CVSS: 10.0EPSS: 71%CPEs: 1EXPL: 6CVE-2017-12478 – Unitrends UEB http api remote code execution
https://notcve.org/view.php?id=CVE-2017-12478
07 Aug 2017 — It was discovered that the api/storage web interface in Unitrends Backup (UB) before 10.0.0 has an issue in which one of its input parameters was not validated. A remote attacker could use this flaw to bypass authentication and execute arbitrary commands with root privilege on the target system. Se ha descubierto que la interfaz web api/storage en Unitrends Backup (UB) en versiones anteriores a la 10.0.0 tiene un problema por el cual uno de sus parámetros de entrada no fue validado. Un atacante remoto podrí... • https://packetstorm.news/files/id/144694 • CWE-287: Improper Authentication •
CVSS: 9.8EPSS: 76%CPEs: 4EXPL: 6CVE-2015-6922 – Kaseya Virtual System Administrator Remote File Upload Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2015-6922
23 Sep 2015 — Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.33, 8.x before 8.0.0.23, 9.0 before 9.0.0.19, and 9.1 before 9.1.0.9 does not properly require authentication, which allows remote attackers to bypass authentication and (1) add an administrative account via crafted request to LocalAuth/setAccount.aspx or (2) write to and execute arbitrary files via a full pathname in the PathData parameter to ConfigTab/uploader.aspx. Kaseya Virtual System Administrator (VSA) versiones 7.x anteriores a 7.0.0.33, ver... • https://packetstorm.news/files/id/180886 • CWE-287: Improper Authentication •
CVSS: 8.8EPSS: 15%CPEs: 4EXPL: 4CVE-2015-6589 – Kaseya Virtual System Administrator Authenticated Remote File Upload Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2015-6589
23 Sep 2015 — Directory traversal vulnerability in Kaseya Virtual System Administrator (VSA) 7.0.0.0 before 7.0.0.33, 8..0.0.0 before 8.0.0.23, 9.0.0.0 before 9.0.0.19, and 9.1.0.0 before 9.1.0.9 allows remote authenticated users to write to and execute arbitrary files due to insufficient restrictions in file paths to json.ashx. La vulnerabilidad de Salto de Directorio en Kaseya Virtual System Administrator (VSA) versiones 7.0.0.0 anteriores a 7.0.0.33, versiones 8..0.0.0 anteriores a 8.0.0.23, versiones 9.0.0.0 anterior... • https://packetstorm.news/files/id/133782 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.5EPSS: 3%CPEs: 4EXPL: 1CVE-2015-2862 – Kaseya Virtual System Administrator (VSA) - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2015-2862
20 Jul 2015 — Directory traversal vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 before 9.0.0.14, and 9.1 before 9.1.0.4 allows remote authenticated users to read arbitrary files via a crafted HTTP request. Vulnerabilidad de salto de directorio en Kaseya Virtual System Administrator (VSA) en sus versiones 7.x anteriores a 7.0.0.29, 8.x anteriores a 8.0.0.18, 9.0 anteriores a 9.0.0.14 y 9.1 anteriores a 9.1.0.4 permite a usuarios remotos autenticados leer archivos ... • https://www.exploit-db.com/exploits/37621 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.1EPSS: 49%CPEs: 4EXPL: 1CVE-2015-2863 – Kaseya Virtual System Administrator (VSA) - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2015-2863
20 Jul 2015 — Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 before 9.0.0.14, and 9.1 before 9.1.0.4 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. Vulnerabilidad de Open Redirect en Kaseya Virtual System Administrator (VSA) en sus versiones 7.x anteriores a 7.0.0.29, 8.x anteriores a 8.0.0.18, 9.0 anteriores a 9.0.0.14 y 9.1 anteriores a 9.1.0.4 permite a atacantes remotos la re... • https://www.exploit-db.com/exploits/37621 •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2014-2926
https://notcve.org/view.php?id=CVE-2014-2926
14 Jul 2014 — kapfa.sys in Kaseya Virtual System Administrator (VSA) 6.5 before 6.5.0.17 and 7.0 before 7.0.0.16 allows local users to cause a denial of service (NULL pointer dereference and application crash) via unspecified vectors. kapfa.sys en Kaseya Virtual System Administrator (VSA) 6.5 anterior a 6.5.0.17 y 7.0 anterior a 7.0.0.16 permite a usuarios locales causar una denegación de servicio (referencia a puntero nulo y caída de aplicación) a través de vectores no especificados. • http://www.kb.cert.org/vuls/id/204988 •