Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
kaseya vsa vulnerabilities and exploits
(subscribe to this query)
7.5
CVSSv2
CVE-2021-30116
Kaseya VSA prior to 9.5.7 allows credential disclosure, as exploited in the wild in July 2021. By default Kaseya VSA on premise offers a download page where the clients for the installation can be downloaded. The default URL for this page is https://x.x.x.x/dl.asp When an attacke...
Kaseya Vsa Agent
Kaseya Vsa Server
3 Github repositories
1 Article
6.5
CVSSv2
CVE-2021-30117
The API call /InstallTab/exportFldr.asp is vulnerable to a semi-authenticated boolean-based blind SQL injection in the parameter fldrId. Detailed description --- Given the following request: ``` GET /InstallTab/exportFldr.asp?fldrId=1’ HTTP/1.1 Host: 192.168.1.194 User-Agen...
Kaseya Vsa
10
CVSSv2
CVE-2021-30118
An attacker can upload files with the privilege of the Web Server process for Kaseya VSA Unified Remote Monitoring & Management (RMM) 9.5.4.2149 and subsequently use these files to execute asp commands The api /SystemTab/uploader.aspx is vulnerable to an unauthenticated arbit...
Kaseya Vsa
4
CVSSv2
CVE-2021-30121
Semi-authenticated local file inclusion The contents of arbitrary files can be returned by the webserver Example request: `https://x.x.x.x/KLC/js/Kaseya.SB.JS/js.aspx?path=C:\Kaseya\WebPages\dl.asp` A valid sessionId is required but can be easily obtained via CVE-2021-30118
Kaseya Vsa
5
CVSSv2
CVE-2021-30201
The API /vsaWS/KaseyaWS.asmx can be used to submit XML to the system. When this XML is processed (external) entities are insecurely processed and fetched by the system and returned to the attacker. Detailed description Given the following request: ``` POST /vsaWS/KaseyaWS.asmx HT...
Kaseya Vsa
3.5
CVSSv2
CVE-2021-30119
Authenticated reflective XSS in HelpDeskTab/rcResults.asp The parameter result of /HelpDeskTab/rcResults.asp is insecurely returned in the requested web page and can be used to perform a Cross Site Scripting attack Example request: `https://x.x.x.x/HelpDeskTab/rcResults.asp?resul...
Kaseya Vsa
5
CVSSv2
CVE-2021-30120
Kaseya VSA prior to 9.5.7 allows malicious users to bypass the 2FA requirement. The need to use 2FA for authentication in enforce client-side instead of server-side and can be bypassed using a local proxy. Thus rendering 2FA useless. Detailed description --- During the login proc...
Kaseya Vsa
7.5
CVSSv2
CVE-2015-6922
Kaseya Virtual System Administrator (VSA) 7.x prior to 7.0.0.33, 8.x prior to 8.0.0.23, 9.0 prior to 9.0.0.19, and 9.1 prior to 9.1.0.9 does not properly require authentication, which allows remote malicious users to bypass authentication and (1) add an administrative account via...
Kaseya Virtual System Administrator
2 EDB exploits
6.5
CVSSv2
CVE-2015-6589
Directory traversal vulnerability in Kaseya Virtual System Administrator (VSA) 7.0.0.0 prior to 7.0.0.33, 8..0.0.0 prior to 8.0.0.23, 9.0.0.0 prior to 9.0.0.19, and 9.1.0.0 prior to 9.1.0.9 allows remote authenticated users to write to and execute arbitrary files due to insuffici...
Kaseya Virtual System Administrator
2 EDB exploits
7.2
CVSSv2
CVE-2019-14510
An issue exists in Kaseya VSA RMM up to and including 9.5.0.22. When using the default configuration, the LAN Cache feature creates a local account FSAdminxxxxxxxxx (e.g., FSAdmin123456789) on the server that hosts the LAN Cache and all clients that are assigned to a LAN Cache. T...
Kaseya Vsa
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-34377
CVE-2024-20859
CVE-2023-49606
inject
arbitrary
CVE-2024-33788
CVE-2024-30973
IDOR
CVE-2024-33907
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
1
2
NEXT »