CVE-2021-30117

CVE-2021-30117 affects Kaseya VSA prior to 9.5.6. It is a semi-authenticated boolean-based blind SQL injection in the exportFldr.asp endpoint (fldrId parameter). Connected CVE data confirms the affected product and the vulnerable version range (

CVE-2021-30118

CVE-2021-30118 affects Kaseya VSA (RMM) prior to 9.5.7, via unauthenticated arbitrary file upload in the web UI path /SystemTab/uploader.aspx. The request can write files with arbitrary content to locations the web server can access (e.g., webroot) and, if code (ASPX) is uploaded, execute it in t...

CVE-2021-30119

The Kaseya VSA Remote Monitoring and Management (RMM) software is vulnerable to an authenticated reflective Cross-Site Scripting (XSS) flaw. The issue resides in the HelpDeskTab/rcResults.asp page, where the result parameter is insecurely returned, and in the done.asp page, where the FileName par...

CVE-2021-30120

Kaseya VSA versions prior to 9.5.7 are vulnerable to a Two-Factor Authentication (2FA) bypass due to an insecure design where 2FA enforcement occurs on the client-side rather than the server-side. During the login process, after the initial username and password authentication, the server sends r...

CVE-2021-30201

CVE-2021-30201 affects Kaseya VSA (on‑premises/server side) where the API /vsaWS/KaseyaWS.asmx processes XML with external entities. The vulnerability arises from insecure handling of XML external entities, allowing an attacker to cause the server to read local files (e.g., c:\kaseya\kserver\kser...

CVE-2021-30121

CVE-2021-30121 is described as a semi-authenticated local file inclusion vulnerability. The NVD description shows an attacker could fetch contents of arbitrary files via the webserver (example: Kaseya-related path) and notes that a valid sessionId is required, which can be obtained via CVE-2021-3...

CVE-2019-14510

CVE-2019-14510 affects Kaseya VSA RMM up to 9.5.0.22. The default LAN Cache configuration creates a local account FSAdminxxxxxxxxx on the LAN Cache host and all assigned clients, placing it in each client’s local Administrators group. If a client is a Domain Controller, the account is created as ...