EUVD-2015-2950

Malware in sbrugna...

EUVD-2017-3983

Malware in sbrugna...

CVE-2015-6922: Improper Authentication

Kaseya Virtual System Administrator VSA 7.x before 7.0.0.33, 8.x before 8.0.0.23, 9.0 before 9.0.0.19, and 9.1 before 9.1.0.9 does not properly require authentication, which allows remote attackers to bypass authentication and 1 add an administrative account via crafted request to...

CVE-2015-6589: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in Kaseya Virtual System Administrator VSA 7.0.0.0 before 7.0.0.33, 8..0.0.0 before 8.0.0.23, 9.0.0.0 before 9.0.0.19, and 9.1.0.0 before 9.1.0.9 allows remote authenticated users to write to and execute arbitrary files due to insufficient restrictions in file...

CVE-2019-15506

An issue was discovered in Kaseya Virtual System Administrator VSA through 9.4.0.37. It has a critical information disclosure vulnerability. An unauthenticated attacker can send properly formatted requests to the web application and download sensitive files and information. For example, the...

PT-2019-14231

Name of the Vulnerable Software and Affected Versions Kaseya Virtual System Administrator VSA versions through 9.4.0.37 Description The issue concerns a critical information disclosure problem. An unauthenticated attacker can send properly formatted requests to the web application and download...

CVE-2019-15506: Missing Authentication for Critical Function

An issue was discovered in Kaseya Virtual System Administrator VSA through 9.4.0.37. It has a critical information disclosure vulnerability. An unauthenticated attacker can send properly formatted requests to the web application and download sensitive files and information. For example, the...

Race condition

It is possible to exploit a Time of Check & Time of Use TOCTOU vulnerability by winning a race condition when Kaseya Virtual System Administrator agent 9.3.0.11 and earlier tries to execute its binaries from working and/or temporary folders. Successful exploitation results in the execution of...

CVE-2017-12410

It is possible to exploit a Time of Check & Time of Use TOCTOU vulnerability by winning a race condition when Kaseya Virtual System Administrator agent 9.3.0.11 and earlier tries to execute its binaries from working and/or temporary folders. Successful exploitation results in the execution of...

CVE-2017-12410

Kaseya VSA Agent

PT-2018-5398

Name of the Vulnerable Software and Affected Versions: Kaseya Virtual System Administrator versions 9.3.0.11 and earlier Description: The issue is related to a Time of Check & Time of Use TOCTOU vulnerability. This vulnerability can be exploited by winning a race condition when the Kaseya Virtual...

CVE-2017-12410: Concurrent Execution using Shared Resource with Improper Synchronization

It is possible to exploit a Time of Check & Time of Use TOCTOU vulnerability by winning a race condition when Kaseya Virtual System Administrator agent 9.3.0.11 and earlier tries to execute its binaries from working and/or temporary folders. Successful exploitation results in the execution of...

Kaseya Virtual System Administrator - Multiple Vulnerabilities

Exploit for asp platform in category web applications Kaseya VSA is an IT management platform for small and medium corporates. From its console you can control thousands of computers and mobile devices. So that if you own the Kaseya server, you own the organisation. With this post I'm also...

Kaseya Virtual System Administrator Elevation of Privilege Vulnerability

Kaseya Virtual System Administrator is a suite of IT system management platforms for simplifying and automating IT services. Kaseya Virtual System Administrator does not enforce user authentication and does not restrict target file paths, allowing remote attackers to exploit vulnerabilities to...

Kaseya Virtual System Administrator Remote Privilege Escalation Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Kaseya Virtual System Administrator. Authentication is not required to exploit this vulnerability. The specific flaw exists within the forwarding service's handing of the setAccount.aspx page, whic...

PT-2015-7305

Name of the Vulnerable Software and Affected Versions Kaseya Virtual System Administrator versions 7.0.0.0 through 7.0.0.32 Kaseya Virtual System Administrator versions 8.0.0.0 through 8.0.0.22 Kaseya Virtual System Administrator versions 9.0.0.0 through 9.0.0.18 Kaseya Virtual System Administrat...

PT-2015-7406

Name of the Vulnerable Software and Affected Versions Kaseya Virtual System Administrator VSA versions 7.x through 7.0.0.32 Kaseya Virtual System Administrator VSA versions 8.x through 8.0.0.22 Kaseya Virtual System Administrator VSA versions 9.0 through 9.0.0.18 Kaseya Virtual System Administrat...

Kaseya Virtual System Administrator Authenticated Remote File Upload Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Kaseya Virtual System Administrator. Authentication is required to exploit this vulnerability. The specific flaw exists within the json.ashx HTTP handler, which does not restrict destination file...

CVE-2015-2862

Directory traversal vulnerability in Kaseya Virtual System Administrator VSA 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 before 9.0.0.14, and 9.1 before 9.1.0.4 allows remote authenticated users to read arbitrary files via a crafted HTTP request...

Directory traversal

Directory traversal vulnerability in Kaseya Virtual System Administrator VSA 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 before 9.0.0.14, and 9.1 before 9.1.0.4 allows remote authenticated users to read arbitrary files via a crafted HTTP request...