Sysaid - vulnerabilities (CVEs)

41 CVEs in 11 products, 0 in the last 30 days, newest from 2025-05-07.

Products

Sysaid - 29 CVEs
Sysaid On-premises - 7 CVEs
Help Desk - 4 CVEs
Application Programming Interface - 1 CVEs
Itil - 1 CVEs
Okta Sso - 1 CVEs
On-premise - 1 CVEs
Sysaid - Okta Sso Integration - 1 CVEs
Sysaid Api - 1 CVEs
Sysaidsy On-premises - 1 CVEs
Sysaid Admin Tools - 0 CVEs

Newest CVEs of Sysaid

CVE-2025-2776 - CVSS 9.8 (critical), 2025-05-07: SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Server URL processing functionality,…
CVE-2025-2775 - CVSS 9.3 (critical), 2025-05-07: SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Checkin processing functionality,…
CVE-2025-2777 - CVSS 9.8 (critical), 2025-05-07: SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the lshw processing functionality, allowing…
CVE-2024-36394 - CVSS 9.8 (critical), 2024-06-06: SysAid - CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2024-36393 - CVSS 9.9 (critical), 2024-06-06: SysAid - CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2024-27775 - CVSS 7.2 (high), 2024-03-28: SysAid before version 23.2.14 b18 - CWE-918: Server-Side Request Forgery (SSRF) may allow exposing the local OS user's NTLMv2 hash
CVE-2023-47247 - CVSS 4.3 (medium), 2023-12-25: In SysAid On-Premise before 23.3.34, there is an edge case in which an end user is able to delete a Knowledge Base article, aka bug 15102.
CVE-2023-33706 - CVSS 6.5 (medium), 2023-11-24: SysAid before 23.2.15 allows Indirect Object Reference (IDOR) attacks to read ticket data via a modified sid parameter to EmailHtmlSourceIframe.jsp or a…
CVE-2023-47246 - CVSS 9.8 (critical), 2023-11-10: In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a file to the Tomcat webroot, as…
CVE-2023-32226 - CVSS 8.3 (high), 2023-07-30: Sysaid - CWE-552: Files or Directories Accessible to External Parties - Authenticated users may exfiltrate files from the server via an unspecified method.
CVE-2023-32225 - CVSS 9.8 (critical), 2023-07-30: Sysaid - CWE-434: Unrestricted Upload of File with Dangerous Type - A malicious user with administrative privileges may be able to upload a dangerous…
CVE-2022-40324 - CVSS 6.1 (medium), 2022-09-11: SysAid Help Desk before 22.1.65 allows XSS via the Linked SRs field, aka FR# 67258.
CVE-2022-40323 - CVSS 6.1 (medium), 2022-09-11: SysAid Help Desk before 22.1.65 allows XSS in the Password Services module, aka FR# 67241.
CVE-2022-40322 - CVSS 6.1 (medium), 2022-09-11: SysAid Help Desk before 22.1.65 allows XSS, aka FR# 66542 and 65579.
CVE-2022-40325 - CVSS 6.1 (medium), 2022-09-11: SysAid Help Desk before 22.1.65 allows XSS via the Asset Dashboard, aka FR# 67262.
CVE-2022-23170 - CVSS 9.8 (critical), 2022-06-24: SysAid - Okta SSO integration - was found vulnerable to XML External Entity Injection vulnerability. Any SysAid environment that uses the Okta SSO integration…
CVE-2022-23166 - CVSS 9.8 (critical), 2022-05-12: Sysaid – Sysaid Local File Inclusion (LFI) – An unauthenticated attacker can access to the system by accessing to "/lib/tinymce/examples/index.html" path. in…
CVE-2022-23165 - CVSS 6.1 (medium), 2022-05-12: Sysaid – Sysaid 14.2.0 Reflected Cross-Site Scripting (XSS) - The parameter "helpPageName" used by the page "/help/treecontent.jsp" suffers from a Reflected…
CVE-2022-22797 - CVSS 6.1 (medium), 2022-05-12: Sysaid – sysaid Open Redirect - An Attacker can change the redirect link at the parameter "redirectURL" from"GET" request from the url location:…
CVE-2022-22796 - CVSS 9.8 (critical), 2022-05-12: Sysaid – Sysaid System Takeover - An attacker can bypass the authentication process by accessing to: /wmiwizard.jsp, Then to: /ConcurrentLogin.jsp, then click…
CVE-2022-22798 - CVSS 8.8 (high), 2022-05-12: Sysaid – Pro Plus Edition, SysAid Help Desk Broken Access Control v20.4.74 b10, v22.1.20 b62, v22.1.30 b49 - An attacker needs to log in as a guest after that…
CVE-2021-43971 - CVSS 8.8 (high), 2022-01-11: A SQL injection vulnerability in /mobile/SelectUsers.jsp in SysAid ITIL 20.4.74 b10 allows a remote authenticated attacker to execute arbitrary SQL commands…
CVE-2021-43974 - CVSS 5.3 (medium), 2022-01-11: An issue was discovered in SysAid ITIL 20.4.74 b10. The /enduserreg endpoint is used to register end users anonymously, but does not respect the server-side…
CVE-2021-43973 - CVSS 8.8 (high), 2022-01-11: An unrestricted file upload vulnerability in /UploadPsIcon.jsp in SysAid ITIL 20.4.74 b10 allows a remote authenticated attacker to upload an arbitrary file…
CVE-2021-43972 - CVSS 6.5 (medium), 2022-01-11: An unrestricted file copy vulnerability in /UserSelfServiceSettings.jsp in SysAid ITIL 20.4.74 b10 allows a remote authenticated attacker to copy arbitrary…
CVE-2021-36721 - CVSS 5.3 (medium), 2021-12-14: Sysaid API User Enumeration - Attacker sending requests to specific api path without any authorization before 21.3.60 version could get users names from the…
CVE-2021-31862 - CVSS 6.1 (medium), 2021-10-29: SysAid 20.4.74 allows XSS via the KeepAlive.jsp stamp parameter without any authentication.
CVE-2021-30049 - CVSS 6.1 (medium), 2021-07-22: SysAid 20.3.64 b14 is affected by Cross Site Scripting (XSS) via a /KeepAlive.jsp?stamp= URI.
CVE-2021-30486 - CVSS 8.8 (high), 2021-07-22: SysAid 20.3.64 b14 is affected by Blind and Stacker SQL injection via AssetManagementChart.jsp (GET computerID), AssetManagementChart.jsp (POST group1),…
CVE-2020-13168 - CVSS 6.1 (medium), 2020-10-02: SysAid 20.1.11b26 allows reflected XSS via the ForgotPassword.jsp accountid parameter.