CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2022-23165 – Sysaid – Sysaid 14.2.0 Reflected Cross-Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2022-23165
Sysaid – Sysaid 14.2.0 Reflected Cross-Site Scripting (XSS) - The parameter "helpPageName" used by the page "/help/treecontent.jsp" suffers from a Reflected Cross-Site Scripting vulnerability. For an attacker to exploit this Cross-Site Scripting vulnerability, it's necessary for the affected product to expose the Offline Help Pages. An attacker may gain access to sensitive information or execute client-side code in the browser session of the victim user. Furthermore, an attacker would require the victim to open a malicious link. An attacker may exploit this vulnerability in order to perform phishing attacks. • https://www.gov.il/en/departments/faq/cve_advisories • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 0CVE-2022-22798 – Sysaid – Pro Plus Edition, SysAid Help Desk Broken Access Control
https://notcve.org/view.php?id=CVE-2022-22798
Sysaid – Pro Plus Edition, SysAid Help Desk Broken Access Control v20.4.74 b10, v22.1.20 b62, v22.1.30 b49 - An attacker needs to log in as a guest after that the system redirects him to the service portal or EndUserPortal.JSP, then he needs to change the path in the URL to /ConcurrentLogin%2ejsp after that he will receive an error message with a login button, by clicking on it, he will connect to the system dashboard. The attacker can receive sensitive data like server details, usernames, workstations, etc. He can also perform actions such as uploading files, deleting calls from the system. Sysaid - Pro Plus Edition, SysAid Help Desk Broken Access Control versiones v20.4.74 b10, v22.1.20 b62, v22.1.30 b49 - Un atacante necesita iniciar sesión como invitado, después de lo cual el sistema lo redirige al portal de servicios o EndUserPortal.JSP, luego necesita cambiar la ruta en la URL a /ConcurrentLogin%2ejsp, después de lo cual recibirá un mensaje de error con un botón de inicio de sesión, al hacer clic en él, será conectado al tablero del sistema. El atacante puede recibir datos confidenciales como detalles del servidor, nombres de usuario, estaciones de trabajo, etc. • https://www.gov.il/en/departments/faq/cve_advisories •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2022-22797 – Sysaid – sysaid Open Redirect
https://notcve.org/view.php?id=CVE-2022-22797
Sysaid – sysaid Open Redirect - An Attacker can change the redirect link at the parameter "redirectURL" from"GET" request from the url location: /CommunitySSORedirect.jsp?redirectURL=https://google.com. Unvalidated redirects and forwards are possible when a web application accepts untrusted input that could cause the web application to redirect the request to a URL contained within untrusted input. By modifying untrusted URL input to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Sysaid - sysaid Redireccionamiento Abierto - Un atacante puede cambiar el enlace de redireccionamiento en el parámetro "redirectURL" de la petición "GET" desde la ubicación de la url: /ComunidadSSORedirect.jsp? • https://www.gov.il/en/departments/faq/cve_advisories • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 0CVE-2022-22796 – Sysaid – Sysaid System Takeover
https://notcve.org/view.php?id=CVE-2022-22796
Sysaid – Sysaid System Takeover - An attacker can bypass the authentication process by accessing to: /wmiwizard.jsp, Then to: /ConcurrentLogin.jsp, then click on the login button, and it will redirect you to /home.jsp without any authentication. Sysaid - Sysaid Toma se Sistema - Un atacante puede omitir el proceso de autenticación accediendo a: /wmiwizard.jsp, Luego a: /ConcurrentLogin.jsp, luego haciendo clic en el botón de inicio de sesión, y le redirigirá a /home.jsp sin ninguna autenticación • https://www.gov.il/en/departments/faq/cve_advisories • CWE-287: Improper Authentication •
CVSS: 6.5EPSS: 87%CPEs: 1EXPL: 4CVE-2015-2994 – SysAid Help Desk 14.4 - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2015-2994
Unrestricted file upload vulnerability in ChangePhoto.jsp in SysAid Help Desk before 15.2 allows remote administrators to execute arbitrary code by uploading a file with a .jsp extension, then accessing it via a direct request to the file in icons/user_photo/. Vulnerabilidad de la subida de ficheros sin restricciones en ChangePhoto.jsp en SysAid Help Desk anterior a 15.2 permite a administradores remotos ejecutar código arbitrario mediante la subida de un fichero con una extensión .jsp, y posteriormente accediendo a ello a través de una solicitud directa al fichero en icons/user_photo/. SysAid Help Desk version 14.4 suffers from code execution, denial of service, path disclosure, remote file upload, remote SQL injection, directory traversal, file download, and various other vulnerabilities. • https://www.exploit-db.com/exploits/43885 https://www.exploit-db.com/exploits/41691 http://packetstormsecurity.com/files/132138/SysAid-Help-Desk-14.4-Code-Execution-Denial-Of-Service-Traversal-SQL-Injection.html http://seclists.org/fulldisclosure/2015/Jun/8 http://www.securityfocus.com/archive/1/535679/100/0/threaded http://www.securityfocus.com/bid/75038 https://www.sysaid.com/blog/entry/sysaid-15-2-your-voice-your-service-desk https://seclists.org/fulldisclosure/2015/Jun/8 •