Kaseya Virtual System Administrator Multiple Vulnerabilities (CVE-2015-6922)

Multiple vulnerabilities exists in Kaseya Virtual System Administrator. These vulnerabilities includes privilege escalation to "Master Admin" and multiple remote code execution vulnerabilities. Successful exploitation of these vulnerabilities could lead to remote execution of arbitrary code under...

Kaseya Virtual System Administrator - Multiple Vulnerabilities

Exploit for asp platform in category web applications Kaseya VSA is an IT management platform for small and medium corporates. From its console you can control thousands of computers and mobile devices. So that if you own the Kaseya server, you own the organisation. With this post I'm also...

Kaseya Virtual System Administrator Elevation of Privilege Vulnerability

Kaseya Virtual System Administrator is a suite of IT system management platforms for simplifying and automating IT services. Kaseya Virtual System Administrator does not enforce user authentication and does not restrict target file paths, allowing remote attackers to exploit vulnerabilities to...

Kaseya Virtual System Administrator Remote Code Execution Vulnerability

Kaseya Virtual System Administrator is a suite of IT system management platforms for simplifying and automating IT services. Kaseya Virtual System Administrator's json.ashx handles HTTP headers without restricting the destination file path, allowing remote attackers to submit a special request to...

PT-2015-7305

Name of the Vulnerable Software and Affected Versions Kaseya Virtual System Administrator versions 7.0.0.0 through 7.0.0.32 Kaseya Virtual System Administrator versions 8.0.0.0 through 8.0.0.22 Kaseya Virtual System Administrator versions 9.0.0.0 through 9.0.0.18 Kaseya Virtual System Administrat...

PT-2015-7406

Name of the Vulnerable Software and Affected Versions Kaseya Virtual System Administrator VSA versions 7.x through 7.0.0.32 Kaseya Virtual System Administrator VSA versions 8.x through 8.0.0.22 Kaseya Virtual System Administrator VSA versions 9.0 through 9.0.0.18 Kaseya Virtual System Administrat...

Kaseya Virtual System Administrator Remote File Upload Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Kaseya Virtual System Administrator. Authentication is not required to exploit this vulnerability. The specific flaw exists within the uploader.aspx page, which does not properly require that users...

Kaseya Virtual System Administrator Authenticated Remote File Upload Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Kaseya Virtual System Administrator. Authentication is required to exploit this vulnerability. The specific flaw exists within the json.ashx HTTP handler, which does not restrict destination file...

Kaseya Virtual System Administrator Remote Privilege Escalation Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Kaseya Virtual System Administrator. Authentication is not required to exploit this vulnerability. The specific flaw exists within the forwarding service's handing of the setAccount.aspx page, whic...

CVE-2015-2862

Directory traversal vulnerability in Kaseya Virtual System Administrator VSA 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 before 9.0.0.14, and 9.1 before 9.1.0.4 allows remote authenticated users to read arbitrary files via a crafted HTTP request...

Directory traversal

Directory traversal vulnerability in Kaseya Virtual System Administrator VSA 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 before 9.0.0.14, and 9.1 before 9.1.0.4 allows remote authenticated users to read arbitrary files via a crafted HTTP request...

CVE-2015-2862

Directory traversal vulnerability in Kaseya Virtual System Administrator VSA 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 before 9.0.0.14, and 9.1 before 9.1.0.4 allows remote authenticated users to read arbitrary files via a crafted HTTP request...

CVE-2015-2863

Open redirect vulnerability in Kaseya Virtual System Administrator VSA 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 before 9.0.0.14, and 9.1 before 9.1.0.4 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

CVE-2015-2863: Undefined Security Weakness

Open redirect vulnerability in Kaseya Virtual System Administrator VSA 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 before 9.0.0.14, and 9.1 before 9.1.0.4 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

CVE-2015-2862: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in Kaseya Virtual System Administrator VSA 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 before 9.0.0.14, and 9.1 before 9.1.0.4 allows remote authenticated users to read arbitrary files via a crafted HTTP request...

PT-2015-5946

Name of the Vulnerable Software and Affected Versions Kaseya Virtual System Administrator VSA versions 7.x through 7.0.0.28 Kaseya Virtual System Administrator VSA versions 8.x through 8.0.0.17 Kaseya Virtual System Administrator VSA versions 9.0 through 9.0.0.13 Kaseya Virtual System Administrat...

PT-2015-5945

Name of the Vulnerable Software and Affected Versions Kaseya Virtual System Administrator VSA versions 7.x before 7.0.0.29 Kaseya Virtual System Administrator VSA versions 8.x before 8.0.0.18 Kaseya Virtual System Administrator VSA versions 9.0 before 9.0.0.14 Kaseya Virtual System Administrator...

Kaseya Virtual System Administrator Multiple Vulnerabilities - Active Check

Kaseya Virtual System Administrator is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Kaseya Virtual System Administrator File Download / Open Redirect

tl;dr Two vulns in Kaseya Virtual System Administrator - an authenticated arbitrary file download and two lame open redirects. Full advisory text below and at 1. Thanks to CERT for helping me to disclose these vulnerabilities 2. Multiple vulnerabilities in Kaseya Virtual System Administrator...

Kaseya Virtual System Administrator contains multiple vulnerabilities

Overview Kaseya Virtual System Administrator VSA, versions R9 and possibly earlier, contains arbitrary file download and open redirect vulnerabilities. Description CWE-22: Improper Limitation of Pathname to a Restricted Directory 'Path Traversal' - CVE-2015-2862Kaseya VSA is an IT management...