Christian Fünfhaus

**Name of the Vulnerable Software and Affected Versions** Velociraptor (affected versions not specified) **Description** The issue concerns the Velociraptor's artifact collection feature, which allows users to collect and execute VQL queries packaged into artifacts from endpoints. These artifacts typically run with elevated permissions. A specific artifact, `Admin.Client.UpdateClientConfig`, used for updating the client's configuration, did not enforce an additional required permission. As a result, users with `COLLECT CLIENT` permissions, usually granted by the "Investigator" role, could collect this artifact from endpoints and update the configuration. This can lead to arbitrary command execution and endpoint takeover. To exploit this issue, the user must already have access to collect artifacts from the endpoint, typically granted by the "Investigator" role. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** VertiGIS WebOffice versions 10.7 SP1 before patch20210202 VertiGIS WebOffice versions 10.8 SP1 before patch20210207 **Description** The issue allows attackers to achieve unauthorized access to contents of the WebOffice application. **Recommendations** For VertiGIS WebOffice version 10.7 SP1, apply patch20210202 to resolve the issue. For VertiGIS WebOffice version 10.8 SP1, apply patch20210207 to resolve the issue.