CVE-2022-35629

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Due to a bug in the handling of the communication between the client and server, it was possible for one client, already registered with their own client ID, to send messages to the server claiming to come from another client ID. This issue was resolved in Velociraptor 0.6.5-2.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-287CWE-290

Affected software

No affected versions have been published.

Timeline

Published
Jul 29, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-35635.7A vulnerability classified as problematic has been found in Linux Kernel. Affected is the function read_50_controller_cap_complete of the fiCVE-2022-356306.1A cross-site scripting (XSS) issue in generating a collection report made it possible for malicious clients to inject JavaScript code into tCVE-2022-356315.5On MacOS and Linux, it may be possible to perform a symlink attack by replacing this predictable file name with a symlink to another file anCVE-2022-356324.8The Velociraptor GUI contains an editor suggestion feature that can display the description field of a VQL function, plugin or artifact. ThiCVE-2022-356376.5IBM Db2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to a denial of service after entering a malformed SQL statCVE-2022-356388.8IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.8 and 6.1.0.0 through 6.1.2.1 is vulnerable to cross-site request forgeryCVE-2022-356397.5IBM Sterling Partner Engagement Manager 6.1, 6.2, and Cloud 22.2 do not limit the length of a connection which could cause the server to becCVE-2022-35647.1A vulnerability classified as critical was found in Linux Kernel. Affected by this vulnerability is the function l2cap_reassemble_sdu of theCVE-2022-356405.5IBM Sterling Partner Engagement Manager 6.2.2 could allow a local attacker to obtain sensitive information when a detailed technical error mCVE-2022-356425.4"IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScriptCVE-2022-356439.1IBM PowerVM VIOS 3.1 could allow a remote attacker to tamper with system configuration or cause a denial of service. IBM X-Force ID: 230956.CVE-2022-356455.4IBM Maximo Asset Management 7.6.1.1, 7.6.1.2, 7.6.1.3 and IBM Maximo Application Suite 8.8 and 8.9 is vulnerable to stored cross-site script
CVE-2022-35629: Medium severity, CVSS 5.4 | Vulnix