Vulnerabilities > Rapid7 > Velociraptor > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2023-11-06 | CVE-2023-5950 | Cross-site Scripting vulnerability in Rapid7 Velociraptor Rapid7 Velociraptor versions prior to 0.7.0-4 suffer from a reflected cross site scripting vulnerability. | 6.1 |
| 2023-04-21 | CVE-2023-2226 | Out-of-bounds Read vulnerability in Rapid7 Velociraptor Due to insufficient validation in the PE and OLE parsers in Rapid7's Velociraptor versions earlier than 0.6.8 allows attacker to crash Velociraptor during parsing of maliciously malformed files. For this attack to succeed, the attacker needs to be able to introduce malicious files to the system at the same time that Velociraptor attempts to collect any artifacts that attempt to parse PE files, Authenticode signatures, or OLE files. | 5.3 |
| 2023-01-18 | CVE-2023-0290 | Path Traversal vulnerability in Rapid7 Velociraptor Rapid7 Velociraptor did not properly sanitize the client ID parameter to the CreateCollection API, allowing a directory traversal in where the collection task could be written. | 4.3 |
| 2022-07-29 | CVE-2022-35629 | Authentication Bypass by Spoofing vulnerability in Rapid7 Velociraptor Due to a bug in the handling of the communication between the client and server, it was possible for one client, already registered with their own client ID, to send messages to the server claiming to come from another client ID. | 5.4 |
| 2022-07-29 | CVE-2022-35630 | Cross-site Scripting vulnerability in Rapid7 Velociraptor A cross-site scripting (XSS) issue in generating a collection report made it possible for malicious clients to inject JavaScript code into the static HTML file. | 6.1 |
| 2022-07-29 | CVE-2022-35631 | Link Following vulnerability in Rapid7 Velociraptor On MacOS and Linux, it may be possible to perform a symlink attack by replacing this predictable file name with a symlink to another file and have the Velociraptor client overwrite the other file. | 5.5 |
| 2022-07-29 | CVE-2022-35632 | Cross-site Scripting vulnerability in Rapid7 Velociraptor The Velociraptor GUI contains an editor suggestion feature that can display the description field of a VQL function, plugin or artifact. | 4.8 |
| 2021-07-22 | CVE-2021-3619 | Cross-site Scripting vulnerability in Rapid7 Velociraptor Rapid7 Velociraptor 0.5.9 and prior is vulnerable to a post-authentication persistent cross-site scripting (XSS) issue, where an authenticated user could abuse MIME filetype sniffing to embed executable code on a malicious upload. | 4.8 |