{"advisories":[{"id":"EUVD-2021-17059","source":"euvd","title":"Authenticated reflective XSS in HelpDeskTab/rcResults.asp The parameter result of /HelpDeskTab/rcResults.asp is insecurely returned in the requested web page and can be used to perform a Cross Site Scripting attack Example request: `https://x.x.x.x/HelpDeskTab/rcResults.asp?result=<script>alert(document.cookie)</script>` The same is true for the parameter FileName of /done.asp Eaxmple request: `https://x.x.x.x/done.asp?FileName=\";</script><script>alert(1);a=\"&PathData=&originalName=shell.aspx&FileSize=4388&TimeElapsed=00:00:00.078`","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-17059"}],"cve":"CVE-2021-30119","epss":{"score":0.50323},"mitre":{"cpes":[],"created":"2021-07-09T13:20:58+00:00","description":"Authenticated reflective XSS in HelpDeskTab/rcResults.asp The parameter result of /HelpDeskTab/rcResults.asp is insecurely returned in the requested web page and can be used to perform a Cross Site Scripting attack Example request: `https://x.x.x.x/HelpDeskTab/rcResults.asp?result=<script>alert(document.cookie)</script>` The same is true for the parameter FileName of /done.asp Eaxmple request: `https://x.x.x.x/done.asp?FileName=\";</script><script>alert(1);a=\"&PathData=&originalName=shell.aspx&FileSize=4388&TimeElapsed=00:00:00.078`","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},"cvssV4_0":{}},"mitre_repo_path":"cves/2021/30xxx/CVE-2021-30119.json","references":["https://csirt.divd.nl/2021/07/07/Kaseya-Limited-Disclosure/","https://csirt.divd.nl/CVE-2021-30119","https://csirt.divd.nl/DIVD-2021-00011"],"title":"Authenticated Authenticated reflective XSS in Kaseya VSA <= v9.5.6","updated":"2026-08-14T03:55:33.368000+00:00","vendors":[],"weaknesses":[]},"nvd":{"cpes":["cpe:2.3:a:kaseya:vsa:*:*:*:*:-:*:*:*"],"created":"2021-07-09T14:15:07.873000+00:00","description":"Authenticated reflective XSS in HelpDeskTab/rcResults.asp The parameter result of /HelpDeskTab/rcResults.asp is insecurely returned in the requested web page and can be used to perform a Cross Site Scripting attack Example request: `https://x.x.x.x/HelpDeskTab/rcResults.asp?result=<script>alert(document.cookie)</script>` The same is true for the parameter FileName of /done.asp Eaxmple request: `https://x.x.x.x/done.asp?FileName=\";</script><script>alert(1);a=\"&PathData=&originalName=shell.aspx&FileSize=4388&TimeElapsed=00:00:00.078`","metrics":{"cvssV2_0":{"score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N"},"cvssV3_0":{},"cvssV3_1":{"score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},"cvssV4_0":{}},"nvd_repo_path":"2021/CVE-2021-30119.json","references":["https://csirt.divd.nl/2021/07/07/Kaseya-Limited-Disclosure/","https://csirt.divd.nl/CVE-2021-30119","https://csirt.divd.nl/DIVD-2021-00011"],"title":null,"updated":"2026-08-14T05:16:54.757000+00:00","vendors":["kaseya","kaseya$PRODUCT$vsa"],"weaknesses":["CWE-79"]},"opencve":{"changes":[],"cpes":{"data":["cpe:2.3:a:kaseya:vsa:*:*:*:*:-:*:*:*"],"providers":["nvd"]},"created":{"data":"2021-07-09T13:20:58+00:00","provider":"mitre"},"description":{"data":"Authenticated reflective XSS in HelpDeskTab/rcResults.asp The parameter result of /HelpDeskTab/rcResults.asp is insecurely returned in the requested web page and can be used to perform a Cross Site Scripting attack Example request: `https://x.x.x.x/HelpDeskTab/rcResults.asp?result=<script>alert(document.cookie)</script>` The same is true for the parameter FileName of /done.asp Eaxmple request: `https://x.x.x.x/done.asp?FileName=\";</script><script>alert(1);a=\"&PathData=&originalName=shell.aspx&FileSize=4388&TimeElapsed=00:00:00.078`","provider":"mitre"},"metrics":{"cvssV2_0":{"data":{"score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N"},"provider":"nvd"},"cvssV3_0":{"data":{},"provider":null},"cvssV3_1":{"data":{"score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},"provider":"mitre"},"cvssV4_0":{"data":{},"provider":null},"epss":{"data":{"score":0.50323},"provider":"first"},"kev":{"data":{},"provider":null},"ssvc":{"data":{},"provider":null},"threat_severity":{"data":null,"provider":null}},"references":{"data":["https://csirt.divd.nl/2021/07/07/Kaseya-Limited-Disclosure/","https://csirt.divd.nl/CVE-2021-30119","https://csirt.divd.nl/DIVD-2021-00011"],"providers":["mitre","nvd"]},"title":{"data":"Authenticated Authenticated reflective XSS in Kaseya VSA <= v9.5.6","provider":"mitre"},"updated":{"data":"2024-11-21T06:03:20.583000+00:00","provider":"nvd"},"vendors":{"data":["kaseya","kaseya$PRODUCT$vsa"],"providers":["nvd"]},"weaknesses":{"data":["CWE-79"],"providers":["nvd"]}}}