velociraptor vulnerabilities (openSUSE)
125 vulnerabilities.
velociraptoropenSUSEVelociraptor Query() Plugin Misapplies Permissions To Orgs8.0 HighvelociraptoropenSUSERapid7 Velociraptor Improper Input Validation in Client Message Handler8.5 HighvelociraptoropenSUSEGo JOSE affect by a panic in JWE decryption7.5 HighvelociraptoropenSUSEgoxmldsig has validateSignature Loop Variable Capture Signature Bypass7.5 HighvelociraptoropenSUSEgRPC-Go has an authorization bypass via missing leading slash in :path9.1 CriticalvelociraptoropenSUSEfast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278)7.5 HighvelociraptoropenSUSESVGO: DoS through entity expansion in DOCTYPE (Billion Laughs)7.5 HighvelociraptoropenSUSEUnderscore.js has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack8.2 HighvelociraptoropenSUSEminimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions7.5 HighvelociraptoropenSUSERollup 4 has Arbitrary File Write via Path Traversal8.8 HighvelociraptoropenSUSEIncorrect calculation in CIRCL secp384r1 CombinedMult2.9 LowvelociraptoropenSUSEbn.js affected by an infinite loop6.9 MediumvelociraptoropenSUSEminimatch has a ReDoS via repeated wildcards with non-matching literal in pattern8.7 HighvelociraptoropenSUSEfast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)7.5 HighvelociraptoropenSUSEfast-xml-parser has RangeError DoS Numeric Entities Bug7.5 HighvelociraptoropenSUSEPrototype Pollution Vulnerability in Lodash _.unset and _.omit functions6.9 MediumvelociraptoropenSUSEUnbounded memory consumption in golang.org/x/crypto/ssh5.3 MediumvelociraptoropenSUSEInfinite parsing loop in golang.org/x/net5.3 MediumvelociraptoropenSUSEQuadratic parsing complexity in golang.org/x/net/html5.3 MediumvelociraptoropenSUSEgithub.com/ulikunitz/xz leaks memory when decoding a corrupted multiple LZMA archives5.3 MediumvelociraptoropenSUSEUsage of unsafe random function in form-data for choosing boundary9.4 CriticalvelociraptoropenSUSEOn Node.js < 3, pbkdf2 silently disregards Uint8Array input, returning static keys9.1 CriticalvelociraptoropenSUSEpbkdf2 silently returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos supported by Node.js9.1 CriticalvelociraptoropenSUSEjuliangruber brace-expansion index.js expand redos2.3 LowvelociraptoropenSUSEIncorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net6.5 MediumvelociraptoropenSUSEgorilla/csrf CSRF vulnerability due to broken Referer validation5.4 MediumvelociraptoropenSUSEjwt-go allows excessive memory allocation during header parsing7.5 HighvelociraptoropenSUSEPossible SSRF and Credential Leakage via Absolute URL in axios Requests7.7 HighvelociraptoropenSUSEHTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net4.4 MediumvelociraptoropenSUSEVelociraptor Shell Plugin Prevent_execve Bypass3.8 LowvelociraptoropenSUSEPotential denial of service in golang.org/x/crypto7.5 HighvelociraptoropenSUSEUnexpected memory consumption during token parsing in golang.org/x/oauth27.5 HighvelociraptoropenSUSEGo JOSE's Parsing Vulnerable to Denial of Service6.6 MediumvelociraptoropenSUSEVulnerability when creating log files in github.com/golang/glog7.1 HighvelociraptoropenSUSENon-linear parsing of case-insensitive content in golang.org/x/net/html5.3 MediumvelociraptoropenSUSEPredictable results in nanoid generation when given non-integer values4.3 MediumvelociraptoropenSUSERegular Expression Denial of Service (ReDoS) in cross-spawn8.7 HighvelociraptoropenSUSEBad documentation of error handling in ParseWithClaims can lead to potentially dangerous situations in golang-jwt3.1 LowvelociraptoropenSUSEValid ECDSA signatures erroneously rejected in Elliptic4.8 MediumvelociraptoropenSUSEElliptic's verify function omits uniqueness validation9.1 CriticalvelociraptoropenSUSEDOM Clobbering Gadget found in rollup bundled scripts that leads to XSS6.1 MediumvelociraptoropenSUSEDOM Clobbering gadget found in vite bundled scripts that leads to XSS in Vite6.4 MediumvelociraptoropenSUSEserver.fs.deny bypassed when using ?import&raw in vite4.8 MediumvelociraptoropenSUSEpath-to-regexp outputs backtracking regular expressions7.5 HighvelociraptoropenSUSEServer-Side Request Forgery in axios7.5 HighvelociraptoropenSUSEElliptic allows BER-encoded signatures9.1 CriticalvelociraptoropenSUSEElliptic's ECDSA missing check for whether leading bit of r and s is zero5.3 MediumvelociraptoropenSUSEElliptic's EDDSA missing signature length check5.3 MediumvelociraptoropenSUSEPotential memory exhaustion attack due to sparse slice deserialization7.5 HighvelociraptoropenSUSEgo-retryablehttp can leak basic auth credentials to log files6.0 Medium- Show moreLoading…