SysAid Help Desk vulnerabilities

SysAid Help Desk versions before 15.2 are vulnerable to an XML Entity Expansion (XEE) attack, allowing remote attackers to cause denial of service through a large number of nested entity references in an XML document.

Multiple directory traversal vulnerabilities in SysAid Help Desk before version 15.2 allow remote attackers to read arbitrary files and cause denial of service.

SysAid Help Desk before 15.2 does not properly restrict access to certain functionality, allowing remote attackers to (1) create administrator accounts via a crafted request to /createnewaccount or (2) write to arbitrary files via the fileName parameter to /userentry.