https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 09:33:20 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-227024 EUVD-2026-227024 https://cve.radiocsirt.org/vuln/euvd-2026-227024 https://cve.radiocsirt.org/vuln/fkie_cve-2023-0290 <p>Rapid7 Velociraptor did not properly sanitize the client ID parameter to the CreateCollection API, allowing a directory traversal in where the collection task could be written. It was possible to provide a client id of &#34;../clients/server&#34; to schedule the collection for the server (as a server artifact), but only require privileges to schedule collections on the client.</p> <p>Normally, to schedule an artifact on the server, the COLLECT_SERVER permission is required. This permission is normally only granted to &#34;administrator&#34; role. Due to this issue, it is sufficient to have the COLLECT_CLIENT privilege, which is normally granted to the &#34;investigator&#34; role. To exploit this vulnerability, the attacker must already have a Velociraptor user account at least &#34;investigator&#34; level, and be able to authenticate to the GUI and issue an API call to the backend. Typically, most users deploy Velociraptor with limited access to a trusted group, and most users will already be administrators within the GUI.</p> <p>This issue affects Velociraptor versions before 0.6.7-5. Version 0.6.7-5, released January 16, 2023, fixes the issue.</p> <p>Rapid7 Velociraptor did not properly sanitize the client ID parameter to the CreateCollection API, allowing a directory traversal in where the collection task could be written. It was possible to provide a client id of &#34;../clients/server&#34; to schedule the collection for the server (as a server artifact), but only require privileges to schedule collections on the client.</p> <p>Normally, to schedule an artifact on the server, the COLLECT_SERVER permission is required. This permission is normally only granted to &#34;administrator&#34; role. Due to this issue, it is sufficient to have the COLLECT_CLIENT privilege, which is normally granted to the &#34;investigator&#34; role. To exploit this vulnerability, the attacker must already have a Velociraptor user account at least &#34;investigator&#34; level, and be able to authenticate to the GUI and issue an API call to the backend. Typically, most users deploy Velociraptor with limited access to a trusted group, and most users will already be administrators within the GUI.</p> <p>This issue affects Velociraptor versions before 0.6.7-5. Version 0.6.7-5, released January 16, 2023, fixes the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-0290 https://cve.radiocsirt.org/vuln/ghsa-7jf5-fvgf-48c6 <p><strong>Affected:</strong> Go: www.velocidex.com/golang/velociraptor</p> <p>Rapid7 Velociraptor did not properly sanitize the client ID parameter to the CreateCollection API, allowing a directory traversal in where the collection task could be written. It was possible to provide a client id of &#34;../clients/server&#34; to schedule the collection for the server (as a server artifact), but only require privileges to schedule collections on the client. Normally, to schedule an artifact on the server, the COLLECT_SERVER permission is required. This permission is normally only granted to &#34;administrator&#34; role. Due to this issue, it is sufficient to have the COLLECT_CLIENT privilege, which is normally granted to the &#34;investigator&#34; role. To exploit this vulnerability, the attacker must already have a Velociraptor user account at least &#34;investigator&#34; level, and be able to authenticate to the GUI and issue an API call to the backend. Typically, most users deploy Velociraptor with limited access to a trusted group, and most users will already be administrators within the GUI. This issue affects Velociraptor versions before 0.6.7-5. Version 0.6.7-5, released January 16, 2023, fixes the issue.</p> <p><strong>Affected:</strong> Go: www.velocidex.com/golang/velociraptor</p> <p>Rapid7 Velociraptor did not properly sanitize the client ID parameter to the CreateCollection API, allowing a directory traversal in where the collection task could be written. It was possible to provide a client id of &#34;../clients/server&#34; to schedule the collection for the server (as a server artifact), but only require privileges to schedule collections on the client. Normally, to schedule an artifact on the server, the COLLECT_SERVER permission is required. This permission is normally only granted to &#34;administrator&#34; role. Due to this issue, it is sufficient to have the COLLECT_CLIENT privilege, which is normally granted to the &#34;investigator&#34; role. To exploit this vulnerability, the attacker must already have a Velociraptor user account at least &#34;investigator&#34; level, and be able to authenticate to the GUI and issue an API call to the backend. Typically, most users deploy Velociraptor with limited access to a trusted group, and most users will already be administrators within the GUI. This issue affects Velociraptor versions before 0.6.7-5. Version 0.6.7-5, released January 16, 2023, fixes the issue.</p> https://cve.radiocsirt.org/vuln/ghsa-7jf5-fvgf-48c6 https://cve.radiocsirt.org/vuln/gsd-2023-0290 gsd-2023-0290 https://cve.radiocsirt.org/vuln/gsd-2023-0290