Xeams SQLRunner Derby hardcoded creds JSP RCE

Unauthenticated SQLRunner.jsp connects to embedded Derby with default credentials, SYSCSEXPORTQUERY writes JSP under webapps/ROOT, GET runs cmd. """Xeams SQLRunner.jsp unauthenticated Derby export → JSP webshell RCE.""" from future import annotations import random import re from urllib.parse impo...

Xeams SMTP save-body cron root RCE

X-SMSAVEBODY4DEBUGGING writes arbitrary file; base64 body plants /etc/cron.d job running payload as root. """Xeams SMTP X-SMSAVEBODY4DEBUGGING Arbitrary File Write Cron Root RCE""" from future import annotations from kittysploit import import base64 import socket import sys import time import re...

Xeams SQLRunner.jsp Unauthenticated Derby Hardcoded Cred JSP Webshell RCE — Detect

Fingerprint / reachability check for Xeams SQLRunner.jsp Unauthenticated Derby Hardcoded Cred JSP Webshell RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Xeams SQLRunner.jsp Unauthenticated Derby Hardcoded Cred JSP Webshell RCE""" from kittysploit import from...

Xeams Admin Console Login Panel - Detect

Xeams Admin Console login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Xeams Admin Console login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Xeams Admin Console Login Panel...

EUVD-2012-2555

Malware in sbrugna...

EUVD-2015-3222

Malware in sbrugna...

CVE-2015-3141

Multiple cross-site request forgery CSRF vulnerabilities in Synametrics Technologies Xeams 4.5 Build 5755 and earlier allow remote attackers to hijack the authentication of administrators for requests that create an 1 SMTP domain or a 2 user via a request to /FrontController; or conduct cross-sit...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in Synametrics Technologies Xeams 4.5 Build 5755 and earlier allow remote attackers to hijack the authentication of administrators for requests that create an 1 SMTP domain or a 2 user via a request to /FrontController; or conduct cross-sit...

CVE-2015-3141

Multiple cross-site request forgery CSRF vulnerabilities in Synametrics Technologies Xeams 4.5 Build 5755 and earlier allow remote attackers to hijack the authentication of administrators for requests that create an 1 SMTP domain or a 2 user via a request to /FrontController; or conduct cross-sit...

CVE-2015-3141

The CVE-2015-3141 entry affects Synametrics Xeams 4.5 Build 5755 and earlier, with CSRF vulnerabilities in /FrontController enabling an attacker to hijack administrator sessions via requests that create an SMTP domain or a user, and to trigger XSS via domainname, txtRecipient, and related paramet...

CVE-2015-3141: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in Synametrics Technologies Xeams 4.5 Build 5755 and earlier allow remote attackers to hijack the authentication of administrators for requests that create an 1 SMTP domain or a 2 user via a request to /FrontController; or conduct cross-sit...

PT-2015-6073

Name of the Vulnerable Software and Affected Versions Synametrics Technologies Xeams versions 4.5 Build 5755 and earlier Description The issue allows remote attackers to hijack the authentication of administrators for requests, such as creating an SMTP domain or a user, via a request to...

Xeams /FrontController Cross-Site Request Forgery Vulnerability

Xeams is an email server. A cross-site request forgery vulnerability exists in Xeams /FrontController, which allows remote attackers to construct malicious URIs, trick users into parsing them, and can target user contexts to perform malicious actions...

Xeams 4.5 Build 5755 - CSRF / XSS Vulnerabilities

Exploit for php platform in category web applications Exploit Title: Multiple vulnerabilities in Xeams 4.5 Build 5755 CSRF/Stored XSS Date: 07-05-2015 Exploit Author: Marlow Tannhauser Contact: email protected Vendor Homepage: http://www.synametrics.com Software Link:...

Xeams 4.5 Build 5755 CSRF / Cross Site Scripting

Exploit Title: Multiple vulnerabilities in Xeams 4.5 Build 5755 CSRF/Stored XSS Date: 07-05-2015 Exploit Author: Marlow Tannhauser Contact: [email protected] Vendor Homepage: http://www.synametrics.com Software Link: http://web.synametrics.com/XeamsDownload.htm Version: 4.5 Build 5755...

Xeams 4.5 Build 5755 - Multiple Vulnerabilities

Xeams 4.5 Build 5755 - Multiple Vulnerabilities Exploit Title: Multiple vulnerabilities in Xeams 4.5 Build 5755 CSRF/Stored XSS Date: 07-05-2015 Exploit Author: Marlow Tannhauser Contact: [email protected] Vendor Homepage: http://www.synametrics.com Software Link:...

Xeams 4.5 Build 5755 - Multiple Vulnerabilities

Exploit Title: Multiple vulnerabilities in Xeams 4.5 Build 5755 CSRF/Stored XSS Date: 07-05-2015 Exploit Author: Marlow Tannhauser Contact: [email protected] Vendor Homepage: http://www.synametrics.com Software Link: http://web.synametrics.com/XeamsDownload.htm Version: 4.5 Build 5755...

xeams email server 4.4 build 5720 - Stored XSS

No description provided by source. !/usr/bin/python ''' Author: loneferret of Offensive Security Product: Xeams Email Server Version: 4.4 Build 5720 Vendor Site: http://www.xeams.com Timeline: 29 May 2012: Vulnerability reported to CERT 30 May 2012: Response received from CERT with disclosure dat...

CVE-2012-2569

Cross-site scripting XSS vulnerability in Synametrics Technologies Xeams 4.4 Build 5720 allows remote attackers to inject arbitrary web script or HTML via the body of an email...

Cross site scripting

Cross-site scripting XSS vulnerability in Synametrics Technologies Xeams 4.4 Build 5720 allows remote attackers to inject arbitrary web script or HTML via the body of an email...