TI-2021-10669 CVE-2021-30120 · GHSA-r6j9-rwx4-qcj3
2FA bypass in Kaseya VSA <= v9.5.6
Priority CRITICAL 100
Kaseya VSA before 9.5.7 allows attackers to bypass the 2FA requirement.
Kaseya
Records37All Threatist records
Exploited (KEV)3In CISA KEV
CVSS critical17CVSS 9.0–10.0
CVSS high12CVSS 7.0–8.9
Exploited now
Kaseya records in CISA KEVComponents
Products in the NVD configurations · select one to filter the recordsRecords
37 records
TI-2021-10665 CVE-2021-30116 · GHSA-qm28-hjhx-pwqg
Unauthenticated credential leak and business logic flaw in Kaseya VSA <= v9.5.6
Priority CRITICAL 100KEV
Kaseya VSA before 9.5.7 allows credential disclosure, as exploited in the wild in July 2021.
TI-2018-14728 CVE-2018-20753 · GHSA-hhg2-f289-m44w
Kaseya VSA RMM before R9.3 9.3.0.35, R9.4 before 9.4.0.36, and R9.5 before 9.5.0.5 allows…
Priority CRITICAL 100KEV
Kaseya VSA RMM before R9.3 9.3.0.35, R9.4 before 9.4.0.36, and R9.5 before 9.5.0.5 allows unprivileged remote attackers to execute PowerShell payloads on all managed devices.
TI-2017-13536 CVE-2017-18362 · GHSA-w35f-w5cg-jqhh
ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to…
Priority CRITICAL 100KEV
ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database.
TI-2021-10668 CVE-2021-30119 · GHSA-f43v-wh9x-rgq6
Authenticated Authenticated reflective XSS in Kaseya VSA <= v9.5.6
Priority HIGH 84
Authenticated reflective XSS in HelpDeskTab/rcResults.asp The parameter result of /HelpDeskTab/rcResults.asp is insecurely returned in the requested web page and can be used to perform a Cross Site Scripting attack Examp…
TI-2015-05774 CVE-2015-6922 · GHSA-qf3c-cpvg-3663
Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.33, 8.x before 8.0.0.23, 9.0…
Priority HIGH 83
Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.33, 8.x before 8.0.0.23, 9.0 before 9.0.0.19, and 9.1 before 9.1.0.9 does not properly require authentication, which allows remote attackers to bypass authentica…
TI-2017-09213 CVE-2017-12478 · GHSA-7q5j-8w8v-g89m
It was discovered that the api/storage web interface in Unitrends Backup (UB) before…
Priority HIGH 82
It was discovered that the api/storage web interface in Unitrends Backup (UB) before 10.0.0 has an issue in which one of its input parameters was not validated.
TI-2013-06177 CVE-2013-10034 · GHSA-86jp-9w2g-x862
Kaseya < 6.3.0.2 uploadImage.asp Arbitrary File Upload RCE
Priority HIGH 81
An unrestricted file upload vulnerability exists in Kaseya KServer versions prior to 6.3.0.2.
TI-2021-10666 CVE-2021-30117 · GHSA-cfh7-xwhw-f278
Authenticated SQL injection in Kaseya VSA < v9.5.6
Priority HIGH 80
The API call /InstallTab/exportFldr.asp is vulnerable to a semi-authenticated boolean-based blind SQL injection in the parameter fldrId.
TI-2017-09212 CVE-2017-12477 · GHSA-9r4h-6jqx-qw6h
It was discovered that the bpserverd proprietary protocol in Unitrends Backup (UB) before…
Priority HIGH 79
It was discovered that the bpserverd proprietary protocol in Unitrends Backup (UB) before 10.0.0, as invoked through xinetd, has an issue in which its authentication can be bypassed.
TI-2018-04653 CVE-2018-6328 · GHSA-743r-2x7m-hrm4
It was discovered that the Unitrends Backup (UB) before 10.1.0 user interface was exposed…
Priority HIGH 78
It was discovered that the Unitrends Backup (UB) before 10.1.0 user interface was exposed to an authentication bypass, which then could allow an unauthenticated user to inject arbitrary commands into its /api/hosts param…
TI-2021-10667 CVE-2021-30118 · GHSA-9xr3-46q4-vwhg
Unauthenticated Remote Code Execution in Kaseya VSA < v9.5.5
Priority HIGH 76
An attacker can upload files with the privilege of the Web Server process for Kaseya VSA Unified Remote Monitoring & Management (RMM) 9.5.4.2149 and subsequently use these files to execute asp commands The api /SystemTab…
TI-2021-10736 CVE-2021-30201 · GHSA-xx66-m4r3-r5vf
Unauthenticated XML External Entity vulnerability in Kaseya VSA < v9.5.6
Priority MEDIUM 55
The API /vsaWS/KaseyaWS.asmx can be used to submit XML to the system.
TI-2015-05525 CVE-2015-6589 · GHSA-vwch-7j7j-p95x
Directory traversal vulnerability in Kaseya Virtual System Administrator (VSA) 7.0.0.0…
Priority MEDIUM 53
Directory traversal vulnerability in Kaseya Virtual System Administrator (VSA) 7.0.0.0 before 7.0.0.33, 8..0.0.0 before 8.0.0.23, 9.0.0.0 before 9.0.0.19, and 9.1.0.0 before 9.1.0.9 allows remote authenticated users to w…
TI-2017-09214 CVE-2017-12479 · GHSA-qm9m-fp5f-xg9x
It was discovered that an issue in the session logic in Unitrends Backup (UB) before…
Priority MEDIUM 52
It was discovered that an issue in the session logic in Unitrends Backup (UB) before 10.0.0 allowed using the LOGDIR environment variable during a web session to elevate an existing low-privilege user to root privileges.
TI-2021-19099 CVE-2021-43033 · GHSA-fw55-5674-qwvm
An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5.
Priority MEDIUM 51
An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5.
TI-2021-19101 CVE-2021-43035 · GHSA-fjm2-hf29-g4fq
An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5.
Priority MEDIUM 48
An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5.
TI-2021-19108 CVE-2021-43042 · GHSA-8xcf-7jjj-p7rh
An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5.
Priority MEDIUM 47
An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5.
TI-2021-19110 CVE-2021-43044 · GHSA-9x6h-x3mh-8xvh
An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5.
Priority MEDIUM 46
An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5.
TI-2021-19102 CVE-2021-43036 · GHSA-3v2g-m6qm-pvj3
An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5.
Priority MEDIUM 46
An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5.
TI-2021-17451 CVE-2021-40386 · GHSA-hpmq-qx89-42jf
Kaseya Unitrends Client/Agent through 10.5,5 allows remote attackers to execute arbitrary code.
Priority MEDIUM 46
Kaseya Unitrends Client/Agent through 10.5,5 allows remote attackers to execute arbitrary code.
TI-2021-19107 CVE-2021-43041 · GHSA-ph8m-x93x-px88
An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5.
Priority MEDIUM 43
An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5.
TI-2021-17452 CVE-2021-40387 · GHSA-fw24-832r-x4vh
An issue was discovered in the server software in Kaseya Unitrends Backup Software before…
Priority MEDIUM 43
An issue was discovered in the server software in Kaseya Unitrends Backup Software before 10.5.5-2.
TI-2021-19106 CVE-2021-43040 · GHSA-4r5f-vh76-jqxp
An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5.
Priority MEDIUM 42
An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5.
TI-2021-19104 CVE-2021-43038 · GHSA-6rjf-7wv7-gjwv
An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5.
Priority MEDIUM 42
An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5.