Search
Find a vulnerability
Search criteria
17 vulnerabilities by Synametrics
GCVE-1988-2026-0492
Vulnerability from gna-1988 – Published: 2026-11-02 07:30 – Updated: 2026-11-02 07:30
VLAI
EPSS
VEX
Title
[0day-rubbish] Synametrics Syncrify 6.2 build 1178 authenticated PublicLink chunk-upload path traversal to /etc/cron.d and root command execution (7.5)
Summary
0day Rubbish Research Team is publicly disclosing a vulnerability in Synametrics
Syncrify 6.2 build 1178, the closed-source incremental backup and
file-replication server from Synametrics Technologies, Inc. (United States). The
product is written in Java, distributed for Linux as a tarball archive, and
served by an embedded Tomcat 9.0.113 through the vendor's in-house sradef
framework, whose single front controller routes every request as
/app?operation=<op>&st=<step> to a handler registered in WorkerMappings.xml.
Type and root cause. Path traversal, CWE-22 primary, with CWE-269 improper
privilege management and CWE-78 OS command injection as contributing
classifications that describe the deployment shape converting a file write into
an execution rather than a defect inside the application. The PublicLink
handler, operation=pb, implements the server's PublicLink client protocol. Its
chunked-upload branch, selected by st=u, reads a length-prefixed binary frame
straight from request.getInputStream(), which means the server's parameter
parsing, form decoding and any framework-level parameter validation are all
bypassed by construction: the field that decides the write destination is not a
parameter. At PublicLink.java:70-110 the decompiled method reads four big-endian
int32 values and one length-prefixed UTF-8 string, then does this:
int protocol = readInt(in); // 4-byte big-endian
int chunkNumber = readInt(in); // read, then not used to bound
// or place the write
int totalChunks = readInt(in); // read, then not used either
int size = readInt(in); // declared length of the body
String filename = readString(in); // [int32 len][UTF-8 bytes],
// attacker-controlled
File base = E(); // this user's PublicLinks folder
File target = new File(base, filename);
if (!target.getParentFile().exists()) {
target.getParentFile().mkdirs();
}
BufferedOutputStream out = new BufferedOutputStream(
new FileOutputStream(target, true)); // append mode
byte[] buf = new byte[size];
readFully(buf);
out.write(buf);
out.close();
return 0; // 0 means success to the caller
new File(base, filename) is reached with no rejection of "..", no rejection of
path separators, no base-name extraction and no canonical containment check.
base is /opt/Syncrify/PublicLinks/<user>/<generated-folder>, five components
below the filesystem root, so a chunk name of ../../../../../etc/cron.d/<name>
leaves the per-user PublicLinks folder and lands a cron fragment, creating any
missing parent directory on the way because of the mkdirs() call. The branch
returns 0, f() at PublicLink.java:127 converts that into the client reply
code="1" with <payload>0</payload>, and the host cron daemon then reads the
fragment as a root-authored job definition and runs its command field through a
shell on the next minute boundary. The application itself never constructs,
quotes or invokes a command line, and every execution site in the product uses
an argument vector with no shell, so this could not have been fixed by argument
hygiene at the application layer; the execution happens one component later.
The identity reached was observed rather than inferred, and it is uid=0(root)
gid=0(root) groups=0(root). Two independent artifacts establish that the writer
process held uid 0: the fragment landed as -rw-r--r-- 1 root root at mode 0644,
and a file's owner after creation is the effective uid of the process that
created it; and the scheduled job's own output reported uid 0, the fragment
naming root in its user field, which a scheduler will not honour for a job file
it does not already trust.
What makes this an oversight rather than a design decision is the asymmetry
with the rest of the same tree. Three sibling families in the same product,
written against the same client protocol, check the same kind of field and
reject the same kind of content: the profile-upload, profile-fetch and
file-splitter handlers refuse names containing path separators by testing
character codes with indexOf(47) and indexOf(92); the multipart upload path
collapses the client-supplied name through getName() of a constructed File,
which discards every directory component; and the download path runs the name
through indexOf("..") and answers 404 on a match. The chunk-upload branch calls
none of them. When one member of a family omits the defense all of its siblings
implement, the economical explanation is that the check was not written rather
than that it lives somewhere else. There is also no decoding step between the
socket and the constructor on this branch, so no encoding trick is involved and
none is needed: what the client puts in the frame is what the path is built
from.
How confirmation works, and what was deliberately not reproduced. Confirmation
is by host-side artifacts, not by the HTTP reply, and that distinction matters.
The reply is a success oracle, so an attacker learns from the network alone that
a write was accepted and can iterate on naming from there, but a successful
reply is not proof of a successful destination: the code never inspects the
resolved path, so a wrong traversal depth still yields code="1" and simply
writes somewhere else with intermediate directories created as needed. The
read-back of the marker file is the only sufficient signal. Four controls were
exercised and the published tool automates one of them. A traversing name and a
non-traversing name were driven through identical authentication, identical
framing and the identical route in the same session; the benign write was
accepted and landed inside the user's own PublicLinks folder, and the assertion
that neither the cron fragment path nor the marker path existed is what isolates
the traversal as the cause of the outcome and of nothing else. A sibling-handler
control confirmed at the Java level that the multipart family's getName()
collapse, applied to a traversing name against the same PublicLinks base,
returns the bare final component and keeps the write inside the root. A dispatch
control built against st=f instead reached a different void E() overload at
PublicLink.java:951 that parses a request parameter named ed as a Long and
performed no write anywhere; that control is what fixed the sink to this branch
rather than to the handler in general, since an initial static reading had
attributed the upload to st=f and the request built on that reading produced no
file at all. Authentication controls established that the credential gate is
live. The published advisory reproduces the identity string and the frame field
lengths derived from the field values, but deliberately not the run's own byte
capture, which was not preserved; not the generated PublicLinks folder name,
which embeds the run's timestamp; not the credential pair, which are mandatory
tool arguments with no default; and not the per-run fragment name or the marker
path. The payload was an identity capture into a marker file. No repository data
was read, no product file was modified or deleted, and the fragment and the
marker were removed after verification together with stopping the service.
Scoring. One score is published: 7.5 High,
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. The arithmetic is shown so any
reader can reproduce it with the CVSS 3.1 base algorithm and its
round-up-to-the-tenth rule: ISS = 1 - (0.44 x 0.44 x 0.44) = 0.914816; Impact
for S:U = 6.42 x 0.914816 = 5.873119; Exploitability = 8.22 x 0.85 x 0.44 x
0.62 x 0.85 = 1.620146; Base = Roundup(5.873119 + 1.620146) =
Roundup(7.493265) = 7.5. AV:N is the honest classification of the component
because the vulnerable component is an HTTP handler on a network-bound servlet
connector and the credential it accepts exists precisely so that remote backup
clients can use it; the deployment-dependent exposure of that listener is priced
in attack complexity rather than smuggled into the attack vector. AC:H carries
two conditions outside the attacker's control: that the listener carrying this
route be reachable from the attacker's position, and that the host run a
scheduler that scans /etc/cron.d. PR:L records that the least privileged
principal proven sufficient is an authenticated backup user, the product's
lowest-trust account type. Scope is Unchanged, for the identity reason given
below.
A conditional reading of 8.8 High, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,
is published alongside it and is labelled conditional everywhere it appears. It
applies only where the listener carrying /app?operation= is reachable from the
attacker's network position, which is the normal operating mode for a backup
server whose clients push data to it remotely, and it removes the first of the
two AC:H conditions by assuming that deployment posture. It computes as
Exploitability = 8.22 x 0.85 x 0.77 x 0.62 x 0.85 = 2.835255, Base =
Roundup(5.873119 + 2.835255) = Roundup(8.708374) = 8.8. The published score is
7.5 and never 8.8; a reader whose deployment keeps the portal on a management
network should read the 7.5.
Two further readings are published as explicitly rejected, both with their
arithmetic, so that a reader who disagrees with either call can see exactly what
it is worth rather than take our word for it. The changed-scope variant of the
same metrics, 8.6 High,
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H, is rejected because the identity
reached is the same root identity the server process already holds on the same
host, so no component authority boundary is crossed by the outcome: the server
process is root over this host by construction of the deployment, and the
compromised scheduler and the compromised server sit inside one authority
domain. Its arithmetic: Impact for S:C = 7.52 x (0.914816 - 0.029) - 3.25 x
(0.914816 x 0.9731 - 0.02)^13 = 6.661336 - 0.533310 = 6.128026; Exploitability
with PR at the S:C value of 0.68 = 8.22 x 0.85 x 0.44 x 0.68 x 0.85 = 1.776934;
Base = Roundup(1.08 x (6.128026 + 1.776934)) = Roundup(8.537357) = 8.6. The
privilege gain in this finding is real and substantial, and it is expressed by
the metrics meant to carry it, PR:L for the low-trust principal and C:H/I:H/A:H
for the totality of what root on this host controls; Scope is not the vehicle
for expressing privilege distance and using it that way would double-count the
same fact.
The second rejected reading is the one we want readers to notice, because it is
the one that could most easily be misused in our favour. Treating the loopback
binding we observed in our own testbed as though it were the shipped default
yields 7.8 High, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H: Exploitability =
8.22 x 0.55 x 0.77 x 0.62 x 0.85 = 1.834577, Base = Roundup(5.873119 +
1.834577) = Roundup(7.707696) = 7.8. We reject it, and rejecting it lowers the
number we publish by 0.3 rather than raising it. That rejected local-vector
reading of 7.8 is higher than the 7.5 we publish at AV:N. So the rejection is
not a scoring maneuver and cannot be read as one: choosing AV:N with AC:H is the
conservative reading on this finding, and a reader who disagrees with us about
the factory default of that binding ends up with a larger figure than ours, not
a smaller one. The advisory says this itself, in those terms. The reason for the
rejection is evidential rather than convenient: that loopback binding was
applied by us, in the configuration, before any testing began, so that the host
carried no public exposure while research was in progress, and we hold no
shipped artifact, no configuration template, no installer script excerpt and no
documentation quotation, that states the factory value of that binding in either
direction. Not that it binds publicly by default, and not that it binds loopback
by default: the premise is unestablished by artifact, which is exactly why the
attack comple
Severity
No CVSS data available.
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Synametrics | Syncrify |
Affected:
unknown
|
{
"containers": {
"cna": {
"affected": [
{
"product": "Syncrify",
"vendor": "Synametrics",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "disclosure via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "0day Rubbish Research Team is publicly disclosing a vulnerability in Synametrics\nSyncrify 6.2 build 1178, the closed-source incremental backup and\nfile-replication server from Synametrics Technologies, Inc. (United States). The\nproduct is written in Java, distributed for Linux as a tarball archive, and\nserved by an embedded Tomcat 9.0.113 through the vendor\u0027s in-house sradef\nframework, whose single front controller routes every request as\n/app?operation=\u003cop\u003e\u0026st=\u003cstep\u003e to a handler registered in WorkerMappings.xml.\n\nType and root cause. Path traversal, CWE-22 primary, with CWE-269 improper\nprivilege management and CWE-78 OS command injection as contributing\nclassifications that describe the deployment shape converting a file write into\nan execution rather than a defect inside the application. The PublicLink\nhandler, operation=pb, implements the server\u0027s PublicLink client protocol. Its\nchunked-upload branch, selected by st=u, reads a length-prefixed binary frame\nstraight from request.getInputStream(), which means the server\u0027s parameter\nparsing, form decoding and any framework-level parameter validation are all\nbypassed by construction: the field that decides the write destination is not a\nparameter. At PublicLink.java:70-110 the decompiled method reads four big-endian\nint32 values and one length-prefixed UTF-8 string, then does this:\n\n int protocol = readInt(in); // 4-byte big-endian\n int chunkNumber = readInt(in); // read, then not used to bound\n // or place the write\n int totalChunks = readInt(in); // read, then not used either\n int size = readInt(in); // declared length of the body\n String filename = readString(in); // [int32 len][UTF-8 bytes],\n // attacker-controlled\n\n File base = E(); // this user\u0027s PublicLinks folder\n File target = new File(base, filename);\n if (!target.getParentFile().exists()) {\n target.getParentFile().mkdirs();\n }\n BufferedOutputStream out = new BufferedOutputStream(\n new FileOutputStream(target, true)); // append mode\n byte[] buf = new byte[size];\n readFully(buf);\n out.write(buf);\n out.close();\n return 0; // 0 means success to the caller\n\nnew File(base, filename) is reached with no rejection of \"..\", no rejection of\npath separators, no base-name extraction and no canonical containment check.\nbase is /opt/Syncrify/PublicLinks/\u003cuser\u003e/\u003cgenerated-folder\u003e, five components\nbelow the filesystem root, so a chunk name of ../../../../../etc/cron.d/\u003cname\u003e\nleaves the per-user PublicLinks folder and lands a cron fragment, creating any\nmissing parent directory on the way because of the mkdirs() call. The branch\nreturns 0, f() at PublicLink.java:127 converts that into the client reply\ncode=\"1\" with \u003cpayload\u003e0\u003c/payload\u003e, and the host cron daemon then reads the\nfragment as a root-authored job definition and runs its command field through a\nshell on the next minute boundary. The application itself never constructs,\nquotes or invokes a command line, and every execution site in the product uses\nan argument vector with no shell, so this could not have been fixed by argument\nhygiene at the application layer; the execution happens one component later.\n\nThe identity reached was observed rather than inferred, and it is uid=0(root)\ngid=0(root) groups=0(root). Two independent artifacts establish that the writer\nprocess held uid 0: the fragment landed as -rw-r--r-- 1 root root at mode 0644,\nand a file\u0027s owner after creation is the effective uid of the process that\ncreated it; and the scheduled job\u0027s own output reported uid 0, the fragment\nnaming root in its user field, which a scheduler will not honour for a job file\nit does not already trust.\n\nWhat makes this an oversight rather than a design decision is the asymmetry\nwith the rest of the same tree. Three sibling families in the same product,\nwritten against the same client protocol, check the same kind of field and\nreject the same kind of content: the profile-upload, profile-fetch and\nfile-splitter handlers refuse names containing path separators by testing\ncharacter codes with indexOf(47) and indexOf(92); the multipart upload path\ncollapses the client-supplied name through getName() of a constructed File,\nwhich discards every directory component; and the download path runs the name\nthrough indexOf(\"..\") and answers 404 on a match. The chunk-upload branch calls\nnone of them. When one member of a family omits the defense all of its siblings\nimplement, the economical explanation is that the check was not written rather\nthan that it lives somewhere else. There is also no decoding step between the\nsocket and the constructor on this branch, so no encoding trick is involved and\nnone is needed: what the client puts in the frame is what the path is built\nfrom.\n\nHow confirmation works, and what was deliberately not reproduced. Confirmation\nis by host-side artifacts, not by the HTTP reply, and that distinction matters.\nThe reply is a success oracle, so an attacker learns from the network alone that\na write was accepted and can iterate on naming from there, but a successful\nreply is not proof of a successful destination: the code never inspects the\nresolved path, so a wrong traversal depth still yields code=\"1\" and simply\nwrites somewhere else with intermediate directories created as needed. The\nread-back of the marker file is the only sufficient signal. Four controls were\nexercised and the published tool automates one of them. A traversing name and a\nnon-traversing name were driven through identical authentication, identical\nframing and the identical route in the same session; the benign write was\naccepted and landed inside the user\u0027s own PublicLinks folder, and the assertion\nthat neither the cron fragment path nor the marker path existed is what isolates\nthe traversal as the cause of the outcome and of nothing else. A sibling-handler\ncontrol confirmed at the Java level that the multipart family\u0027s getName()\ncollapse, applied to a traversing name against the same PublicLinks base,\nreturns the bare final component and keeps the write inside the root. A dispatch\ncontrol built against st=f instead reached a different void E() overload at\nPublicLink.java:951 that parses a request parameter named ed as a Long and\nperformed no write anywhere; that control is what fixed the sink to this branch\nrather than to the handler in general, since an initial static reading had\nattributed the upload to st=f and the request built on that reading produced no\nfile at all. Authentication controls established that the credential gate is\nlive. The published advisory reproduces the identity string and the frame field\nlengths derived from the field values, but deliberately not the run\u0027s own byte\ncapture, which was not preserved; not the generated PublicLinks folder name,\nwhich embeds the run\u0027s timestamp; not the credential pair, which are mandatory\ntool arguments with no default; and not the per-run fragment name or the marker\npath. The payload was an identity capture into a marker file. No repository data\nwas read, no product file was modified or deleted, and the fragment and the\nmarker were removed after verification together with stopping the service.\n\nScoring. One score is published: 7.5 High,\nCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. The arithmetic is shown so any\nreader can reproduce it with the CVSS 3.1 base algorithm and its\nround-up-to-the-tenth rule: ISS = 1 - (0.44 x 0.44 x 0.44) = 0.914816; Impact\nfor S:U = 6.42 x 0.914816 = 5.873119; Exploitability = 8.22 x 0.85 x 0.44 x\n0.62 x 0.85 = 1.620146; Base = Roundup(5.873119 + 1.620146) =\nRoundup(7.493265) = 7.5. AV:N is the honest classification of the component\nbecause the vulnerable component is an HTTP handler on a network-bound servlet\nconnector and the credential it accepts exists precisely so that remote backup\nclients can use it; the deployment-dependent exposure of that listener is priced\nin attack complexity rather than smuggled into the attack vector. AC:H carries\ntwo conditions outside the attacker\u0027s control: that the listener carrying this\nroute be reachable from the attacker\u0027s position, and that the host run a\nscheduler that scans /etc/cron.d. PR:L records that the least privileged\nprincipal proven sufficient is an authenticated backup user, the product\u0027s\nlowest-trust account type. Scope is Unchanged, for the identity reason given\nbelow.\n\nA conditional reading of 8.8 High, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,\nis published alongside it and is labelled conditional everywhere it appears. It\napplies only where the listener carrying /app?operation= is reachable from the\nattacker\u0027s network position, which is the normal operating mode for a backup\nserver whose clients push data to it remotely, and it removes the first of the\ntwo AC:H conditions by assuming that deployment posture. It computes as\nExploitability = 8.22 x 0.85 x 0.77 x 0.62 x 0.85 = 2.835255, Base =\nRoundup(5.873119 + 2.835255) = Roundup(8.708374) = 8.8. The published score is\n7.5 and never 8.8; a reader whose deployment keeps the portal on a management\nnetwork should read the 7.5.\n\nTwo further readings are published as explicitly rejected, both with their\narithmetic, so that a reader who disagrees with either call can see exactly what\nit is worth rather than take our word for it. The changed-scope variant of the\nsame metrics, 8.6 High,\nCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H, is rejected because the identity\nreached is the same root identity the server process already holds on the same\nhost, so no component authority boundary is crossed by the outcome: the server\nprocess is root over this host by construction of the deployment, and the\ncompromised scheduler and the compromised server sit inside one authority\ndomain. Its arithmetic: Impact for S:C = 7.52 x (0.914816 - 0.029) - 3.25 x\n(0.914816 x 0.9731 - 0.02)^13 = 6.661336 - 0.533310 = 6.128026; Exploitability\nwith PR at the S:C value of 0.68 = 8.22 x 0.85 x 0.44 x 0.68 x 0.85 = 1.776934;\nBase = Roundup(1.08 x (6.128026 + 1.776934)) = Roundup(8.537357) = 8.6. The\nprivilege gain in this finding is real and substantial, and it is expressed by\nthe metrics meant to carry it, PR:L for the low-trust principal and C:H/I:H/A:H\nfor the totality of what root on this host controls; Scope is not the vehicle\nfor expressing privilege distance and using it that way would double-count the\nsame fact.\n\nThe second rejected reading is the one we want readers to notice, because it is\nthe one that could most easily be misused in our favour. Treating the loopback\nbinding we observed in our own testbed as though it were the shipped default\nyields 7.8 High, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H: Exploitability =\n8.22 x 0.55 x 0.77 x 0.62 x 0.85 = 1.834577, Base = Roundup(5.873119 +\n1.834577) = Roundup(7.707696) = 7.8. We reject it, and rejecting it lowers the\nnumber we publish by 0.3 rather than raising it. That rejected local-vector\nreading of 7.8 is higher than the 7.5 we publish at AV:N. So the rejection is\nnot a scoring maneuver and cannot be read as one: choosing AV:N with AC:H is the\nconservative reading on this finding, and a reader who disagrees with us about\nthe factory default of that binding ends up with a larger figure than ours, not\na smaller one. The advisory says this itself, in those terms. The reason for the\nrejection is evidential rather than convenient: that loopback binding was\napplied by us, in the configuration, before any testing began, so that the host\ncarried no public exposure while research was in progress, and we hold no\nshipped artifact, no configuration template, no installer script excerpt and no\ndocumentation quotation, that states the factory value of that binding in either\ndirection. Not that it binds publicly by default, and not that it binds loopback\nby default: the premise is unestablished by artifact, which is exactly why the\nattack comple"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-203",
"description": "CWE-203",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-22",
"description": "CWE-22",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-269",
"description": "CWE-269",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-78",
"description": "CWE-78",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T07:30:03Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Oct/21"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Oct/21"
},
{
"url": "https://0day-rubbish.com"
},
{
"url": "https://0day-rubbish.com/blog/synametrics-syncrify-publiclink-chunk-upload-traversal-cron-root-rce"
},
{
"url": "https://github.com/Exploit-Garbage/0day-Rubbish"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Oct/21"
],
"discovery": "EXTERNAL"
},
"title": "[0day-rubbish] Synametrics Syncrify 6.2 build 1178 authenticated PublicLink chunk-upload path traversal to /etc/cron.d and root command execution (7.5)",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0492",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Oct/21",
"automated": true,
"contentSha256": "0198cf6df4cd4863eb42fe67179edce7b0dcb72d4de85a3d9766e1d1ac4ef071",
"evidenceScore": 11,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Oct/21",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-10-13T02:23:01Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-11-02T07:30:03Z",
"dateUpdated": "2026-11-02T07:30:03Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0492"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2022-26251 (GCVE-0-2022-26251)
Vulnerability from nvd – Published: 2022-04-06 00:22 – Updated: 2026-07-09 00:17
VLAI
EPSS
VEX
Summary
The HTTP interface of Synaman v5.1 and below was discovered to allow authenticated attackers to execute arbitrary code and escalate privileges.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
1 reference
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-07-09T00:17:53.908Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.bencteux.fr/posts/synaman/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The HTTP interface of Synaman v5.1 and below was discovered to allow authenticated attackers to execute arbitrary code and escalate privileges."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-05T15:47:16.071Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://www.bencteux.fr/posts/synaman/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2022-26251",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The HTTP interface of Synaman v5.1 and below was discovered to allow authenticated attackers to execute arbitrary code and escalate privileges."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://synaman.com",
"refsource": "MISC",
"url": "http://synaman.com"
},
{
"name": "http://synametrics.com",
"refsource": "MISC",
"url": "http://synametrics.com"
},
{
"name": "https://www.bencteux.fr/posts/synaman/",
"refsource": "MISC",
"url": "https://www.bencteux.fr/posts/synaman/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2022-26251",
"datePublished": "2022-04-06T00:22:47.000Z",
"dateReserved": "2022-02-28T00:00:00.000Z",
"dateUpdated": "2026-07-09T00:17:53.908Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2022-26250 (GCVE-0-2022-26250)
Vulnerability from nvd – Published: 2022-04-06 00:22 – Updated: 2026-07-09 00:17
VLAI
EPSS
VEX
Summary
Synaman v5.1 and below was discovered to contain weak file permissions which allows authenticated attackers to escalate privileges.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
1 reference
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-07-09T00:17:52.670Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.bencteux.fr/posts/synaman/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Synaman v5.1 and below was discovered to contain weak file permissions which allows authenticated attackers to escalate privileges."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-05T15:44:21.558Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://www.bencteux.fr/posts/synaman/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2022-26250",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Synaman v5.1 and below was discovered to contain weak file permissions which allows authenticated attackers to escalate privileges."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://synaman.com",
"refsource": "MISC",
"url": "http://synaman.com"
},
{
"name": "http://synametrics.com",
"refsource": "MISC",
"url": "http://synametrics.com"
},
{
"name": "https://www.bencteux.fr/posts/synaman/",
"refsource": "MISC",
"url": "https://www.bencteux.fr/posts/synaman/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2022-26250",
"datePublished": "2022-04-06T00:22:49.000Z",
"dateReserved": "2022-02-28T00:00:00.000Z",
"dateUpdated": "2026-07-09T00:17:52.670Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2022-22828 (GCVE-0-2022-22828)
Vulnerability from nvd – Published: 2022-01-27 05:41 – Updated: 2024-08-03 03:28
VLAI
EPSS
VEX
Summary
An insecure direct object reference for the file-download URL in Synametrics SynaMan before 5.0 allows a remote attacker to access unshared files via a modified base64-encoded filename string.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://web.synametrics.com/SynamanVersionHistory.htm | x_refsource_MISC |
| https://github.com/videnlabs/CVE-2022-22828/ | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T03:28:42.513Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://web.synametrics.com/SynamanVersionHistory.htm"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/videnlabs/CVE-2022-22828/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An insecure direct object reference for the file-download URL in Synametrics SynaMan before 5.0 allows a remote attacker to access unshared files via a modified base64-encoded filename string."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-01-27T05:41:02.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://web.synametrics.com/SynamanVersionHistory.htm"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/videnlabs/CVE-2022-22828/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2022-22828",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An insecure direct object reference for the file-download URL in Synametrics SynaMan before 5.0 allows a remote attacker to access unshared files via a modified base64-encoded filename string."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://web.synametrics.com/SynamanVersionHistory.htm",
"refsource": "MISC",
"url": "https://web.synametrics.com/SynamanVersionHistory.htm"
},
{
"name": "https://github.com/videnlabs/CVE-2022-22828/",
"refsource": "MISC",
"url": "https://github.com/videnlabs/CVE-2022-22828/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2022-22828",
"datePublished": "2022-01-27T05:41:02.000Z",
"dateReserved": "2022-01-08T00:00:00.000Z",
"dateUpdated": "2024-08-03T03:28:42.513Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2015-3140 (GCVE-0-2015-3140)
Vulnerability from nvd – Published: 2019-11-21 21:41 – Updated: 2024-08-06 05:39
VLAI
EPSS
VEX
Summary
Multiple cross-site request forgery (CSRF) vulnerabilities in Synametrics Technologies SynaMan before 3.5 Build 1451, Syncrify before 3.7 Build 856, and SynTail before 1.5 Build 567
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
3 references
| URL | Tags |
|---|---|
| http://web.synametrics.com/SynamanVersionHistory.htm | x_refsource_CONFIRM |
| https://web.synametrics.com/SyntailVersionHistory.htm | x_refsource_CONFIRM |
| https://web.synametrics.com/SyncrifyVersionHistory.htm | x_refsource_CONFIRM |
Date Public
2015-05-08 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T05:39:31.534Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://web.synametrics.com/SynamanVersionHistory.htm"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://web.synametrics.com/SyntailVersionHistory.htm"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://web.synametrics.com/SyncrifyVersionHistory.htm"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2015-05-08T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site request forgery (CSRF) vulnerabilities in Synametrics Technologies SynaMan before 3.5 Build 1451, Syncrify before 3.7 Build 856, and SynTail before 1.5 Build 567"
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-11-21T21:41:58.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://web.synametrics.com/SynamanVersionHistory.htm"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://web.synametrics.com/SyntailVersionHistory.htm"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://web.synametrics.com/SyncrifyVersionHistory.htm"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2015-3140",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site request forgery (CSRF) vulnerabilities in Synametrics Technologies SynaMan before 3.5 Build 1451, Syncrify before 3.7 Build 856, and SynTail before 1.5 Build 567"
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://web.synametrics.com/SynamanVersionHistory.htm",
"refsource": "CONFIRM",
"url": "http://web.synametrics.com/SynamanVersionHistory.htm"
},
{
"name": "https://web.synametrics.com/SyntailVersionHistory.htm",
"refsource": "CONFIRM",
"url": "https://web.synametrics.com/SyntailVersionHistory.htm"
},
{
"name": "https://web.synametrics.com/SyncrifyVersionHistory.htm",
"refsource": "CONFIRM",
"url": "https://web.synametrics.com/SyncrifyVersionHistory.htm"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2015-3140",
"datePublished": "2019-11-21T21:41:58.000Z",
"dateReserved": "2015-04-09T00:00:00.000Z",
"dateUpdated": "2024-08-06T05:39:31.534Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2018-10814 (GCVE-0-2018-10814)
Vulnerability from nvd – Published: 2018-09-14 21:00 – Updated: 2024-08-05 07:46
VLAI
EPSS
VEX
Summary
Synametrics SynaMan 4.0 build 1488 uses cleartext password storage for SMTP credentials.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| http://packetstormsecurity.com/files/149326/SynaM… | x_refsource_MISC |
| https://www.exploit-db.com/exploits/45387/ | exploitx_refsource_EXPLOIT-DB |
Date Public
2018-09-11 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T07:46:47.309Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/149326/SynaMan-40-Build-1488-SMTP-Credential-Disclosure.html"
},
{
"name": "45387",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/45387/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2018-09-11T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Synametrics SynaMan 4.0 build 1488 uses cleartext password storage for SMTP credentials."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-09-15T09:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/149326/SynaMan-40-Build-1488-SMTP-Credential-Disclosure.html"
},
{
"name": "45387",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/45387/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-10814",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Synametrics SynaMan 4.0 build 1488 uses cleartext password storage for SMTP credentials."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://packetstormsecurity.com/files/149326/SynaMan-40-Build-1488-SMTP-Credential-Disclosure.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/149326/SynaMan-40-Build-1488-SMTP-Credential-Disclosure.html"
},
{
"name": "45387",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/45387/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-10814",
"datePublished": "2018-09-14T21:00:00.000Z",
"dateReserved": "2018-05-08T00:00:00.000Z",
"dateUpdated": "2024-08-05T07:46:47.309Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2018-10763 (GCVE-0-2018-10763)
Vulnerability from nvd – Published: 2018-09-14 21:00 – Updated: 2024-08-05 07:46
VLAI
EPSS
VEX
Summary
Multiple cross-site scripting (XSS) vulnerabilities in Synametrics SynaMan 4.0 build 1488 via the (1) Main heading or (2) Sub heading fields in the Partial Branding configuration page.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.exploit-db.com/exploits/45386/ | exploitx_refsource_EXPLOIT-DB |
| http://packetstormsecurity.com/files/149324/SynaM… | x_refsource_MISC |
Date Public
2018-09-12 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T07:46:46.639Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "45386",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/45386/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/149324/SynaMan-4.0-Build-1488-Cross-Site-Scripting.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2018-09-12T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in Synametrics SynaMan 4.0 build 1488 via the (1) Main heading or (2) Sub heading fields in the Partial Branding configuration page."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-09-15T09:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "45386",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/45386/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/149324/SynaMan-4.0-Build-1488-Cross-Site-Scripting.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-10763",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in Synametrics SynaMan 4.0 build 1488 via the (1) Main heading or (2) Sub heading fields in the Partial Branding configuration page."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "45386",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/45386/"
},
{
"name": "http://packetstormsecurity.com/files/149324/SynaMan-4.0-Build-1488-Cross-Site-Scripting.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/149324/SynaMan-4.0-Build-1488-Cross-Site-Scripting.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-10763",
"datePublished": "2018-09-14T21:00:00.000Z",
"dateReserved": "2018-05-06T00:00:00.000Z",
"dateUpdated": "2024-08-05T07:46:46.639Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2015-3141 (GCVE-0-2015-3141)
Vulnerability from nvd – Published: 2015-05-20 19:00 – Updated: 2024-08-06 05:39
VLAI
EPSS
VEX
Summary
Multiple cross-site request forgery (CSRF) vulnerabilities in Synametrics Technologies Xeams 4.5 Build 5755 and earlier allow remote attackers to hijack the authentication of administrators for requests that create an (1) SMTP domain or a (2) user via a request to /FrontController; or conduct cross-site scripting (XSS) attacks via the (3) domainname parameter to /FrontController, when creating a new SMTP domain configuration; the (4) txtRecipient parameter to /FrontController, when creating a new forwarder; the (5) popFetchServer, (6) popFetchUser, or (7) popFetchRecipient parameter to /FrontController, when creating a new POP3 Fetcher account; or the (8) Smtp HELO domain in the Advanced Server Configuration.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
4 references
| URL | Tags |
|---|---|
| http://osvdb.org/show/osvdb/121847 | vdb-entryx_refsource_OSVDB |
| http://www.securityfocus.com/bid/74578 | vdb-entryx_refsource_BID |
| https://www.exploit-db.com/exploits/36949/ | exploitx_refsource_EXPLOIT-DB |
| http://packetstormsecurity.com/files/131844/Xeams… | x_refsource_MISC |
Date Public
2015-05-08 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T05:39:31.595Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "121847",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/show/osvdb/121847"
},
{
"name": "74578",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/74578"
},
{
"name": "36949",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/36949/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/131844/Xeams-4.5-Build-5755-CSRF-Cross-Site-Scripting.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2015-05-08T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site request forgery (CSRF) vulnerabilities in Synametrics Technologies Xeams 4.5 Build 5755 and earlier allow remote attackers to hijack the authentication of administrators for requests that create an (1) SMTP domain or a (2) user via a request to /FrontController; or conduct cross-site scripting (XSS) attacks via the (3) domainname parameter to /FrontController, when creating a new SMTP domain configuration; the (4) txtRecipient parameter to /FrontController, when creating a new forwarder; the (5) popFetchServer, (6) popFetchUser, or (7) popFetchRecipient parameter to /FrontController, when creating a new POP3 Fetcher account; or the (8) Smtp HELO domain in the Advanced Server Configuration."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-12-01T15:57:02.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "121847",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/show/osvdb/121847"
},
{
"name": "74578",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/74578"
},
{
"name": "36949",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/36949/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/131844/Xeams-4.5-Build-5755-CSRF-Cross-Site-Scripting.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2015-3141",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site request forgery (CSRF) vulnerabilities in Synametrics Technologies Xeams 4.5 Build 5755 and earlier allow remote attackers to hijack the authentication of administrators for requests that create an (1) SMTP domain or a (2) user via a request to /FrontController; or conduct cross-site scripting (XSS) attacks via the (3) domainname parameter to /FrontController, when creating a new SMTP domain configuration; the (4) txtRecipient parameter to /FrontController, when creating a new forwarder; the (5) popFetchServer, (6) popFetchUser, or (7) popFetchRecipient parameter to /FrontController, when creating a new POP3 Fetcher account; or the (8) Smtp HELO domain in the Advanced Server Configuration."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "121847",
"refsource": "OSVDB",
"url": "http://osvdb.org/show/osvdb/121847"
},
{
"name": "74578",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/74578"
},
{
"name": "36949",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/36949/"
},
{
"name": "http://packetstormsecurity.com/files/131844/Xeams-4.5-Build-5755-CSRF-Cross-Site-Scripting.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/131844/Xeams-4.5-Build-5755-CSRF-Cross-Site-Scripting.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2015-3141",
"datePublished": "2015-05-20T19:00:00.000Z",
"dateReserved": "2015-04-09T00:00:00.000Z",
"dateUpdated": "2024-08-06T05:39:31.595Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2012-2569 (GCVE-0-2012-2569)
Vulnerability from nvd – Published: 2014-06-19 14:00 – Updated: 2024-08-06 19:34
VLAI
EPSS
VEX
Summary
Cross-site scripting (XSS) vulnerability in Synametrics Technologies Xeams 4.4 Build 5720 allows remote attackers to inject arbitrary web script or HTML via the body of an email.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
5 references
| URL | Tags |
|---|---|
| http://osvdb.org/84591 | vdb-entryx_refsource_OSVDB |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
| http://secunia.com/advisories/50190 | third-party-advisoryx_refsource_SECUNIA |
| http://www.exploit-db.com/exploits/20367 | exploitx_refsource_EXPLOIT-DB |
| http://www.securityfocus.com/bid/54902 | vdb-entryx_refsource_BID |
Date Public
2012-08-08 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T19:34:25.918Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "84591",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/84591"
},
{
"name": "xeamsemailserver-sendmail-xss(77504)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/77504"
},
{
"name": "50190",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/50190"
},
{
"name": "20367",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "http://www.exploit-db.com/exploits/20367"
},
{
"name": "54902",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/54902"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2012-08-08T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in Synametrics Technologies Xeams 4.4 Build 5720 allows remote attackers to inject arbitrary web script or HTML via the body of an email."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-28T12:57:01.000Z",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"name": "84591",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/84591"
},
{
"name": "xeamsemailserver-sendmail-xss(77504)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/77504"
},
{
"name": "50190",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/50190"
},
{
"name": "20367",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "http://www.exploit-db.com/exploits/20367"
},
{
"name": "54902",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/54902"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cert@cert.org",
"ID": "CVE-2012-2569",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in Synametrics Technologies Xeams 4.4 Build 5720 allows remote attackers to inject arbitrary web script or HTML via the body of an email."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "84591",
"refsource": "OSVDB",
"url": "http://osvdb.org/84591"
},
{
"name": "xeamsemailserver-sendmail-xss(77504)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/77504"
},
{
"name": "50190",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/50190"
},
{
"name": "20367",
"refsource": "EXPLOIT-DB",
"url": "http://www.exploit-db.com/exploits/20367"
},
{
"name": "54902",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/54902"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2012-2569",
"datePublished": "2014-06-19T14:00:00.000Z",
"dateReserved": "2012-05-09T00:00:00.000Z",
"dateUpdated": "2024-08-06T19:34:25.918Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-26250 (GCVE-0-2022-26250)
Vulnerability from cvelistv5 – Published: 2022-04-06 00:22 – Updated: 2026-07-09 00:17
VLAI
EPSS
VEX
Summary
Synaman v5.1 and below was discovered to contain weak file permissions which allows authenticated attackers to escalate privileges.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
1 reference
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-07-09T00:17:52.670Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.bencteux.fr/posts/synaman/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Synaman v5.1 and below was discovered to contain weak file permissions which allows authenticated attackers to escalate privileges."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-05T15:44:21.558Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://www.bencteux.fr/posts/synaman/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2022-26250",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Synaman v5.1 and below was discovered to contain weak file permissions which allows authenticated attackers to escalate privileges."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://synaman.com",
"refsource": "MISC",
"url": "http://synaman.com"
},
{
"name": "http://synametrics.com",
"refsource": "MISC",
"url": "http://synametrics.com"
},
{
"name": "https://www.bencteux.fr/posts/synaman/",
"refsource": "MISC",
"url": "https://www.bencteux.fr/posts/synaman/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2022-26250",
"datePublished": "2022-04-06T00:22:49.000Z",
"dateReserved": "2022-02-28T00:00:00.000Z",
"dateUpdated": "2026-07-09T00:17:52.670Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2022-26251 (GCVE-0-2022-26251)
Vulnerability from cvelistv5 – Published: 2022-04-06 00:22 – Updated: 2026-07-09 00:17
VLAI
EPSS
VEX
Summary
The HTTP interface of Synaman v5.1 and below was discovered to allow authenticated attackers to execute arbitrary code and escalate privileges.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
1 reference
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-07-09T00:17:53.908Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.bencteux.fr/posts/synaman/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The HTTP interface of Synaman v5.1 and below was discovered to allow authenticated attackers to execute arbitrary code and escalate privileges."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-05T15:47:16.071Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://www.bencteux.fr/posts/synaman/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2022-26251",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The HTTP interface of Synaman v5.1 and below was discovered to allow authenticated attackers to execute arbitrary code and escalate privileges."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://synaman.com",
"refsource": "MISC",
"url": "http://synaman.com"
},
{
"name": "http://synametrics.com",
"refsource": "MISC",
"url": "http://synametrics.com"
},
{
"name": "https://www.bencteux.fr/posts/synaman/",
"refsource": "MISC",
"url": "https://www.bencteux.fr/posts/synaman/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2022-26251",
"datePublished": "2022-04-06T00:22:47.000Z",
"dateReserved": "2022-02-28T00:00:00.000Z",
"dateUpdated": "2026-07-09T00:17:53.908Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2022-22828 (GCVE-0-2022-22828)
Vulnerability from cvelistv5 – Published: 2022-01-27 05:41 – Updated: 2024-08-03 03:28
VLAI
EPSS
VEX
Summary
An insecure direct object reference for the file-download URL in Synametrics SynaMan before 5.0 allows a remote attacker to access unshared files via a modified base64-encoded filename string.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://web.synametrics.com/SynamanVersionHistory.htm | x_refsource_MISC |
| https://github.com/videnlabs/CVE-2022-22828/ | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T03:28:42.513Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://web.synametrics.com/SynamanVersionHistory.htm"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/videnlabs/CVE-2022-22828/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An insecure direct object reference for the file-download URL in Synametrics SynaMan before 5.0 allows a remote attacker to access unshared files via a modified base64-encoded filename string."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-01-27T05:41:02.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://web.synametrics.com/SynamanVersionHistory.htm"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/videnlabs/CVE-2022-22828/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2022-22828",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An insecure direct object reference for the file-download URL in Synametrics SynaMan before 5.0 allows a remote attacker to access unshared files via a modified base64-encoded filename string."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://web.synametrics.com/SynamanVersionHistory.htm",
"refsource": "MISC",
"url": "https://web.synametrics.com/SynamanVersionHistory.htm"
},
{
"name": "https://github.com/videnlabs/CVE-2022-22828/",
"refsource": "MISC",
"url": "https://github.com/videnlabs/CVE-2022-22828/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2022-22828",
"datePublished": "2022-01-27T05:41:02.000Z",
"dateReserved": "2022-01-08T00:00:00.000Z",
"dateUpdated": "2024-08-03T03:28:42.513Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2015-3140 (GCVE-0-2015-3140)
Vulnerability from cvelistv5 – Published: 2019-11-21 21:41 – Updated: 2024-08-06 05:39
VLAI
EPSS
VEX
Summary
Multiple cross-site request forgery (CSRF) vulnerabilities in Synametrics Technologies SynaMan before 3.5 Build 1451, Syncrify before 3.7 Build 856, and SynTail before 1.5 Build 567
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
3 references
| URL | Tags |
|---|---|
| http://web.synametrics.com/SynamanVersionHistory.htm | x_refsource_CONFIRM |
| https://web.synametrics.com/SyntailVersionHistory.htm | x_refsource_CONFIRM |
| https://web.synametrics.com/SyncrifyVersionHistory.htm | x_refsource_CONFIRM |
Date Public
2015-05-08 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T05:39:31.534Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://web.synametrics.com/SynamanVersionHistory.htm"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://web.synametrics.com/SyntailVersionHistory.htm"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://web.synametrics.com/SyncrifyVersionHistory.htm"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2015-05-08T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site request forgery (CSRF) vulnerabilities in Synametrics Technologies SynaMan before 3.5 Build 1451, Syncrify before 3.7 Build 856, and SynTail before 1.5 Build 567"
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-11-21T21:41:58.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://web.synametrics.com/SynamanVersionHistory.htm"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://web.synametrics.com/SyntailVersionHistory.htm"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://web.synametrics.com/SyncrifyVersionHistory.htm"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2015-3140",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site request forgery (CSRF) vulnerabilities in Synametrics Technologies SynaMan before 3.5 Build 1451, Syncrify before 3.7 Build 856, and SynTail before 1.5 Build 567"
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://web.synametrics.com/SynamanVersionHistory.htm",
"refsource": "CONFIRM",
"url": "http://web.synametrics.com/SynamanVersionHistory.htm"
},
{
"name": "https://web.synametrics.com/SyntailVersionHistory.htm",
"refsource": "CONFIRM",
"url": "https://web.synametrics.com/SyntailVersionHistory.htm"
},
{
"name": "https://web.synametrics.com/SyncrifyVersionHistory.htm",
"refsource": "CONFIRM",
"url": "https://web.synametrics.com/SyncrifyVersionHistory.htm"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2015-3140",
"datePublished": "2019-11-21T21:41:58.000Z",
"dateReserved": "2015-04-09T00:00:00.000Z",
"dateUpdated": "2024-08-06T05:39:31.534Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2018-10763 (GCVE-0-2018-10763)
Vulnerability from cvelistv5 – Published: 2018-09-14 21:00 – Updated: 2024-08-05 07:46
VLAI
EPSS
VEX
Summary
Multiple cross-site scripting (XSS) vulnerabilities in Synametrics SynaMan 4.0 build 1488 via the (1) Main heading or (2) Sub heading fields in the Partial Branding configuration page.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.exploit-db.com/exploits/45386/ | exploitx_refsource_EXPLOIT-DB |
| http://packetstormsecurity.com/files/149324/SynaM… | x_refsource_MISC |
Date Public
2018-09-12 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T07:46:46.639Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "45386",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/45386/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/149324/SynaMan-4.0-Build-1488-Cross-Site-Scripting.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2018-09-12T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in Synametrics SynaMan 4.0 build 1488 via the (1) Main heading or (2) Sub heading fields in the Partial Branding configuration page."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-09-15T09:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "45386",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/45386/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/149324/SynaMan-4.0-Build-1488-Cross-Site-Scripting.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-10763",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in Synametrics SynaMan 4.0 build 1488 via the (1) Main heading or (2) Sub heading fields in the Partial Branding configuration page."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "45386",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/45386/"
},
{
"name": "http://packetstormsecurity.com/files/149324/SynaMan-4.0-Build-1488-Cross-Site-Scripting.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/149324/SynaMan-4.0-Build-1488-Cross-Site-Scripting.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-10763",
"datePublished": "2018-09-14T21:00:00.000Z",
"dateReserved": "2018-05-06T00:00:00.000Z",
"dateUpdated": "2024-08-05T07:46:46.639Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2018-10814 (GCVE-0-2018-10814)
Vulnerability from cvelistv5 – Published: 2018-09-14 21:00 – Updated: 2024-08-05 07:46
VLAI
EPSS
VEX
Summary
Synametrics SynaMan 4.0 build 1488 uses cleartext password storage for SMTP credentials.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| http://packetstormsecurity.com/files/149326/SynaM… | x_refsource_MISC |
| https://www.exploit-db.com/exploits/45387/ | exploitx_refsource_EXPLOIT-DB |
Date Public
2018-09-11 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T07:46:47.309Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/149326/SynaMan-40-Build-1488-SMTP-Credential-Disclosure.html"
},
{
"name": "45387",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/45387/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2018-09-11T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Synametrics SynaMan 4.0 build 1488 uses cleartext password storage for SMTP credentials."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-09-15T09:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/149326/SynaMan-40-Build-1488-SMTP-Credential-Disclosure.html"
},
{
"name": "45387",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/45387/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-10814",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Synametrics SynaMan 4.0 build 1488 uses cleartext password storage for SMTP credentials."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://packetstormsecurity.com/files/149326/SynaMan-40-Build-1488-SMTP-Credential-Disclosure.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/149326/SynaMan-40-Build-1488-SMTP-Credential-Disclosure.html"
},
{
"name": "45387",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/45387/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-10814",
"datePublished": "2018-09-14T21:00:00.000Z",
"dateReserved": "2018-05-08T00:00:00.000Z",
"dateUpdated": "2024-08-05T07:46:47.309Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2015-3141 (GCVE-0-2015-3141)
Vulnerability from cvelistv5 – Published: 2015-05-20 19:00 – Updated: 2024-08-06 05:39
VLAI
EPSS
VEX
Summary
Multiple cross-site request forgery (CSRF) vulnerabilities in Synametrics Technologies Xeams 4.5 Build 5755 and earlier allow remote attackers to hijack the authentication of administrators for requests that create an (1) SMTP domain or a (2) user via a request to /FrontController; or conduct cross-site scripting (XSS) attacks via the (3) domainname parameter to /FrontController, when creating a new SMTP domain configuration; the (4) txtRecipient parameter to /FrontController, when creating a new forwarder; the (5) popFetchServer, (6) popFetchUser, or (7) popFetchRecipient parameter to /FrontController, when creating a new POP3 Fetcher account; or the (8) Smtp HELO domain in the Advanced Server Configuration.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
4 references
| URL | Tags |
|---|---|
| http://osvdb.org/show/osvdb/121847 | vdb-entryx_refsource_OSVDB |
| http://www.securityfocus.com/bid/74578 | vdb-entryx_refsource_BID |
| https://www.exploit-db.com/exploits/36949/ | exploitx_refsource_EXPLOIT-DB |
| http://packetstormsecurity.com/files/131844/Xeams… | x_refsource_MISC |
Date Public
2015-05-08 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T05:39:31.595Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "121847",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/show/osvdb/121847"
},
{
"name": "74578",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/74578"
},
{
"name": "36949",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/36949/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/131844/Xeams-4.5-Build-5755-CSRF-Cross-Site-Scripting.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2015-05-08T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site request forgery (CSRF) vulnerabilities in Synametrics Technologies Xeams 4.5 Build 5755 and earlier allow remote attackers to hijack the authentication of administrators for requests that create an (1) SMTP domain or a (2) user via a request to /FrontController; or conduct cross-site scripting (XSS) attacks via the (3) domainname parameter to /FrontController, when creating a new SMTP domain configuration; the (4) txtRecipient parameter to /FrontController, when creating a new forwarder; the (5) popFetchServer, (6) popFetchUser, or (7) popFetchRecipient parameter to /FrontController, when creating a new POP3 Fetcher account; or the (8) Smtp HELO domain in the Advanced Server Configuration."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-12-01T15:57:02.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "121847",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/show/osvdb/121847"
},
{
"name": "74578",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/74578"
},
{
"name": "36949",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/36949/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/131844/Xeams-4.5-Build-5755-CSRF-Cross-Site-Scripting.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2015-3141",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site request forgery (CSRF) vulnerabilities in Synametrics Technologies Xeams 4.5 Build 5755 and earlier allow remote attackers to hijack the authentication of administrators for requests that create an (1) SMTP domain or a (2) user via a request to /FrontController; or conduct cross-site scripting (XSS) attacks via the (3) domainname parameter to /FrontController, when creating a new SMTP domain configuration; the (4) txtRecipient parameter to /FrontController, when creating a new forwarder; the (5) popFetchServer, (6) popFetchUser, or (7) popFetchRecipient parameter to /FrontController, when creating a new POP3 Fetcher account; or the (8) Smtp HELO domain in the Advanced Server Configuration."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "121847",
"refsource": "OSVDB",
"url": "http://osvdb.org/show/osvdb/121847"
},
{
"name": "74578",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/74578"
},
{
"name": "36949",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/36949/"
},
{
"name": "http://packetstormsecurity.com/files/131844/Xeams-4.5-Build-5755-CSRF-Cross-Site-Scripting.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/131844/Xeams-4.5-Build-5755-CSRF-Cross-Site-Scripting.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2015-3141",
"datePublished": "2015-05-20T19:00:00.000Z",
"dateReserved": "2015-04-09T00:00:00.000Z",
"dateUpdated": "2024-08-06T05:39:31.595Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2012-2569 (GCVE-0-2012-2569)
Vulnerability from cvelistv5 – Published: 2014-06-19 14:00 – Updated: 2024-08-06 19:34
VLAI
EPSS
VEX
Summary
Cross-site scripting (XSS) vulnerability in Synametrics Technologies Xeams 4.4 Build 5720 allows remote attackers to inject arbitrary web script or HTML via the body of an email.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
5 references
| URL | Tags |
|---|---|
| http://osvdb.org/84591 | vdb-entryx_refsource_OSVDB |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
| http://secunia.com/advisories/50190 | third-party-advisoryx_refsource_SECUNIA |
| http://www.exploit-db.com/exploits/20367 | exploitx_refsource_EXPLOIT-DB |
| http://www.securityfocus.com/bid/54902 | vdb-entryx_refsource_BID |
Date Public
2012-08-08 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T19:34:25.918Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "84591",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/84591"
},
{
"name": "xeamsemailserver-sendmail-xss(77504)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/77504"
},
{
"name": "50190",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/50190"
},
{
"name": "20367",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "http://www.exploit-db.com/exploits/20367"
},
{
"name": "54902",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/54902"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2012-08-08T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in Synametrics Technologies Xeams 4.4 Build 5720 allows remote attackers to inject arbitrary web script or HTML via the body of an email."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-28T12:57:01.000Z",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"name": "84591",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/84591"
},
{
"name": "xeamsemailserver-sendmail-xss(77504)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/77504"
},
{
"name": "50190",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/50190"
},
{
"name": "20367",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "http://www.exploit-db.com/exploits/20367"
},
{
"name": "54902",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/54902"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cert@cert.org",
"ID": "CVE-2012-2569",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in Synametrics Technologies Xeams 4.4 Build 5720 allows remote attackers to inject arbitrary web script or HTML via the body of an email."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "84591",
"refsource": "OSVDB",
"url": "http://osvdb.org/84591"
},
{
"name": "xeamsemailserver-sendmail-xss(77504)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/77504"
},
{
"name": "50190",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/50190"
},
{
"name": "20367",
"refsource": "EXPLOIT-DB",
"url": "http://www.exploit-db.com/exploits/20367"
},
{
"name": "54902",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/54902"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2012-2569",
"datePublished": "2014-06-19T14:00:00.000Z",
"dateReserved": "2012-05-09T00:00:00.000Z",
"dateUpdated": "2024-08-06T19:34:25.918Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}