SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability

Mô tả

Tham khảo

• documentation.sysaid.com/docs/24-40-60 · Release Notes
• labs.watchtowr.com/sysowned-your-friendly-rce-support-ticket · Exploit
• cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
• CISA KEV · CVE-2025-2776

Lỗ hổng khác của sysaid

• CVE-2025-2777NGHIÊM TRỌNG 9.8SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the lshw processing funct…
• CVE-2025-2775CAO 7.5ĐANG BỊ KHAI THÁC (CISA KEV)SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Checkin processing fu…
• CVE-2024-36394NGHIÊM TRỌNG 9.8SysAid - CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
• CVE-2024-36393NGHIÊM TRỌNG 9.8SysAid - CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
• CVE-2023-47247TRUNG BÌNH 4.3In SysAid On-Premise before 23.3.34, there is an edge case in which an end user is able to delete a Knowledge Base article, aka bug 15102.