Vulnerabilities > Sysaid
DATE | CVE | VULNERABILITY TITLE | RISK |
---|---|---|---|
2022-05-12 | CVE-2022-23166 | Path Traversal vulnerability in Sysaid Sysaid – Sysaid Local File Inclusion (LFI) – An unauthenticated attacker can access to the system by accessing to "/lib/tinymce/examples/index.html" path. | 10.0 |
2022-01-11 | CVE-2021-43971 | SQL Injection vulnerability in Sysaid 20.4.74 A SQL injection vulnerability in /mobile/SelectUsers.jsp in SysAid ITIL 20.4.74 b10 allows a remote authenticated attacker to execute arbitrary SQL commands via the filterText parameter. | 6.5 |
2022-01-11 | CVE-2021-43972 | Unspecified vulnerability in Sysaid 20.4.74 An unrestricted file copy vulnerability in /UserSelfServiceSettings.jsp in SysAid ITIL 20.4.74 b10 allows a remote authenticated attacker to copy arbitrary files on the server filesystem to the web root (with an arbitrary filename) via the tempFile and fileName parameters in the HTTP POST body. | 6.8 |
2022-01-11 | CVE-2021-43973 | Unrestricted Upload of File with Dangerous Type vulnerability in Sysaid 20.4.74 An unrestricted file upload vulnerability in /UploadPsIcon.jsp in SysAid ITIL 20.4.74 b10 allows a remote authenticated attacker to upload an arbitrary file via the file parameter in the HTTP POST body. | 6.5 |
2022-01-11 | CVE-2021-43974 | Missing Authentication for Critical Function vulnerability in Sysaid Itil 20.4.74 An issue was discovered in SysAid ITIL 20.4.74 b10. | 5.0 |
2021-12-14 | CVE-2021-36721 | Unspecified vulnerability in Sysaid Application Programming Interface Sysaid API User Enumeration - Attacker sending requests to specific api path without any authorization before 21.3.60 version could get users names from the LDAP server. | 5.0 |
2021-10-29 | CVE-2021-31862 | Cross-site Scripting vulnerability in Sysaid 20.4.74 SysAid 20.4.74 allows XSS via the KeepAlive.jsp stamp parameter without any authentication. | 4.3 |
2021-07-22 | CVE-2021-30049 | Cross-site Scripting vulnerability in Sysaid 20.3.64 SysAid 20.3.64 b14 is affected by Cross Site Scripting (XSS) via a /KeepAlive.jsp?stamp= URI. | 4.3 |
2021-07-22 | CVE-2021-30486 | SQL Injection vulnerability in Sysaid 20.3.64 SysAid 20.3.64 b14 is affected by Blind and Stacker SQL injection via AssetManagementChart.jsp (GET computerID), AssetManagementChart.jsp (POST group1), AssetManagementList.jsp (GET computerID or group1), or AssetManagementSummary.jsp (GET group1). | 6.5 |
2020-10-02 | CVE-2020-13168 | Cross-site Scripting vulnerability in Sysaid On-Premises and Sysaidsy On-Premises SysAid 20.1.11b26 allows reflected XSS via the ForgotPassword.jsp accountid parameter. | 4.3 |