CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-15506
https://notcve.org/view.php?id=CVE-2019-15506
26 Aug 2019 — An issue was discovered in Kaseya Virtual System Administrator (VSA) through 9.4.0.37. It has a critical information disclosure vulnerability. An unauthenticated attacker can send properly formatted requests to the web application and download sensitive files and information. For example, the /DATAREPORTS directory can be farmed for reports. Because this directory contains the results of reports such as NMAP, Patch Status, and Active Directory domain metadata, an attacker can easily collect this critical in... • http://dfdrconsulting.com/2019/cyber-security/cve-2019-15506-kaseya-vsa-critical-information-disclosure-unauthenticated-access • CWE-306: Missing Authentication for Critical Function •
CVSS: 7.4EPSS: 0%CPEs: 1EXPL: 1CVE-2017-12410 – Kaseya Virtual System Administrator (VSA) Local Privilege Escalation
https://notcve.org/view.php?id=CVE-2017-12410
23 Mar 2018 — It is possible to exploit a Time of Check & Time of Use (TOCTOU) vulnerability by winning a race condition when Kaseya Virtual System Administrator agent 9.3.0.11 and earlier tries to execute its binaries from working and/or temporary folders. Successful exploitation results in the execution of arbitrary programs with "NT AUTHORITY\SYSTEM" privileges. Es posible explotar una vulnerabilidad Time of Check Time of Use (TOCTOU) al ganar una condición de carrera cuando las versiones 9.3.0.11 y anteriores del age... • https://packetstorm.news/files/id/146871 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 8.8EPSS: 14%CPEs: 4EXPL: 4CVE-2015-6589 – Kaseya Virtual System Administrator Authenticated Remote File Upload Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2015-6589
23 Sep 2015 — Directory traversal vulnerability in Kaseya Virtual System Administrator (VSA) 7.0.0.0 before 7.0.0.33, 8..0.0.0 before 8.0.0.23, 9.0.0.0 before 9.0.0.19, and 9.1.0.0 before 9.1.0.9 allows remote authenticated users to write to and execute arbitrary files due to insufficient restrictions in file paths to json.ashx. La vulnerabilidad de Salto de Directorio en Kaseya Virtual System Administrator (VSA) versiones 7.0.0.0 anteriores a 7.0.0.33, versiones 8..0.0.0 anteriores a 8.0.0.23, versiones 9.0.0.0 anterior... • https://packetstorm.news/files/id/133782 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.8EPSS: 76%CPEs: 4EXPL: 6CVE-2015-6922 – Kaseya Virtual System Administrator Remote File Upload Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2015-6922
23 Sep 2015 — Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.33, 8.x before 8.0.0.23, 9.0 before 9.0.0.19, and 9.1 before 9.1.0.9 does not properly require authentication, which allows remote attackers to bypass authentication and (1) add an administrative account via crafted request to LocalAuth/setAccount.aspx or (2) write to and execute arbitrary files via a full pathname in the PathData parameter to ConfigTab/uploader.aspx. Kaseya Virtual System Administrator (VSA) versiones 7.x anteriores a 7.0.0.33, ver... • https://packetstorm.news/files/id/180886 • CWE-287: Improper Authentication •
CVSS: 6.5EPSS: 3%CPEs: 4EXPL: 1CVE-2015-2862 – Kaseya Virtual System Administrator (VSA) - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2015-2862
20 Jul 2015 — Directory traversal vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 before 9.0.0.14, and 9.1 before 9.1.0.4 allows remote authenticated users to read arbitrary files via a crafted HTTP request. Vulnerabilidad de salto de directorio en Kaseya Virtual System Administrator (VSA) en sus versiones 7.x anteriores a 7.0.0.29, 8.x anteriores a 8.0.0.18, 9.0 anteriores a 9.0.0.14 y 9.1 anteriores a 9.1.0.4 permite a usuarios remotos autenticados leer archivos ... • https://www.exploit-db.com/exploits/37621 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.1EPSS: 49%CPEs: 4EXPL: 1CVE-2015-2863 – Kaseya Virtual System Administrator (VSA) - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2015-2863
20 Jul 2015 — Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 before 9.0.0.14, and 9.1 before 9.1.0.4 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. Vulnerabilidad de Open Redirect en Kaseya Virtual System Administrator (VSA) en sus versiones 7.x anteriores a 7.0.0.29, 8.x anteriores a 8.0.0.18, 9.0 anteriores a 9.0.0.14 y 9.1 anteriores a 9.1.0.4 permite a atacantes remotos la re... • https://www.exploit-db.com/exploits/37621 •