CVE-2022-36536

An issue in the component postapplogin.php of Super Flexible Software GmbH & Co. KG Syncovery 9 for Linux v9.47x and below allows attackers to escalate privileges via creating crafted session tokens...

Cross site scripting

Super Flexible Software GmbH & Co. KG Syncovery 9 for Linux v9.47x and below was discovered to contain a cross-site scripting XSS vulnerability...

Design/Logic Flaw

An issue in the component postapplogin.php of Super Flexible Software GmbH & Co. KG Syncovery 9 for Linux v9.47x and below allows attackers to escalate privileges via creating crafted session tokens...

Remote code execution

Super Flexible Software GmbH & Co. KG Syncovery 9 for Linux v9.47x and below was discovered to contain multiple remote code execution RCE vulnerabilities via the JobExecuteBefore and JobExecuteAfter parameters at postprofilesettings.php...

CVE-2022-36536

CVE-2022-36536 affects Syncovery for Linux (Super Flexible Software) in the post_applogin.php component. Multiple sources (NVD, Red Hat, CVE lists) describe an insecure session token generation that enables privilege escalation via crafted tokens in v9.47x and earlier. The published CVSS 3.1 base...

CVE-2022-36536

An issue in the component postapplogin.php of Super Flexible Software GmbH & Co. KG Syncovery 9 for Linux v9.47x and below allows attackers to escalate privileges via creating crafted session tokens...

CVE-2022-36533

Syncovery for Linux (Super Flexible Software Syncovery, v9.47x and earlier) is affected by an XSS vulnerability caused by missing output encoding on error and status pages, enabling Reflective XSS via a crafted link. Public descriptions confirm exploitable behavior and versions affected up to at ...

CVE-2022-36533

Super Flexible Software GmbH & Co. KG Syncovery 9 for Linux v9.47x and below was discovered to contain a cross-site scripting XSS vulnerability...

Syncovery 安全特征问题漏洞

Syncovery is a superbly versatile synchronization, copy, move, and backup tool from Syncovery Germany. A security vulnerability exists in Syncovery 9 for Linux prior to v9.48j, which stems from session tokens being generated in an insecure manner and can be exploited by an attacker to easily...

Syncovery 命令注入漏洞

Syncovery is a superbly versatile synchronization, copy, move, and backup utility from German company Syncovery. Syncovery 9 for Linux before v9.48j suffers from a command injection vulnerability that originates from allowing a user to execute commands or scripts before or after running a...

CVE-2022-36534

Syncovery for Linux (Syncovery 9, v9.47x and below) contains authenticated remote code execution via Job_ExecuteBefore/Job_ExecuteAfter in post_profilesettings.php. The vulnerability allows an authenticated user to create jobs that execute commands when a profile runs, potentially executing arbit...

Syncovery 跨站脚本漏洞

Syncovery is a superbly versatile synchronization, copy, move, and backup tool from Syncovery Germany. A cross-site scripting vulnerability exists in Syncovery 9 for Linux prior to v9.48j, which stems from a missing output encoding in the error and status pages, and can be exploited by an attacke...

PT-2022-4827 · Syncovery · Syncovery

Name of the Vulnerable Software and Affected Versions: Syncovery versions 9.47x and below Description: The issue is related to remote code execution via the Job ExecuteBefore and Job ExecuteAfter parameters at the "post profilesettings.php" endpoint. It is associated with a lack of data...

Syncovery For Linux Web-GUI Authenticated Remote Command Execution

This module exploits an authenticated command injection vulnerability in the Web GUI of Syncovery File Sync & Backup Software for Linux. Successful exploitation results in remote code execution under the context of the root user. Syncovery allows an authenticated user to create jobs, which are...

Syncovery For Linux Web-GUI Session Token Brute-Forcer

This module attempts to brute-force a valid session token for the Syncovery File Sync & Backup Software Web-GUI by generating all possible tokens, for every second between 'DateTime.now' and the given X days. By default today and yesterday DAYS = 1 will be checked. If a valid session token is...