CVE Vulnerability Advisory Database

Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.

Showing 1–2 of 2 advisories (Page 1/1)

CVE-2021-301169.8/CRITICALEPSS 85.7%CISA KEV

2021-07-09

Kaseya VSA Credential Disclosure and Authentication Bypass Vulnerability (CVE-2021-30116) Security Advisory

[Affected Scope] Kaseya VSA on-premise installations prior to version 9.5.7

[Impact] Attackers can extract agent credentials to obtain a valid session ID, bypassing authentication to gain unauthorized control over the system

[Mitigation] Immediately upgrade Kaseya VSA to version 9.5.7 or higher, and restrict external access to the dl.asp page

CVE-2018-207539.8/CRITICALEPSS 29.5%CISA KEV

2019-02-05

[Affected Scope] Kaseya VSA R9.3 (before 9.3.0.35), R9.4 (before 9.4.0.36), and R9.5 (before 9.5.0.5)

[Impact] Unprivileged remote attackers can execute arbitrary PowerShell payloads with SYSTEM privileges on all managed endpoints

[Mitigation] Immediately upgrade Kaseya VSA servers to patched versions (9.3.0.35, 9.4.0.36, 9.5.0.5 or higher) and restrict external access