kaseya virtual system administrator vulnerabilities and exploits

(subscribe to this query)

NA

kapfa.sys in Kaseya Virtual System Administrator (VSA) 6.5 prior to 6.5.0.17 and 7.0 prior to 7.0.0.16 allows local users to cause a denial of service (NULL pointer dereference and application crash) via unspecified vectors.

Kaseya Virtual System Administrator 6.5 Kaseya Virtual System Administrator 7.0

7.4

CVSSv3

It is possible to exploit a Time of Check & Time of Use (TOCTOU) vulnerability by winning a race condition when Kaseya Virtual System Administrator agent 9.3.0.11 and previous versions tries to execute its binaries from working and/or temporary folders. Successful exploitatio...

Kaseya Virtual System Administrator

9.8

CVSSv3

Kaseya Virtual System Administrator (VSA) 7.x prior to 7.0.0.33, 8.x prior to 8.0.0.23, 9.0 prior to 9.0.0.19, and 9.1 prior to 9.1.0.9 does not properly require authentication, which allows remote malicious users to bypass authentication and (1) add an administrative account via...

Kaseya Virtual System Administrator

2 EDB exploits

NA

Directory traversal vulnerability in Kaseya Virtual System Administrator (VSA) 7.x prior to 7.0.0.29, 8.x prior to 8.0.0.18, 9.0 prior to 9.0.0.14, and 9.1 prior to 9.1.0.4 allows remote authenticated users to read arbitrary files via a crafted HTTP request.

Kaseya Virtual System Administrator

1 EDB exploit

NA

Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x prior to 7.0.0.29, 8.x prior to 8.0.0.18, 9.0 prior to 9.0.0.14, and 9.1 prior to 9.1.0.4 allows remote malicious users to redirect users to arbitrary web sites and conduct phishing attacks via unspecifi...

Kaseya Virtual System Administrator

1 EDB exploit

9.8

CVSSv3

Kaseya VSA RMM before R9.3 9.3.0.35, R9.4 prior to 9.4.0.36, and R9.5 prior to 9.5.0.5 allows unprivileged remote malicious users to execute PowerShell payloads on all managed devices. In January 2018, attackers actively exploited this vulnerability in the wild.

Kaseya Virtual System Administrator

1 Article

8.8

CVSSv3

Directory traversal vulnerability in Kaseya Virtual System Administrator (VSA) 7.0.0.0 prior to 7.0.0.33, 8..0.0.0 prior to 8.0.0.23, 9.0.0.0 prior to 9.0.0.19, and 9.1.0.0 prior to 9.1.0.9 allows remote authenticated users to write to and execute arbitrary files due to insuffici...

Kaseya Virtual System Administrator

2 EDB exploits

7.5

CVSSv3

An issue exists in Kaseya Virtual System Administrator (VSA) up to and including 9.4.0.37. It has a critical information disclosure vulnerability. An unauthenticated attacker can send properly formatted requests to the web application and download sensitive files and information....

Kaseya Virtual System Administrator

9.8

CVSSv3

Kaseya VSA prior to 9.5.7 allows credential disclosure, as exploited in the wild in July 2021. By default Kaseya VSA on premise offers a download page where the clients for the installation can be downloaded. The default URL for this page is https://x.x.x.x/dl.asp When an attacke...

Kaseya Vsa Agent Kaseya Vsa Server

2 Github repositories1 Article

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook