Vulnerabilidades en SysAid
15 resultadosAnálisis Vexday
SysAid apresenta 10 vulnerabilidades catalogadas, das quais 2 estão sob exploração ativa (KEV), incluindo 3 classificadas como críticas. A fraqueza dominante é injeção XML (CWE-611), um vetor tradicional e bem estabelecido. O panorama não apresenta pressão de novas publicações nos últimos 90 dias, indicando que o risco concentra-se em falhas já conhecidas e ativamente exploradas.
CVE-2025-2777CRITICALSysAid On-Prem <= 23.3.40 lshw Proceessing XML External Entity InjectionEPSS 72.2%CVE-2025-2776CRITICALSysAid On-Prem <= 23.3.40 serverurl Proceessing XML External Entity InjectionEPSS 64.4%KEVCVE-2025-2775CRITICALSysAid On-Prem <= 23.3.40 Checkin Proceessing XML External Entity InjectionEPSS 42.7%KEVCVE-2022-22796HIGHSysaid – Sysaid System TakeoverEPSS 1.4%CVE-2024-36394CRITICALSysAid - CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')EPSS 1.1%CVE-2022-23166MEDIUMSysaid – Sysaid Local File Inclusion (LFI)EPSS 1.1%CVE-2023-32225CRITICAL Sysaid - CWE-434: Unrestricted Upload of File with Dangerous TypeEPSS 0.6%CVE-2022-23170MEDIUMSysAid - Okta SSO integrationEPSS 0.6%CVE-2022-22798MEDIUMSysaid – Pro Plus Edition, SysAid Help Desk Broken Access ControlEPSS 0.6%CVE-2024-27775HIGHSysAid - CWE-918: Server-Side Request Forgery (SSRF)EPSS 0.6%CVE-2023-32226HIGH Sysaid - CWE-552: Files or Directories Accessible to External PartiesEPSS 0.5%CVE-2022-22797MEDIUMSysaid – sysaid Open RedirectEPSS 0.5%CVE-2021-36721MEDIUMSysaid - Sysaid API User EnumerationEPSS 0.4%CVE-2024-36393CRITICALSysAid - CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')EPSS 0.4%CVE-2022-23165MEDIUMSysaid – Sysaid 14.2.0 Reflected Cross-Site Scripting (XSS)EPSS 0.4%