociraptor
- Other injection
- CVSS 8.2 High
Velociraptor collect_client() Permissions Bypass
- Rapid7 Velociraptor
- Broken access control
- CVSS 7.3 High
Velociraptor OIDC Authenticator susceptible to email spoofing
- Rapid7 Velociraptor
- Authentication bypass
- CVSS 6.5 Medium
Velociraptor server crash via the SetPassword API
- Rapid7 Velociraptor
- Memory corruption
- CWE-703
- CVSS 7.1 High
Velociraptor directory traversal via the NewNotebook API
- Rapid7 Velociraptor
- Path traversal
- CVSS 8.7 High
Velociraptor incorrect Org deletion permissions check
- Rapid7 Velociraptor
- CWE-280
- CVSS 6.2 Medium
Velociraptor Multiple Crashes in NTFS Parser when applied to invalid NTFS Volumes
- Rapid7 Velociraptor
- Memory corruption
- Denial of service
- CVSS 6.8 Medium
Velociraptor VFSGetBuffer API path deny list bypass
- Rapid7 Velociraptor
- Authentication bypass
- CVSS 7.2 High
Velociraptor query plugin allows impersonation in other orgs
- Rapid7 Velociraptor
- Broken access control
- CVSS 9.6 CriticalCritical · CVSS 9+
Velociraptor authenticated identity-spoofing vulnerability
- Rapid7 Velociraptor
- Authentication bypass
- CVSS 4.1 Medium
Velociraptor NETWORK ACL bypass via upload_azure / upload_sftp / upload_smb VQL plugins
- Rapid7 Velociraptor
- Broken access control
- CVSS 7.8 High
Injection in Rapid7 Velociraptor
- Rapid7 Velociraptor
- Other injection
- Code injection
- CVSS 4.9 Medium
Unbounded Memory Allocation in VQLResponse Result-Set Writer
- Rapid7 Velociraptor
- Denial of service
- CVSS 8.5 High
Rapid7 Velociraptor Improper Input Validation in Client Message Handler
- Rapid7 Velociraptor
- CWE-20
- CVSS 6.8 Medium
Rapid7 Velociraptor Directory Traversal Vulnerability
- Rapid7 Velociraptor
- Path traversal
- CVSS 3.8 Low
Velociraptor Shell Plugin Prevent_execve Bypass
- Rapid7 Velociraptor
- CWE-281
- CVSS 8.6 High
Rapid7 Velociraptor Local Privilege Escalation In Windows Velociraptor Service
- Rapid7 Velociraptor
- Information disclosure
- Broken access control
- CVSS 8.6 High
Rapid7 Velociraptor Reflected XSS
- Rapid7 Velociraptor
- Cross-site scripting (XSS)
- CVSS 3.3 Low
Velociraptor crashes while parsing some malformed PE or OLE files.
- Rapid7 Velociraptor
- Memory corruption
-
XSS in User Interface
- Rapid7 Velociraptor
- Cross-site scripting (XSS)
-
Filesystem race on temporary files
- Rapid7 Velociraptor
- CWE-377
-
Unsafe HTML Injection in Artifact Collection Report
- Rapid7 Velociraptor
- Cross-site scripting (XSS)
-
Velociraptor Client ID Spoofing
- Rapid7 Velociraptor
- Authentication bypass
- CVSS 3.5 Low
Rapid7 Velociraptor Notebooks Authenticated Persistent XSS
- Rapid7 Velociraptor
- Cross-site scripting (XSS)