ASSERT-KTH/go_vulnerabilities_2019_2024 huggingface dataset:
CVE-2024-41659 (published 2024-08-20T20:15:08)
Repository: https://github.com/usememos/memos
memos is a privacy-first, lightweight note-taking service. A CORS misconfiguration exists in memos 0.20.1 and earlier where an arbitrary origin is reflected with Access-Control-Allow-Credentials set to true. This may allow an attacking website to make a cross-origin request, allowing the attacker to read private information or make privileged changes to the system as the vulnerable user account. This vulnerability is fixed in 0.21.0.
CVE-2023-0106 (published 2023-01-07T04:15:08)
Repository: https://github.com/usememos/memos
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2023-0111 (published 2023-01-07T04:15:08)
Repository: https://github.com/usememos/memos
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2023-0107 (published 2023-01-07T04:15:08)
Repository: https://github.com/usememos/memos
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2023-0110 (published 2023-01-07T04:15:08)
Repository: https://github.com/usememos/memos
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2023-0112 (published 2023-01-07T04:15:08)
Repository: https://github.com/usememos/memos
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2023-0108 (published 2023-01-07T04:15:08)
Repository: https://github.com/usememos/memos
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2023-4698 (published 2023-09-01T01:15:09)
Repository: https://github.com/usememos/memos
Improper Input Validation in GitHub repository usememos/memos prior to 0.13.2.
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVE-2023-4696 (published 2023-09-01T01:15:08)
Repository: https://github.com/usememos/memos
Improper Access Control in GitHub repository usememos/memos prior to 0.13.2.
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2023-5036 (published 2023-09-18T06:15:08)
Repository: https://github.com/usememos/memos
Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.15.1.
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2023-4697 (published 2023-09-01T01:15:09)
Repository: https://github.com/usememos/memos
Improper Privilege Management in GitHub repository usememos/memos prior to 0.13.2.
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2022-25978 (published 2023-02-15T05:15:11)
Repository: https://github.com/usememos/memos
All versions of the package github.com/usememos/memos/server are vulnerable to Cross-site Scripting (XSS) due to insufficient checks on external resources, which allows malicious actors to introduce links starting with a javascript: scheme. 
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVE-2022-4813 (published 2022-12-28T14:15:11)
Repository: https://github.com/usememos/memos
Insufficient Granularity of Access Control in GitHub repository usememos/memos prior to 0.9.1.
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVE-2022-4811 (published 2022-12-28T14:15:11)
Repository: https://github.com/usememos/memos
Authorization Bypass Through User-Controlled Key vulnerability in usememos usememos/memos.This issue affects usememos/memos before 0.9.1.


Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVE-2022-4848 (published 2022-12-29T18:15:10)
Repository: https://github.com/usememos/memos
Improper Verification of Source of a Communication Channel in GitHub repository usememos/memos prior to 0.9.1.
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
CVE-2022-4846 (published 2022-12-29T18:15:10)
Repository: https://github.com/usememos/memos
Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CVE-2022-4844 (published 2022-12-29T18:15:10)
Repository: https://github.com/usememos/memos
Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2022-4841 (published 2022-12-29T17:15:21)
Repository: https://github.com/usememos/memos
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1.
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2022-4840 (published 2022-12-29T17:15:21)
Repository: https://github.com/usememos/memos
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1.
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2022-4806 (published 2022-12-28T14:15:11)
Repository: https://github.com/usememos/memos
Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVE-2022-4797 (published 2022-12-28T14:15:10)
Repository: https://github.com/usememos/memos
Improper Restriction of Excessive Authentication Attempts in GitHub repository usememos/memos prior to 0.9.1.
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVE-2022-4798 (published 2022-12-28T14:15:10)
Repository: https://github.com/usememos/memos
Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVE-2022-4866 (published 2022-12-31T09:15:11)
Repository: https://github.com/usememos/memos
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1.
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
CVE-2022-4807 (published 2022-12-28T14:15:11)
Repository: https://github.com/usememos/memos
Improper Access Control in GitHub repository usememos/memos prior to 0.9.1.
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVE-2022-4801 (published 2022-12-28T14:15:10)
Repository: https://github.com/usememos/memos
Insufficient Granularity of Access Control in GitHub repository usememos/memos prior to 0.9.1.
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVE-2022-4847 (published 2022-12-29T18:15:10)
Repository: https://github.com/usememos/memos
Incorrectly Specified Destination in a Communication Channel in GitHub repository usememos/memos prior to 0.9.1.
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CVE-2022-4799 (published 2022-12-28T14:15:10)
Repository: https://github.com/usememos/memos
Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CVE-2022-4684 (published 2022-12-23T12:15:10)
Repository: https://github.com/usememos/memos
Improper Access Control in GitHub repository usememos/memos prior to 0.9.0.
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2022-4689 (published 2022-12-23T12:15:12)
Repository: https://github.com/usememos/memos
Improper Access Control in GitHub repository usememos/memos prior to 0.9.0.
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2022-4851 (published 2022-12-29T18:15:10)
Repository: https://github.com/usememos/memos
Improper Handling of Values in GitHub repository usememos/memos prior to 0.9.1.
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVE-2022-4849 (published 2022-12-29T18:15:10)
Repository: https://github.com/usememos/memos
Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CVE-2022-4802 (published 2022-12-28T14:15:10)
Repository: https://github.com/usememos/memos
Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVE-2022-4809 (published 2022-12-28T14:15:11)
Repository: https://github.com/usememos/memos
Improper Access Control in GitHub repository usememos/memos prior to 0.9.1.
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2022-4691 (published 2022-12-27T15:15:11)
Repository: https://github.com/usememos/memos
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0.
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2022-4850 (published 2022-12-29T18:15:10)
Repository: https://github.com/usememos/memos
Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CVE-2022-4683 (published 2022-12-23T12:15:08)
Repository: https://github.com/usememos/memos
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository usememos/memos prior to 0.9.0.
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVE-2022-4609 (published 2022-12-19T12:15:11)
Repository: https://github.com/usememos/memos
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0.
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2022-4808 (published 2022-12-28T14:15:11)
Repository: https://github.com/usememos/memos
Improper Privilege Management in GitHub repository usememos/memos prior to 0.9.1.
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2022-4863 (published 2022-12-30T16:15:09)
Repository: https://github.com/usememos/memos
Improper Handling of Insufficient Permissions or Privileges in GitHub repository usememos/memos prior to 0.9.1.
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
CVE-2022-4734 (published 2022-12-27T15:15:12)
Repository: https://github.com/usememos/memos
Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository usememos/memos prior to 0.9.1.


Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVE-2022-4800 (published 2022-12-28T14:15:10)
Repository: https://github.com/usememos/memos
Improper Verification of Source of a Communication Channel in GitHub repository usememos/memos prior to 0.9.1.
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CVE-2022-4804 (published 2022-12-28T14:15:10)
Repository: https://github.com/usememos/memos
Improper Authorization in GitHub repository usememos/memos prior to 0.9.1.
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVE-2022-4687 (published 2022-12-23T12:15:11)
Repository: https://github.com/usememos/memos
Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.0.
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVE-2022-4695 (published 2022-12-27T15:15:11)
Repository: https://github.com/usememos/memos
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0.
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2022-4805 (published 2022-12-28T14:15:10)
Repository: https://github.com/usememos/memos
Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.1.
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVE-2022-4812 (published 2022-12-28T14:15:11)
Repository: https://github.com/usememos/memos
Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVE-2022-4803 (published 2022-12-28T14:15:10)
Repository: https://github.com/usememos/memos
Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2022-4865 (published 2022-12-31T09:15:08)
Repository: https://github.com/usememos/memos
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1.
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
CVE-2022-4814 (published 2022-12-28T14:15:11)
Repository: https://github.com/usememos/memos
Improper Access Control in GitHub repository usememos/memos prior to 0.9.1.
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVE-2022-4686 (published 2022-12-23T12:15:11)
Repository: https://github.com/usememos/memos
Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.0.
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2022-4845 (published 2022-12-29T18:15:10)
Repository: https://github.com/usememos/memos
Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVE-2022-4796 (published 2022-12-28T14:15:09)
Repository: https://github.com/usememos/memos
Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.1.
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CVE-2022-4690 (published 2022-12-23T12:15:12)
Repository: https://github.com/usememos/memos
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0.
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2022-4839 (published 2022-12-29T17:15:21)
Repository: https://github.com/usememos/memos
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1.
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2022-4694 (published 2022-12-27T15:15:11)
Repository: https://github.com/usememos/memos
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0.
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2022-4692 (published 2022-12-23T20:15:20)
Repository: https://github.com/usememos/memos
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0.
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2022-4688 (published 2022-12-23T12:15:11)
Repository: https://github.com/usememos/memos
Improper Authorization in GitHub repository usememos/memos prior to 0.9.0.
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2022-4767 (published 2022-12-27T15:15:12)
Repository: https://github.com/usememos/memos
Denial of Service in GitHub repository usememos/memos prior to 0.9.1.
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVE-2022-4810 (published 2022-12-28T14:15:11)
Repository: https://github.com/usememos/memos
Improper Access Control in GitHub repository usememos/memos prior to 0.9.1.
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVE-2022-21221 (published 2022-03-17T12:15:08)
Repository: https://github.com/valyala/fasthttp
The package github.com/valyala/fasthttp before 1.34.0 are vulnerable to Directory Traversal via the ServeFile function, due to improper sanitization. It is possible to be exploited by using a backslash %5c character in the path. **Note:** This security issue impacts Windows users only.
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVE-2023-35163 (published 2023-06-23T21:15:09)
Repository: https://github.com/vegaprotocol/vega
Vega is a decentralized trading platform that allows pseudo-anonymous trading of derivatives on a blockchain. Prior to version 0.71.6, a vulnerability exists that allows a malicious validator to trick the Vega network into re-processing past Ethereum events from Vega’s Ethereum bridge. For example, a deposit to the collateral bridge for 100USDT that credits a party’s general account on Vega, can be re-processed 50 times resulting in 5000USDT in that party’s general account. This is without depositing any more than the original 100USDT on the bridge. Despite this exploit requiring access to a validator's Vega key, a validator key can be obtained at the small cost of 3000VEGA, the amount needed to announce a new node onto the network.

A patch is available in version 0.71.6. No known workarounds are available, however there are mitigations in place should this vulnerability be exploited. There are monitoring alerts for `mainnet1` in place to identify any issues of this nature including this vulnerability being exploited. The validators have the ability to stop the bridge thus stopping any withdrawals should this vulnerability be exploited.
Severity: type: CVSS_V3
score: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
CVE-2023-0290 (published 2023-01-18T22:15:10)
Repository: https://github.com/velocidex/velociraptor
Rapid7 Velociraptor did not properly sanitize the client ID parameter to the CreateCollection API, allowing a directory traversal in where the collection task could be written. It was possible to provide a client id of "../clients/server" to schedule the collection for the server (as a server artifact), but only require privileges to schedule collections on the client.

Normally, to schedule an artifact on the server, the COLLECT_SERVER permission is required. This permission is normally only granted to "administrator" role. Due to this issue, it is sufficient to have the COLLECT_CLIENT privilege, which is normally granted to the "investigator" role.
To exploit this vulnerability, the attacker must already have a Velociraptor user account at least "investigator" level, and be able to authenticate to the GUI and issue an API call to the backend. Typically, most users deploy Velociraptor with limited access to a trusted group, and most users will already be administrators within the GUI.

This issue affects Velociraptor versions before 0.6.7-5. Version 0.6.7-5, released January 16, 2023, fixes the issue.


Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVE-2023-0242 (published 2023-01-18T21:15:11)
Repository: https://github.com/velocidex/velociraptor
Rapid7 Velociraptor allows users to be created with different privileges on the server. Administrators are generally allowed to run any command on the server including writing arbitrary files. However, lower privilege users are generally forbidden from writing or modifying files on the server.

The VQL copy() function applies permission checks for reading files but does not check for permission to write files. This allows a low privilege user (usually, users with the Velociraptor "investigator" role) to overwrite files on the server, including Velociraptor configuration files.

To exploit this vulnerability, the attacker must already have a Velociraptor user account at a low privilege level (at least "analyst") and be able to log into the GUI and create a notebook where they can run the VQL query invoking the copy() VQL function. Typically, most users deploy Velociraptor with limited access to a trusted group (most users will be administrators within the GUI).
This vulnerability is associated with program files  https://github.Com/Velocidex/velociraptor/blob/master/vql/filesystem/copy.go https://github.Com/Velocidex/velociraptor/blob/master/vql/filesystem/copy.go  and program routines copy().

This issue affects Velociraptor versions before 0.6.7-5. Version 0.6.7-5, released January 16, 2023, fixes the issue.


Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2023-5950 (published 2023-11-06T15:15:14)
Repository: https://github.com/velocidex/velociraptor
Rapid7 Velociraptor versions prior to 0.7.0-4 suffer from a reflected cross site scripting vulnerability. This vulnerability allows attackers to inject JS into the error path, potentially leading to unauthorized execution of scripts within a user's web browser. This vulnerability is fixed in version 0.7.0-04 and a patch is available to download. Patches are also available for version 0.6.9 (0.6.9-1).


Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVE-2021-3619 (published 2021-07-22T19:15:09)
Repository: https://github.com/velocidex/velociraptor
Rapid7 Velociraptor 0.5.9 and prior is vulnerable to a post-authentication persistent cross-site scripting (XSS) issue, where an authenticated user could abuse MIME filetype sniffing to embed executable code on a malicious upload. This issue was fixed in version 0.6.0. Note that login rights to Velociraptor is nearly always reserved for trusted and verified users with IT security backgrounds.
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
CVE-2023-36088 (published 2023-09-01T16:15:07)
Repository: https://github.com/vesoft-inc/nebula-studio
Server Side Request Forgery (SSRF) vulnerability in NebulaGraph Studio version 3.7.0, allows remote attackers to gain sensitive information.
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVE-2024-32886 (published 2024-05-08T14:15:08)
Repository: https://github.com/vitessio/vitess
Vitess is a database clustering system for horizontal scaling of MySQL. When executing the following simple query, the `vtgate` will go into an endless loop that also keeps consuming memory and eventually will run out of memory. This vulnerability is fixed in 19.0.4, 18.0.5, and 17.0.7.
CVE-2024-53257 (published 2024-12-03T16:15:23)
Repository: https://github.com/vitessio/vitess
Vitess is a database clustering system for horizontal scaling of MySQL. The /debug/querylogz and /debug/env pages for vtgate and vttablet do not properly escape user input. The result is that queries executed by Vitess can write HTML into the monitoring page at will. These pages are rendered using text/template instead of rendering with a proper HTML templating engine. This vulnerability is fixed in 21.0.1, 20.0.4, and 19.0.8.
CVE-2023-29194 (published 2023-04-14T19:15:09)
Repository: https://github.com/vitessio/vitess
Vitess is a database clustering system for horizontal scaling of MySQL. Users can either intentionally or inadvertently create a keyspace containing `/` characters such that from that point on, anyone who tries to view keyspaces from VTAdmin will receive an error. Trying to list all the keyspaces using `vtctldclient GetKeyspaces` will also return an error. Note that all other keyspaces can still be administered using the CLI (vtctldclient). This issue is fixed in version 16.0.1. As a workaround, delete the offending keyspace using a CLI client (vtctldclient).
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
CVE-2023-29195 (published 2023-05-11T20:15:09)
Repository: https://github.com/vitessio/vitess
Vitess is a database clustering system for horizontal scaling of MySQL through generalized sharding. Prior to version 16.0.2, users can either intentionally or inadvertently create a shard containing `/` characters from VTAdmin such that from that point on, anyone who tries to create a new shard from VTAdmin will receive an error. Attempting to view the keyspace(s) will also no longer work. Creating a shard using `vtctldclient` does not have the same problem because the CLI validates the input correctly. Version 16.0.2, corresponding to version 0.16.2 of the `go` module, contains a patch for this issue. Some workarounds are available. Always use `vtctldclient` to create shards, instead of using VTAdmin; disable creating shards from VTAdmin using RBAC; and/or delete the topology record for the offending shard using the client for your topology server.
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L