CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-15506
https://notcve.org/view.php?id=CVE-2019-15506
An issue was discovered in Kaseya Virtual System Administrator (VSA) through 9.4.0.37. It has a critical information disclosure vulnerability. An unauthenticated attacker can send properly formatted requests to the web application and download sensitive files and information. For example, the /DATAREPORTS directory can be farmed for reports. Because this directory contains the results of reports such as NMAP, Patch Status, and Active Directory domain metadata, an attacker can easily collect this critical information and parse it for information. • http://dfdrconsulting.com/2019/cyber-security/cve-2019-15506-kaseya-vsa-critical-information-disclosure-unauthenticated-access http://help.kaseya.com/WebHelp/EN/RN/index.asp#VSAReleaseNotes.htm • CWE-306: Missing Authentication for Critical Function •
CVSS: 7.4EPSS: 0%CPEs: 1EXPL: 0CVE-2017-12410 – Kaseya Virtual System Administrator (VSA) Local Privilege Escalation
https://notcve.org/view.php?id=CVE-2017-12410
It is possible to exploit a Time of Check & Time of Use (TOCTOU) vulnerability by winning a race condition when Kaseya Virtual System Administrator agent 9.3.0.11 and earlier tries to execute its binaries from working and/or temporary folders. Successful exploitation results in the execution of arbitrary programs with "NT AUTHORITY\SYSTEM" privileges. Es posible explotar una vulnerabilidad Time of Check Time of Use (TOCTOU) al ganar una condición de carrera cuando las versiones 9.3.0.11 y anteriores del agente Kaseya Virtual System Administrator intentan ejecutar sus binarios de las carpetas de trabajo y/o temporales. Resultados de explotación exitosos en la ejecución de programas arbitrarios con privilegios "NT AUTHORITY\SYSTEM". The Kaseya Virtual System Administrator (VSA) agent "AgentMon.exe" suffers from a local privilege escalation vulnerability. • http://www.securityfocus.com/archive/1/541884/100/0/threaded • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 1.7EPSS: 0%CPEs: 2EXPL: 0CVE-2014-2926
https://notcve.org/view.php?id=CVE-2014-2926
kapfa.sys in Kaseya Virtual System Administrator (VSA) 6.5 before 6.5.0.17 and 7.0 before 7.0.0.16 allows local users to cause a denial of service (NULL pointer dereference and application crash) via unspecified vectors. kapfa.sys en Kaseya Virtual System Administrator (VSA) 6.5 anterior a 6.5.0.17 y 7.0 anterior a 7.0.0.16 permite a usuarios locales causar una denegación de servicio (referencia a puntero nulo y caída de aplicación) a través de vectores no especificados. • http://www.kb.cert.org/vuls/id/204988 •