Published: 20/05/2015 Updated: 03/12/2016

CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6

VMScore: 685

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

Multiple cross-site request forgery (CSRF) vulnerabilities in Synametrics Technologies Xeams 4.5 Build 5755 and previous versions allow remote malicious users to hijack the authentication of administrators for requests that create an (1) SMTP domain or a (2) user via a request to /FrontController; or conduct cross-site scripting (XSS) attacks via the (3) domainname parameter to /FrontController, when creating a new SMTP domain configuration; the (4) txtRecipient parameter to /FrontController, when creating a new forwarder; the (5) popFetchServer, (6) popFetchUser, or (7) popFetchRecipient parameter to /FrontController, when creating a new POP3 Fetcher account; or the (8) Smtp HELO domain in the Advanced Server Configuration.

Vulnerable Product	Search on Vulmon	Subscribe to Product
synametrics xeams

# Exploit Title: Multiple vulnerabilities in Xeams 45 Build 5755 (CSRF/Stored XSS) # Date: 07-05-2015 # Exploit Author: Marlow Tannhauser # Contact: marlowtannhauser@gmailcom # Vendor Homepage: wwwsynametricscom # Software Link: websynametricscom/XeamsDownloadhtm # Version: 45 Build 5755 Earlier versions may also be affected ...

CWE-352 http://osvdb.org/show/osvdb/121847 https://www.exploit-db.com/exploits/36949/http://packetstormsecurity.com/files/131844/Xeams-4.5-Build-5755-CSRF-Cross-Site-Scripting.html http://www.securityfocus.com/bid/74578 https://nvd.nist.gov https://www.exploit-db.com/exploits/36949/

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2015-3141

Vulnerability Summary

Exploits

References

Vulmon Search

About

Products

Connect