CVE-2019-15506

An issue was discovered in Kaseya Virtual System Administrator (VSA) through 9.4.0.37. It has a critical information disclosure vulnerability. An unauthenticated attacker can send properly formatted requests to the web application and download sensitive files and information. For example, the /DATAREPORTS directory can be farmed for reports. Because this directory contains the results of reports such as NMAP, Patch Status, and Active Directory domain metadata, an attacker can easily collect this critical information and parse it for information. There are a number of directories affected.

• CWE-306

• http://dfdrconsulting.com/2019/cyber-security/cve-2019-15506-kaseya-vsa-critical-information-disclosure-unauthenticated-access/Third Party Advisory
• http://help.kaseya.com/WebHelp/EN/RN/index.asp#VSAReleaseNotes.htmRelease Notes, Vendor Advisory
• http://dfdrconsulting.com/2019/cyber-security/cve-2019-15506-kaseya-vsa-critical-information-disclosure-unauthenticated-access/Third Party Advisory
• http://help.kaseya.com/WebHelp/EN/RN/index.asp#VSAReleaseNotes.htmRelease Notes, Vendor Advisory

Published

Aug 26, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-1550Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-15501Reflected cross site scripting (XSS) in L-Soft LISTSERV befo…
• CVE-2019-15502The TeamSpeak client before 3.3.2 allows remote servers to t…
• CVE-2019-15503cgi-cpn/xcoding/prontus_videocut.cgi in AltaVoz Prontus (aka…
• CVE-2019-15504drivers/net/wireless/rsi/rsi_91x_usb.c in the Linux kernel t…9.8
• CVE-2019-15505drivers/media/usb/dvb-usb/technisat-usb2.c in the Linux kern…9.8
• CVE-2019-15507In Octopus Deploy versions 2018.8.4 to 2019.7.6, when a web …
• CVE-2019-15508In Octopus Tentacle versions 3.0.8 to 5.0.0, when a web requ…
• CVE-2019-1551There is an overflow bug in the x64_64 Montgomery squaring p…5.3
• CVE-2019-15510ManageEngine_DesktopCentral.exe in Zoho ManageEngine Desktop…6.1
• CVE-2019-15511An exploitable local privilege escalation vulnerability exis…7.8
• CVE-2019-15513An issue was discovered in OpenWrt libuci (aka Library for t…