CVE-2015-6589

Directory traversal vulnerability in Kaseya Virtual System Administrator (VSA) 7.0.0.0 before 7.0.0.33, 8..0.0.0 before 8.0.0.23, 9.0.0.0 before 9.0.0.19, and 9.1.0.0 before 9.1.0.9 allows remote authenticated users to write to and execute arbitrary files due to insufficient restrictions in file paths to json.ashx.

• CWE-22

• http://packetstormsecurity.com/files/133782/Kaseya-Virtual-System-Administrator-Code-Execution-Privilege-Escalation.htmlExploit, Third Party Advisory, VDB Entry
• http://www.zerodayinitiative.com/advisories/ZDI-15-450Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/38351/Exploit, Third Party Advisory, VDB Entry
• https://www.securityfocus.com/bid/76838Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/133782/Kaseya-Virtual-System-Administrator-Code-Execution-Privilege-Escalation.htmlExploit, Third Party Advisory, VDB Entry
• http://www.zerodayinitiative.com/advisories/ZDI-15-450Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/38351/Exploit, Third Party Advisory, VDB Entry
• https://www.securityfocus.com/bid/76838Third Party Advisory, VDB Entry

Published

Feb 13, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-6583Google Chrome before 45.0.2454.85 does not display a locatio…
• CVE-2015-6584Cross-site scripting (XSS) vulnerability in the DataTables p…
• CVE-2015-6585hwpapp.dll in Hangul Word Processor allows remote attackers …
• CVE-2015-6586The mDNS module in Huawei WLAN AC6005, AC6605, and ACU2 devi…
• CVE-2015-6587The vlserver in OpenAFS before 1.6.13 allows remote authenti…
• CVE-2015-6588Cross-site scripting (XSS) vulnerability in login-fsp.html i…
• CVE-2015-6591Directory traversal vulnerability in application/templates/a…5.5
• CVE-2015-6592Huawei UAP2105 before V300R012C00SPC160(BootRom) does not re…
• CVE-2015-6593Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2015-6596mediaserver in Android before 5.1.1 LMY48T allows attackers …
• CVE-2015-6598libstagefright in Android before 5.1.1 LMY48T allows remote …
• CVE-2015-6599libstagefright in Android before 5.1.1 LMY48T allows remote …