PT-2021-18613

Name of the Vulnerable Software and Affected Versions Kaseya VSA versions prior to 9.5.6 Description The issue allows for semi-authenticated local file inclusion, where the contents of arbitrary files can be returned by the web server. A valid session ID is required but can be easily obtained. Th...

CVE-2021-30121: Inclusion of Functionality from Untrusted Control Sphere

Semi-authenticated local file inclusion The contents of arbitrary files can be returned by the webserver Example request: https://x.x.x.x/KLC/js/Kaseya.SB.JS/js.aspx?path=C:\Kaseya\WebPages\dl.asp A valid sessionId is required but can be easily obtained via CVE-2021-30118...

PT-2017-15135

Name of the Vulnerable Software and Affected Versions BA SYSTEMS BAS Web versions on BAS920 devices with Firmware 01.01.00, HTTPserv 00002, and Script 02. BA SYSTEMS BAS Web versions on ISC2000 devices Description The issue allows remote attackers to obtain sensitive information by making a reque...