Velociraptor Investigator reaches SuperUser via hunt EffectivePrincipal

Velociraptor Required Permissions bypass by using client monitoring queries

Velociraptor authenticated identity-spoofing vulnerability

Velociraptor Query() Plugin Misapplies Permissions To Orgs

Velociraptor Analyst overwrites live built-in artifacts through verify()

Insufficient permission check in the VQL copy() function

Velociraptor incorrect Org deletion permissions check

Rapid7 Velociraptor Local Privilege Escalation In Windows Velociraptor Service

Velociraptor collect_client() Permissions Bypass

Velociraptor Stored XSS in URL column types

A YAML injection vulnerability exists in the Windows.Collectors.Remapping artifact of Rapid7 Velociraptor before version 0.76.6

Velociraptor VQL injection during notebook restore from backup

GetUserRoles API endpoint allows any authenticated user to enumerate ACL policies across all organizations

Velociraptor OIDC Authenticator susceptible to email spoofing

Velociraptor query plugin allows impersonation in other orgs

Velociraptor directory traversal via the NewNotebook API

Velociraptor VFSGetBuffer API path deny list bypass

HTTP Filestore Endpoints Misapply Permissions Across Organizations

Rapid7 Velociraptor Directory Traversal Vulnerability

Velociraptor Server Metadata update with Insufficient Permission Check

Velociraptor Authenticated Denial of Service

Velociraptor STACK Type Download Path Bypasses Denied Prefix Check

Velociraptor Hunt Deletion With Insufficient Permission Check

Velociraptor server crash via the SetPassword API

Rapid7 Velociraptor Improper Input Validation in Client Message Handler

Velociraptor Multiple Crashes in NTFS Parser when applied to invalid NTFS Volumes

Velociraptor CSV Formula Injection in Export Pipeline

Rapid7 Velociraptor Reflected XSS

Unsafe HTML Injection in Artifact Collection Report

Velociraptor privilege escalation via SysmonLogForward client monitoring artifact

Velociraptor EVTX Parser — Process Crash via Crafted .evtx File

Velociraptor priviledge escalation via UpdateConfig artifact

Filesystem race on temporary files

Velociraptor Client ID Spoofing

Velociraptor crashes while parsing some malformed PE or OLE files.

WatchEvent API streams another organization's live events

Unbounded Memory Allocation in VQLResponse Result-Set Writer

XSS in User Interface

Rapid7 Velociraptor 0.5.9 and prior is vulnerable to a post-authentication persistent cross-site scripting (XSS) issue, where an authenticated user could abuse MIME filetype…

Rapid7 Velociraptor directory traversal in client ID parameter

Velociraptor NETWORK ACL bypass via upload_azure / upload_sftp / upload_smb VQL plugins

Velociraptor Shell Plugin Prevent_execve Bypass

Velociraptor Prefetch parser out of bounds

Velociraptor DoS triggered by Divide by Zero panic