CVE-2023-33706: Authorization Bypass Through User-Controlled Key

SysAid before 23.2.15 allows Indirect Object Reference IDOR attacks to read ticket data via a modified sid parameter to EmailHtmlSourceIframe.jsp or a modified srID parameter to ShowMessage.jsp...

Sysaid Technologies SysAid Security Vulnerabilities

Sysaid Technologies SysAid is a suite of IT service management solutions from Sysaid Technologies, Israel. A security vulnerability exists in Sysaid Technologies SysAid versions prior to 23.2.15 that stems from the presence of an insecure direct object reference IDOR issue that allows an attacker...

CVE-2023-33706

SysAid CVE-2023-33706 affects SysAid before 23.2.15. The issue is an Indirect Object Reference (IDOR) allowing reading of ticket data by modifying sid to EmailHtmlSourceIframe.jsp or srID to ShowMessage.jsp. Affected component paths and parameters are explicitly named in connected sources. Impact...

CVE-2023-33706

SysAid before 23.2.15 allows Indirect Object Reference IDOR attacks to read ticket data via a modified sid parameter to EmailHtmlSourceIframe.jsp or a modified srID parameter to ShowMessage.jsp...

File Upload Vulnerability Exists in SysAid On-Premise

SysAid On-Premise is an IT Service Management ITSM and IT Asset Management ITAM solution designed to provide organizations with comprehensive, integrated IT management services. A file upload vulnerability exists in SysAid On-Premise that can be exploited by an attacker to gain server privileges...

Exploit for Path Traversal in Sysaid

Vulnerability Details 1. fofa: text body="sysaid-lo...

SysAid On-Premise < 23.3.36 Path Traversal

In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a file to the Tomcat webroot. No source data...

SysAid Server Installed (Windows)

Binary data sysaidserverwininstalled.nbin...

Attacks, Vulnerabilities and Actors 6 November to 12 November 2023

For a detailed threat digest, download the pdf file here Summary HiveForce Labs has recently made several significant discoveries related to cybersecurity threats. Over the past week, we identified a total of twenty-five executed attacks, six instances of adversary activity, and four exploited...

Lace Tempest Exploits Zero-Day in a Strategic Strike on SysAid

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary Lace Tempest has been implicated in exploiting a zero-day vulnerability, identified as CVE-2023-47246. This exploitation allows for the execution of code within SysAid on-premise software, leading...

CISA Adds Six Known Exploited Vulnerabilities to Catalog

CISA has added six new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2023-47246 SysAid Server Path Traversal Vulnerability CVE-2023-36844 Juniper Junos OS EX Series PHP External Variable Modification Vulnerability CVE-2023-36845...

SysAid Server Path Traversal Vulnerability

SysAid Server on-premises version contains a path traversal vulnerability that leads to code execution...

The vulnerability of the doPost method in the UserEntry class of the com.ilient.server package in the SysAid software for hardware and software support and control allows a perpetrator to execute arbitrary code.

The vulnerability of the doPost method in the UserEntry class of the com.ilient.server package in the SysAid software for hardware and software support and control involves the possibility of path traversal. Exploiting this vulnerability could allow an attacker to execute arbitrary code by loadin...

CVE-2023-47246

In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a file to the Tomcat webroot, as exploited in the wild in November 2023...

CVE-2023-47246

In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a file to the Tomcat webroot, as exploited in the wild in November 2023...

Path traversal

In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a file to the Tomcat webroot, as exploited in the wild in November 2023...

CVE-2023-47246: Improper Limitation of a Pathname to a Restricted Directory

In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a file to the Tomcat webroot, as exploited in the wild in November 2023...

CVE-2023-47246

In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a file to the Tomcat webroot, as exploited in the wild in November 2023. Recent assessments: cbeek-r7 at November 09, 2023 2:50pm UTC reported: On November 8, 2023, SysAid, an IT...

CVE-2023-47246

CVE-2023-47246 affects SysAid On-Premise prior to 23.3.36, where improper validation of user-supplied paths enables a path traversal leading to code execution by writing a file into the Tomcat webroot. Exploited in the wild during November 2023 (Lace Tempest activity) with reports of attackers de...

Sysaid Technologies SysAid 安全漏洞

SysAid On-Premise is an IT Service Management ITSM and IT Asset Management ITAM solution designed to provide organizations with comprehensive, integrated IT management services. A file upload vulnerability exists in SysAid On-Premise that can be exploited by an attacker to gain server privileges...