CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-43971
https://notcve.org/view.php?id=CVE-2021-43971
A SQL injection vulnerability in /mobile/SelectUsers.jsp in SysAid ITIL 20.4.74 b10 allows a remote authenticated attacker to execute arbitrary SQL commands via the filterText parameter. Una vulnerabilidad de inyección SQL en el archivo /mobile/SelectUsers.jsp en SysAid ITIL versión 20.4.74 b10, permite a un atacante remoto autenticado ejecutar comandos SQL arbitrarios por medio del parámetro filterText • https://github.com/atredispartners/advisories/blob/master/ATREDIS-2021-0002.md https://github.com/atredispartners/advisories/blob/master/ATREDIS-2022-0001.md https://www.sysaid.com/it-service-management-software/incident-management • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2021-36721 – Sysaid - Sysaid API User Enumeration
https://notcve.org/view.php?id=CVE-2021-36721
Sysaid API User Enumeration - Attacker sending requests to specific api path without any authorization before 21.3.60 version could get users names from the LDAP server. Enumeración de usuarios de la API de Sysaid - Los atacantes que envían peticiones a una ruta api específica sin ninguna autorización en versiones anteriores a 21.3.60, podrían conseguir los nombres de los usuarios del servidor LDAP • https://www.gov.il/en/departments/faq/cve_advisories •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 2CVE-2021-31862
https://notcve.org/view.php?id=CVE-2021-31862
SysAid 20.4.74 allows XSS via the KeepAlive.jsp stamp parameter without any authentication. SysAid versión 20.4.74, permite un ataque de tipo XSS por medio del parámetro de sello KeepAlive.jsp sin ninguna autenticación • https://github.com/RobertDra/CVE-2021-31862 https://github.com/RobertDra/CVE-2021-31862/blob/main/README.md https://www.sysaid.com/product/on-premise/latest-release • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-30486
https://notcve.org/view.php?id=CVE-2021-30486
SysAid 20.3.64 b14 is affected by Blind and Stacker SQL injection via AssetManagementChart.jsp (GET computerID), AssetManagementChart.jsp (POST group1), AssetManagementList.jsp (GET computerID or group1), or AssetManagementSummary.jsp (GET group1). SysAid versión 20.3.64 b14, está afectado por una inyección SQL de Blind y Stacker por medio de los archivos AssetManagementChart.jsp (GET computerID), AssetManagementChart.jsp (POST group1), AssetManagementList.jsp (GET computerID o group1), o AssetManagementSummary.jsp (GET group1) • https://eh337.net/2021/04/10/sysaid-ii • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2021-30049
https://notcve.org/view.php?id=CVE-2021-30049
SysAid 20.3.64 b14 is affected by Cross Site Scripting (XSS) via a /KeepAlive.jsp?stamp= URI. SysAid versión 20.3.64 b14, está afectado por una vulnerabilidad de tipo Cross Site Scripting (XSS) por medio de un URI /KeepAlive.jsp?stamp= • https://eh337.net/2021/03/30/sysaid • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •