Kaseya Releases Patches for Flaws Exploited in Widespread Ransomware Attack

Florida-based software vendor Kaseya on Sunday rolled out urgent updates to address critical security vulnerabilities in its Virtual System Administrator VSA solution that was used as a jumping off point to target as many as 1,500 businesses across the globe as part of a widespread supply-chain...

Kaseya VSA < 9.5.7a Multiple Vulnerabilities

The version of Kaseya VSA installed on the remote host is affected by multiple vulnerabilities as referenced in the vendor advisory: - Credentials leak and business logic flaw. CVE-2021-30116 - Cross-Site Scripting vulnerability XSS. CVE-2021-30119 - 2FA Authentication bypass. CVE-2021-30120 Note...

CVE-2021-30119

The Kaseya VSA Remote Monitoring and Management (RMM) software is vulnerable to an authenticated reflective Cross-Site Scripting (XSS) flaw. The issue resides in the HelpDeskTab/rcResults.asp page, where the result parameter is insecurely returned, and in the done.asp page, where the FileName par...

CVE-2021-30119 Authenticated Authenticated reflective XSS in Kaseya VSA <= v9.5.6

Authenticated reflective XSS in HelpDeskTab/rcResults.asp The parameter result of /HelpDeskTab/rcResults.asp is insecurely returned in the requested web page and can be used to perform a Cross Site Scripting attack Example request:...