Unrestricted file upload

An unrestricted file upload vulnerability in /UploadPsIcon.jsp in SysAid ITIL 20.4.74 b10 allows a remote authenticated attacker to upload an arbitrary file via the file parameter in the HTTP POST body. A successful request returns the absolute, server-side filesystem path of the uploaded file...

Unrestricted file upload

An unrestricted file copy vulnerability in /UserSelfServiceSettings.jsp in SysAid ITIL 20.4.74 b10 allows a remote authenticated attacker to copy arbitrary files on the server filesystem to the web root with an arbitrary filename via the tempFile and fileName parameters in the HTTP POST body...

Sql injection

A SQL injection vulnerability in /mobile/SelectUsers.jsp in SysAid ITIL 20.4.74 b10 allows a remote authenticated attacker to execute arbitrary SQL commands via the filterText parameter...

CVE-2021-43974

An issue was discovered in SysAid ITIL 20.4.74 b10. The /enduserreg endpoint is used to register end users anonymously, but does not respect the server-side setting that determines if anonymous users are allowed to register new accounts. Configuring the server-side setting to disable anonymous us...

CVE-2021-43974

CVE-2021-43974 affects SysAid ITIL 20.4.74 b10. The /enduserreg endpoint allows anonymous users to register new accounts even when the server-side setting to disable anonymous registration is enabled, bypassing client-side controls and enabling account creation without authentication. Connected d...

CVE-2021-43973

This CVE concerns SysAid ITIL 20.4.74 b10, where UploadPsIcon.jsp is vulnerable to an unrestricted file upload. An authenticated remote attacker can upload an arbitrary file via the file parameter in an HTTP POST, with the server returning the uploaded file’s absolute path. The issue affects the ...

CVE-2021-43973

An unrestricted file upload vulnerability in /UploadPsIcon.jsp in SysAid ITIL 20.4.74 b10 allows a remote authenticated attacker to upload an arbitrary file via the file parameter in the HTTP POST body. A successful request returns the absolute, server-side filesystem path of the uploaded file...

CVE-2021-43972

CVE-2021-43972 concerns SysAid ITIL 20.4.74 b10. The vulnerability is an unrestricted file copy in /UserSelfServiceSettings.jsp, exploitable by a remote authenticated attacker who can copy arbitrary server files to the web root via tempFile and fileName in the HTTP POST body. The root cause is in...

CVE-2021-43972

An unrestricted file copy vulnerability in /UserSelfServiceSettings.jsp in SysAid ITIL 20.4.74 b10 allows a remote authenticated attacker to copy arbitrary files on the server filesystem to the web root with an arbitrary filename via the tempFile and fileName parameters in the HTTP POST body...

CVE-2021-43971

A SQL injection vulnerability in /mobile/SelectUsers.jsp in SysAid ITIL 20.4.74 b10 allows a remote authenticated attacker to execute arbitrary SQL commands via the filterText parameter...

CVE-2021-43971

CVE-2021-43971 is a SQL injection vulnerability in SysAid ITIL, affect­ing SysAid ITIL 20.4.74 b10. The issue is exploitable via the filterText parameter in /mobile/SelectUsers.jsp, allowing a remote authenticated attacker to execute arbitrary SQL commands. The connected documents confirm the aff...

Sysaid Technologies SysAid 代码问题漏洞

SysAid ITIL in version 20.4.74 b10 is vulnerable to file uploads due to the lack of valid validation of uploaded files in UploadPsIcon.jsp in SysAid. A remote authenticated attacker can exploit this vulnerability to upload arbitrary files via the file parameter in the HTTP POST body...

Sysaid Technologies SysAid 安全漏洞

Sysaid Technologies SysAid is an IT service management solution from the Israeli company SysAid Technologies Sysaid Technologies.A security vulnerability exists in SysAid ITIL, which could be exploited by an attacker to copy arbitrary files on the server file system to the Web root via the HTTP...

Sysaid Technologies SysAid SQL注入漏洞

Sysaid Technologies SysAid is an IT service management solution from Israel-based SysAid Technologies Sysaid Technologies.A SQL injection vulnerability exists in SysAid ITIL, which can be exploited by attackers to execute arbitrary SQL commands via the filterText parameter...

Sysaid Technologies SysAid 访问控制错误漏洞

Sysaid Technologies SysAid is an IT service management solution from the Israeli company SysAid Technologies Sysaid Technologies. a security vulnerability in SysAid ITIL could be exploited by an attacker to publish registration data to create new accounts without prior authentication...

SysAid authorization issue vulnerability

Sysaid Technologies SysAid is a suite of IT service management solutions from Israel-based SysAid Technologies Sysaid Technologies.An authorization issue vulnerability exists in the Sysaid API in versions prior to 21.3.60, which stems from a lack of authentication measures or insufficient...

CVE-2021-36721

Sysaid API User Enumeration - Attacker sending requests to specific api path without any authorization before 21.3.60 version could get users names from the LDAP server...

CVE-2021-36721

Sysaid API User Enumeration - Attacker sending requests to specific api path without any authorization before 21.3.60 version could get users names from the LDAP server...

Authorization

Sysaid API User Enumeration - Attacker sending requests to specific api path without any authorization before 21.3.60 version could get users names from the LDAP server...

CVE-2021-36721

SysAid IT service management product: authorization issue in the SysAid API prior to version 21.3.60. Root cause is insufficient authentication on a specific API path, allowing an attacker to retrieve usernames from an LDAP server. Affected: versions before 21.3.60. Impact: potential disclosure o...