CVE-2021-36721

SysAid IT service management product: authorization issue in the SysAid API prior to version 21.3.60. Root cause is insufficient authentication on a specific API path, allowing an attacker to retrieve usernames from an LDAP server. Affected: versions before 21.3.60. Impact: potential disclosure o...

CVE-2021-36721: Undefined Security Weakness

Sysaid API User Enumeration - Attacker sending requests to specific api path without any authorization before 21.3.60 version could get users names from the LDAP server...

PT-2021-21325

Name of the Vulnerable Software and Affected Versions Sysaid versions prior to 21.3.60 Description The issue allows an attacker to send requests to a specific API path without authorization, potentially obtaining user names from the LDAP server. Recommendations For versions prior to 21.3.60, upda...

SysAid 授权问题漏洞

Sysaid Technologies SysAid is a suite of IT service management solutions from Israel-based SysAid Technologies Sysaid Technologies.An authorization issue vulnerability exists in the Sysaid API in versions prior to 21.3.60, which stems from a lack of authentication measures or insufficient...

CVE-2021-36721

Sysaid API User Enumeration - Attacker sending requests to specific api path without any authorization before 21.3.60 version could get users names from the LDAP server...

CVE-2021-31862

SysAid 20.4.74 allows XSS via the KeepAlive.jsp stamp parameter without any authentication...

CVE-2021-31862

SysAid 20.4.74 allows XSS via the KeepAlive.jsp stamp parameter without any authentication...

Authentication flaw

SysAid 20.4.74 allows XSS via the KeepAlive.jsp stamp parameter without any authentication...

CVE-2021-31862

SysAid 20.4.74 allows XSS via the KeepAlive.jsp stamp parameter without any authentication...

CVE-2021-31862

SysAid 20.4.74 allows XSS via the KeepAlive.jsp stamp parameter without any authentication...

CVE-2021-31862

SysAid 20.4.74 contains a reflected Cross-Site Scripting (XSS) vulnerability in the KeepAlive.jsp stamp parameter, exploitable without authentication. Affected: SysAid 20.4.74 and earlier. Root cause: unencoded stamp parameter reflected into the page output. Impact: potentially executing maliciou...

PT-2021-19555

Name of the Vulnerable Software and Affected Versions: SysAid version 20.4.74 Description: The issue allows for cross-site scripting XSS attacks via the stamp parameter in the "KeepAlive.jsp" page without requiring any authentication. This means an attacker can inject malicious scripts into the...

Sysaid Technologies SysAid 跨站脚本漏洞

Sysaid Technologies SysAid is a suite of IT service management solutions from SysAid Technologies Sysaid Technologies, Israel. A security vulnerability exists in SysAid Technologies SysAid 20.4.74 that allows XSS via the KeepAlive.jsp tag parameter without any authentication...

CVE-2021-31862: Improper Neutralization of Input During Web Page Generation

SysAid 20.4.74 allows XSS via the KeepAlive.jsp stamp parameter without any authentication...

Exploit for Cross-site Scripting in Sysaid

CVE-2021-31862 SysAid 20.4.74 allows reflected XSS via the Ke...

CVE-2021-30049

SysAid 20.3.64 b14 is affected by Cross Site Scripting XSS via a /KeepAlive.jsp?stamp= URI...

CVE-2021-30486

SysAid 20.3.64 b14 is affected by Blind and Stacker SQL injection via AssetManagementChart.jsp GET computerID, AssetManagementChart.jsp POST group1, AssetManagementList.jsp GET computerID or group1, or AssetManagementSummary.jsp GET group1...

CVE-2021-30049

SysAid 20.3.64 b14 is affected by Cross Site Scripting XSS via a /KeepAlive.jsp?stamp= URI...

Cross site scripting

SysAid 20.3.64 b14 is affected by Cross Site Scripting XSS via a /KeepAlive.jsp?stamp= URI...

Sql injection

SysAid 20.3.64 b14 is affected by Blind and Stacker SQL injection via AssetManagementChart.jsp GET computerID, AssetManagementChart.jsp POST group1, AssetManagementList.jsp GET computerID or group1, or AssetManagementSummary.jsp GET group1...