SysAid 20.4.74 - Cross-Site Scripting

SysAid 20.4.74 contains a reflected cross-site scripting vulnerability via the KeepAlive.jsp stamp parameter. id: CVE-2021-31862 info: name: SysAid 20.4.74 - Cross-Site Scripting author: jas37 severity: medium description: SysAid 20.4.74 contains a reflected cross-site scripting vulnerability via...

SysAid file upload vulnerability

SysAid ITIL in version 20.4.74 b10 is vulnerable to file uploads due to the lack of valid validation of uploaded files in UploadPsIcon.jsp in SysAid. A remote authenticated attacker can exploit this vulnerability to upload arbitrary files via the file parameter in the HTTP POST body...

CVE-2021-43974

CVE-2021-43974 affects SysAid ITIL 20.4.74 b10. The /enduserreg endpoint allows anonymous users to register new accounts even when the server-side setting to disable anonymous registration is enabled, bypassing client-side controls and enabling account creation without authentication. Connected d...

CVE-2021-43972

An unrestricted file copy vulnerability in /UserSelfServiceSettings.jsp in SysAid ITIL 20.4.74 b10 allows a remote authenticated attacker to copy arbitrary files on the server filesystem to the web root with an arbitrary filename via the tempFile and fileName parameters in the HTTP POST body...

CVE-2021-31862

SysAid 20.4.74 allows XSS via the KeepAlive.jsp stamp parameter without any authentication...

Authentication flaw

SysAid 20.4.74 allows XSS via the KeepAlive.jsp stamp parameter without any authentication...

CVE-2021-31862

SysAid 20.4.74 contains a reflected Cross-Site Scripting (XSS) vulnerability in the KeepAlive.jsp stamp parameter, exploitable without authentication. Affected: SysAid 20.4.74 and earlier. Root cause: unencoded stamp parameter reflected into the page output. Impact: potentially executing maliciou...

Sysaid Technologies SysAid 跨站脚本漏洞

Sysaid Technologies SysAid is a suite of IT service management solutions from SysAid Technologies Sysaid Technologies, Israel. A security vulnerability exists in SysAid Technologies SysAid 20.4.74 that allows XSS via the KeepAlive.jsp tag parameter without any authentication...