CPE Details
Rapid7 Velociraptor 0.6.7-5
0.6.7-5
2023-01-27
13h40 +00:00
13h40 +00:00
2023-03-21
15h18 +00:00
15h18 +00:00
Alerte pour un CPE
Stay informed of any changes for a specific CPE.
CPE Name: cpe:2.3:a:rapid7:velociraptor:0.6.7-5:*:*:*:*:*:*:*
Informations
Vendor
rapid7Product
velociraptorVersion
0.6.7-5Related CVE
| CVE ID | Published | Description | Score | Severity |
|---|---|---|---|---|
| Rapid7 Velociraptor versions prior to 0.7.0-4 suffer from a reflected cross site scripting vulnerability. This vulnerability allows attackers to inject JS into the error path, potentially leading to unauthorized execution of scripts within a user's web browser. This vulnerability is fixed in version 0.7.0-04 and a patch is available to download. Patches are also available for version 0.6.9 (0.6.9-1). | 8.6 |
High |
||
| Due to insufficient validation in the PE and OLE parsers in Rapid7's Velociraptor versions earlier than 0.6.8 allows attacker to crash Velociraptor during parsing of maliciously malformed files. For this attack to succeed, the attacker needs to be able to introduce malicious files to the system at the same time that Velociraptor attempts to collect any artifacts that attempt to parse PE files, Authenticode signatures, or OLE files. After crashing, the Velociraptor service will restart and it will still be possible to collect other artifacts. | 5.3 |
Medium |
