Velociraptor Investigator reaches SuperUser via hunt EffectivePrincipal

Velociraptor Required Permissions bypass by using client monitoring queries

Velociraptor authenticated identity-spoofing vulnerability

Velociraptor Query() Plugin Misapplies Permissions To Orgs

Velociraptor Analyst overwrites live built-in artifacts through verify()

Rapid7 Velociraptor allows users to be created with different privileges on the server

Velociraptor incorrect Org deletion permissions check

Velociraptor collect_client() Permissions Bypass

Velociraptor Stored XSS in URL column types

A YAML injection vulnerability exists in the Windows.Collectors.Remapping artifact of Rapid7 Velociraptor before version 0.76.6

Velociraptor VQL injection during notebook restore from backup

GetUserRoles API endpoint allows any authenticated user to enumerate ACL policies across all organizations

Velociraptor OIDC Authenticator susceptible to email spoofing

Velociraptor query plugin allows impersonation in other orgs

Velociraptor directory traversal via the NewNotebook API

Velociraptor VFSGetBuffer API path deny list bypass

HTTP Filestore Endpoints Misapply Permissions Across Organizations

Rapid7 Velociraptor Directory Traversal Vulnerability

Velociraptor Server Metadata update with Insufficient Permission Check

Velociraptor Authenticated Denial of Service

Velociraptor STACK Type Download Path Bypasses Denied Prefix Check

Velociraptor Hunt Deletion With Insufficient Permission Check

Velociraptor server crash via the SetPassword API

Rapid7 Velociraptor Improper Input Validation in Client Message Handler

Velociraptor Multiple Crashes in NTFS Parser when applied to invalid NTFS Volumes

Velociraptor CSV Formula Injection in Export Pipeline

Rapid7 Velociraptor versions prior to 0.7.0-4 suffer from a reflected cross site scripting vulnerability

A cross-site scripting (XSS) issue in generating a collection report made it possible for malicious clients to inject JavaScript code into the static HTML file

Velociraptor privilege escalation via SysmonLogForward client monitoring artifact

Velociraptor EVTX Parser — Process Crash via Crafted .evtx File

Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints

On MacOS and Linux, it may be possible to perform a symlink attack by replacing this predictable file name with a symlink to another file and have the Velociraptor client…

Due to a bug in the handling of the communication between the client and server, it was possible for one client, already registered with their own client ID, to send messages to…

Due to insufficient validation in the PE and OLE parsers in Rapid7's Velociraptor versions earlier than 0.6.8 allows attacker to crash Velociraptor during parsing of maliciously…

WatchEvent API streams another organization's live events

Unbounded Memory Allocation in VQLResponse Result-Set Writer

The Velociraptor GUI contains an editor suggestion feature that can display the description field of a VQL function, plugin or artifact

Rapid7 Velociraptor 0.5.9 and prior is vulnerable to a post-authentication persistent cross-site scripting (XSS) issue, where an authenticated user could abuse MIME filetype…

Rapid7 Velociraptor did not properly sanitize the client ID parameter to the CreateCollection API, allowing a directory traversal in where the collection task could be written

Velociraptor NETWORK ACL bypass via upload_azure / upload_sftp / upload_smb VQL plugins

Velociraptor Prefetch parser out of bounds

Velociraptor DoS triggered by Divide by Zero panic