CVE-2020-9030

Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow Directory Traversal via the FileName parameter to the syslog.php...

CVE-2020-9031

Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow Directory Traversal via the FileName parameter to daemonlog.php...

CVE-2020-9033

Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow Directory Traversal via the FileName parameter to authlog.php...

CVE-2020-9030

Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow Directory Traversal via the FileName parameter to the syslog.php...

Directory traversal

Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow Directory Traversal via the FileName parameter to the syslog.php...

Default credentials

Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow stored XSS via the newUserName parameter on the "User Creation, Deletion and Password Maintenance" screen when creating a new user...

Directory traversal

Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow Directory Traversal via the FileName parameter to kernlog.php...

Directory traversal

Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow Directory Traversal via the FileName parameter to messagelog.php...

Directory traversal

Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow Directory Traversal via the FileName parameter to daemonlog.php...

CVE-2020-9034

Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices mishandle session validation, leading to unauthenticated creation, modification, or elimination of users...

Input validation

Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices mishandle session validation, leading to unauthenticated creation, modification, or elimination of users...

CVE-2020-9028

The CVE-2020-9028 entry concerns Symmetricom SyncServer devices (S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, S350 2.80.1) that allow stored XSS via the newUserName parameter on the User Creation, Deletion and Password Maintenance screen when creating a new user. The connected documents con...

CVE-2020-9028

Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow stored XSS via the newUserName parameter on the "User Creation, Deletion and Password Maintenance" screen when creating a new user...

CVE-2020-9029

CVE-2020-9029 concerns Symmetricom SyncServer family (S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, S350 2.80.1) where a Directory Traversal is possible via the FileName parameter to messagelog.php. The connected sources consistently describe a path traversal vulnerability in these devices; ...

CVE-2020-9029

Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow Directory Traversal via the FileName parameter to messagelog.php...

CVE-2020-9030

Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow Directory Traversal via the FileName parameter to the syslog.php...

CVE-2020-9030

Symmetricom SyncServer S100/S200/S250/S300/S350 devices are affected by CVE-2020-9030 due to a directory traversal vulnerability in the FileName parameter of syslog.php. The root cause is improper validation of the file path, enabling an attacker to access locations outside of a restricted direct...

CVE-2020-9031

Symmetricom SyncServer devices (S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, S350 2.80.1) are affected by a directory traversal vulnerability in the FileName parameter of daemonlog.php. The underlying root cause is not explicitly detailed in the provided documents, but the vulnerability all...

CVE-2020-9031

Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow Directory Traversal via the FileName parameter to daemonlog.php...

CVE-2020-9032

CVE-2020-9032 affects Symmetricom SyncServer S100/S200/S250/S300/S350 devices (versions listed in the CVE) and enables Directory Traversal via the FileName parameter to kernlog.php. Root cause: improper handling/filtering of file paths in kernlog.php leading to access outside the intended directo...