Lucene search
+L

59 matches found

Kitploit
Kitploit
added 2026/09/22 3:53 p.m.17 views

velociraptor

Velociraptor - エンドポイント可視化・収集ツール Velociraptor は、Velociraptor Query Language VQL クエリを使用してホストベースの状態情報を収集するツールです。 Velociraptor の詳細については、以下のドキュメントをお読みください: https://docs.velociraptor.app/ クイックスタート Velociraptor がどのようなものかすぐに確認したい場合は、次の手順に従ってください: 1. お使いのプラットフォーム Windows/Linux/MacOS...

5.8AI score
SaveExploits0References4
Kitploit
Kitploit
added 2026/09/20 4:21 a.m.7 views

DetectRaptor

DetectRaptor 一个仓库,用于以易于使用的方式共享公开可用的批量 Velociraptor 检测内容。 只需获取发布版 VQL zip 并将其导入 Velociraptor。 通过 Velociraptor 工件交换可以轻松实现:Server.Import.DetectRaptor 1. 导入 Velociraptor 工件交换 服务器工件 + Server.Import.ArtifactExchange 这将导入“Import DetectRaptor”工件。 2. 导入 DetectRaptor 服务器工件 +...

5.9AI score
SaveExploits0References4
NVD
NVD
added 2026/09/10 3:17 a.m.10 views

CVE-2026-19584

Velociraptor allows for the creation of notebook backups in its default enabled daily backup feature. When Velociraptor restores the backup, the notebook cell content is interpolated into a template with no ACL checks. This allows a malicious user with NOTEBOOKEDITOR permission to plant a VQL que...

7.7CVSS0.0019EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/09/10 3:00 a.m.11 views

EUVD-2026-75234

Velociraptor allows for the creation of notebook backups in its default enabled daily backup feature. When Velociraptor restores the backup, the notebook cell content is interpolated into a template with no ACL checks. This allows a malicious user with NOTEBOOKEDITOR permission to plant a VQL que...

7.7CVSS5.7AI score0.0019EPSS
SaveExploits0References2
CVE
CVE
added 2026/09/10 3:00 a.m.28 views

CVE-2026-19584

Velociraptor , a threat hunting and incident response platform, is affected by a VQL injection vulnerability in its notebook backup/restore feature. The daily backup mechanism is enabled by default; upon restore, notebook cell content is interpolated into a template without ACL checks . A user wi...

7.7CVSS5.7AI score0.0019EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/09/10 3:00 a.m.46 views

CVE-2026-19584 Velociraptor VQL injection during notebook restore from backup

Velociraptor allows for the creation of notebook backups in its default enabled daily backup feature. When Velociraptor restores the backup, the notebook cell content is interpolated into a template with no ACL checks. This allows a malicious user with NOTEBOOKEDITOR permission to plant a VQL que...

7.7CVSS0.0019EPSS
SaveExploits0References2
OSV
OSV
added 2026/09/10 3:00 a.m.23 views

CVE-2026-19584 Velociraptor VQL injection during notebook restore from backup

Velociraptor allows for the creation of notebook backups in its default enabled daily backup feature. When Velociraptor restores the backup, the notebook cell content is interpolated into a template with no ACL checks. This allows a malicious user with NOTEBOOKEDITOR permission to plant a VQL que...

7.7CVSS5.8AI score
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2026/09/10 12:00 a.m.17 views

PT-2026-89260

Velociraptor allows for the creation of notebook backups in its default enabled daily backup feature. When Velociraptor restores the backup, the notebook cell content is interpolated into a template with no ACL checks. This allows a malicious user with NOTEBOOK EDITOR permission to plant a VQL...

7.7CVSS5.7AI score0.0019EPSS
SaveExploits0References3
NVD
NVD
added 2026/08/24 4:16 a.m.20 views

CVE-2026-19200

The Velociraptor verify VQL function allows a user to verify an artifact for syntatic and other issues. Due to an implementation fault in this VQL function, the global artifact repository is used which allows callers to overwrite existing artifacts without the required permissions. The attacker...

8.9CVSS0.00228EPSS
SaveExploits0References2
CVE
CVE
added 2026/08/24 3:22 a.m.32 views

CVE-2026-19200

Velociraptor 's verify() VQL function suffers from an implementation fault that causes it to use the global artifact repository instead of a scoped one. This allows a user with only the NOTEBOOK_EDIT permission (e.g., an analyst role) to overwrite existing live built-in artifacts without the perm...

8.9CVSS5.3AI score0.00228EPSS
SaveExploits0References2
OSV
OSV
added 2026/08/24 3:22 a.m.14 views

CVE-2026-19200 Velociraptor Analyst overwrites live built-in artifacts through verify()

The Velociraptor verify VQL function allows a user to verify an artifact for syntatic and other issues. Due to an implementation fault in this VQL function, the global artifact repository is used which allows callers to overwrite existing artifacts without the required permissions. The attacker...

8.9CVSS5.6AI score
SaveExploits0References5
Cvelist
Cvelist
added 2026/08/24 3:22 a.m.71 views

CVE-2026-19200 Velociraptor Analyst overwrites live built-in artifacts through verify()

The Velociraptor verify VQL function allows a user to verify an artifact for syntatic and other issues. Due to an implementation fault in this VQL function, the global artifact repository is used which allows callers to overwrite existing artifacts without the required permissions. The attacker...

8.9CVSS0.00228EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/08/24 3:22 a.m.18 views

EUVD-2026-64703

The Velociraptor verify VQL function allows a user to verify an artifact for syntatic and other issues. Due to an implementation fault in this VQL function, the global artifact repository is used which allows callers to overwrite existing artifacts without the required permissions. The attacker...

8.9CVSS5.5AI score0.00228EPSS
SaveExploits0References2
CVE
CVE
added 2026/08/12 9:44 a.m.46 views

CVE-2026-64952

Velociraptor’s hunt_delete() VQL function has a permission check flaw: it allows deleting hunts because the check requires COLLECT_CLIENT (investigator) instead of DELETE_RESULTS (administrators). This misapplies access control, potentially enabling non-administrator users to delete hunts. The CV...

6.5CVSS5.2AI score0.00174EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/12 9:44 a.m.16 views

EUVD-2026-57159

The huntdelete VQL function allows deleting hunts. Velociraptor misapplied the permission check requiring only COLLECTCLIENT usually assigned to the "investigator" role instead of the "DELETERESULTS" permission usually only assigned to "administrators"...

6.5CVSS5.2AI score0.00174EPSS
SaveExploits0References1
attackerkb
attackerkb
added 2026/08/12 9:44 a.m.13 views

CVE-2026-64952

The huntdelete VQL function allows deleting hunts. Velociraptor misapplied the permission check requiring only COLLECTCLIENT usually assigned to the "investigator" role instead of the "DELETERESULTS" permission usually only assigned to "administrators"...

6.5CVSS5.2AI score0.00174EPSS
SaveExploits0References2
NVD
NVD
added 2026/08/12 5:19 a.m.11 views

CVE-2026-64954

Velociraptor allows scheduling new collections via VQL queries in notebooks. For a user to schedule a new collection, they require the COLLECTCLIENT permission. However, this is not enforced when the user can run a VQL query which resets the authorization provider. This allows a user who can run...

8.2CVSS0.00232EPSS
SaveExploits0References2
CVE
CVE
added 2026/08/12 4:26 a.m.56 views

CVE-2026-64954

Velociraptor vulnerability CVE-2026-64954 arises because the COLLECT_CLIENT permission is not enforced when a user can run a VQL query that resets the authorization provider. This lets a user who can execute arbitrary VQL (typically an analyst) trigger new collections that normally require the in...

8.2CVSS5.4AI score0.00232EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/08/12 4:26 a.m.42 views

CVE-2026-64954 Velociraptor collect_client() Permissions Bypass

Velociraptor allows scheduling new collections via VQL queries in notebooks. For a user to schedule a new collection, they require the COLLECTCLIENT permission. However, this is not enforced when the user can run a VQL query which resets the authorization provider. This allows a user who can run...

8.2CVSS0.00232EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/08/12 4:26 a.m.15 views

EUVD-2026-57068

Velociraptor allows scheduling new collections via VQL queries in notebooks. For a user to schedule a new collection, they require the COLLECTCLIENT permission. However, this is not enforced when the user can run a VQL query which resets the authorization provider. This allows a user who can run...

8.2CVSS5.4AI score0.00232EPSS
SaveExploits0References2
Rows per page
Query Builder