Vulnerabilities > Synametrics

DATE CVE VULNERABILITY TITLE RISK
2022-04-06 CVE-2022-26250 Incorrect Permission Assignment for Critical Resource vulnerability in Synametrics Synaman
Synaman v5.1 and below was discovered to contain weak file permissions which allows authenticated attackers to escalate privileges.
local
low complexity
synametrics CWE-732
4.6
2022-04-06 CVE-2022-26251 Improper Privilege Management vulnerability in Synametrics Synaman
The HTTP interface of Synaman v5.1 and below was discovered to allow authenticated attackers to execute arbitrary code and escalate privileges.
network
low complexity
synametrics CWE-269
critical
9.0
2022-01-27 CVE-2022-22828 Authorization Bypass Through User-Controlled Key vulnerability in Synametrics Synaman
An insecure direct object reference for the file-download URL in Synametrics SynaMan before 5.0 allows a remote attacker to access unshared files via a modified base64-encoded filename string.
network
low complexity
synametrics CWE-639
5.0
2019-11-21 CVE-2015-3140 Cross-Site Request Forgery (CSRF) vulnerability in Synametrics Synaman, Syncrify and Syntail
Multiple cross-site request forgery (CSRF) vulnerabilities in Synametrics Technologies SynaMan before 3.5 Build 1451, Syncrify before 3.7 Build 856, and SynTail before 1.5 Build 567
6.8
2018-09-14 CVE-2018-10814 Insufficiently Protected Credentials vulnerability in Synametrics Synaman 4.0
Synametrics SynaMan 4.0 build 1488 uses cleartext password storage for SMTP credentials.
local
low complexity
synametrics CWE-522
2.1
2018-09-14 CVE-2018-10763 Cross-site Scripting vulnerability in Synametrics Synaman 4.0
Multiple cross-site scripting (XSS) vulnerabilities in Synametrics SynaMan 4.0 build 1488 via the (1) Main heading or (2) Sub heading fields in the Partial Branding configuration page.
3.5
2015-05-20 CVE-2015-3141 Cross-Site Request Forgery (CSRF) vulnerability in Synametrics Xeams 4.4
Multiple cross-site request forgery (CSRF) vulnerabilities in Synametrics Technologies Xeams 4.5 Build 5755 and earlier allow remote attackers to hijack the authentication of administrators for requests that create an (1) SMTP domain or a (2) user via a request to /FrontController; or conduct cross-site scripting (XSS) attacks via the (3) domainname parameter to /FrontController, when creating a new SMTP domain configuration; the (4) txtRecipient parameter to /FrontController, when creating a new forwarder; the (5) popFetchServer, (6) popFetchUser, or (7) popFetchRecipient parameter to /FrontController, when creating a new POP3 Fetcher account; or the (8) Smtp HELO domain in the Advanced Server Configuration.
6.8
2014-06-19 CVE-2012-2569 Cross-Site Scripting vulnerability in Synametrics Xeams 4.4
Cross-site scripting (XSS) vulnerability in Synametrics Technologies Xeams 4.4 Build 5720 allows remote attackers to inject arbitrary web script or HTML via the body of an email.
4.3