SY
Product
SysAid
On CISA KEVExploited in the wildRansomware-linked
30
CVEs
3
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 7High 6Medium 7Low 0
Watch
Add SysAid to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-33706 | 6.5 | Nov 24 | SysAid before 23.2.15 allows Indirect Object Reference (IDOR) attacks to read ticket data via a modified sid parameter to EmailHtmlSourceIframe.jsp or a modified srID parameter to… Affected: before 23.2.15; before 23.2.50 |
| CVE-2021-43972 | 6.5 | Jan 11 | An unrestricted file copy vulnerability in /UserSelfServiceSettings.jsp in SysAid ITIL 20.4.74 b10 allows a remote authenticated attacker to copy arbitrary files on the server… Affected: 20.4.74 |
| CVE-2022-23165 | 6.1 | May 12 | Sysaid – Sysaid 14.2.0 Reflected Cross-Site Scripting (XSS) - The parameter "helpPageName" used by the page "/help/treecontent.jsp" suffers from a Reflected Cross-Site Scripting… Affected: before 22.1.64; before 22.2.20 |
| CVE-2022-22797 | 6.1 | May 12 | Sysaid – sysaid Open Redirect - An Attacker can change the redirect link at the parameter "redirectURL" from"GET" request from the url location:… Affected: before 22.1.50; before 22.1.64 |
| CVE-2021-31862 | 6.1 | Oct 29 | SysAid 20.4.74 allows XSS via the KeepAlive.jsp stamp parameter without any authentication Affected: 20.4.74 |
| CVE-2021-30049 | 6.1 | Jul 22 | SysAid 20.3.64 b14 is affected by Cross Site Scripting (XSS) via a /KeepAlive.jsp?stamp= URI Affected: 20.3.64 |
| CVE-2023-47247 | 4.3 | Dec 25 | In SysAid On-Premise before 23.3.34, there is an edge case in which an end user is able to delete a Knowledge Base article, aka bug 15102 Affected: before 23.3.34 |
Showing 7