Synametrics develops a focused line of administrative and messaging software products including SynaMan, Xeams, Syncrify, and SynTail, positioned for enterprise email gateway, file-transfer, and log-management use cases. Its vulnerability profile clusters around web-application and authorization-control weaknesses such as cross-site request forgery, cross-site scripting, and privilege-management flaws that recur across its product portfolio and reflect the user-facing and permission-sensitive nature of these tools. Public exploit code becomes available with notable frequency for vulnerabilities in this vendor's products. Current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Synametrics over time
Signals from CVEs in this vendor scope (8 CVEs).
8 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2018-10814HIGH Synametrics SynaMan 4.0 build 1488 uses cleartext password storage for SMTP credentials. | Sep 14, 2018 | 7.8 | 35 | NO | YES |
CVE-2015-3140HIGH Multiple cross-site request forgery (CSRF) vulnerabilities in Synametrics Technologies SynaMan before 3.5 Build 1451, Syncrify before 3.7 Build 856, and SynTail before 1.5 Build 56 | Nov 21, 2019 | 8.8 | 31 | NO | YES |
CVE-2018-10763MEDIUM Multiple cross-site scripting (XSS) vulnerabilities in Synametrics SynaMan 4.0 build 1488 via the (1) Main heading or (2) Sub heading fields in the Partial Branding configuration p | Sep 14, 2018 | 4.8 | 28 | NO | YES |
CVE-2022-26251HIGH The HTTP interface of Synaman v5.1 and below was discovered to allow authenticated attackers to execute arbitrary code and escalate privileges. | Apr 6, 2022 | 7.2 | 27 | NO | NO |
CVE-2022-26250HIGH Synaman v5.1 and below was discovered to contain weak file permissions which allows authenticated attackers to escalate privileges. | Apr 6, 2022 | 7.8 | 27 | NO | NO |
CVE-2015-3141MEDIUM Multiple cross-site request forgery (CSRF) vulnerabilities in Synametrics Technologies Xeams 4.5 Build 5755 and earlier allow remote attackers to hijack the authentication of admin | May 20, 2015 | 6.8 | 27 | NO | YES |
CVE-2022-22828HIGH An insecure direct object reference for the file-download URL in Synametrics SynaMan before 5.0 allows a remote attacker to access unshared files via a modified base64-encoded file | Jan 27, 2022 | 7.5 | 25 | NO | NO |
CVE-2012-2569MEDIUM Cross-site scripting (XSS) vulnerability in Synametrics Technologies Xeams 4.4 Build 5720 allows remote attackers to inject arbitrary web script or HTML via the body of an email. | Jun 19, 2014 | 4.3 | 25 | NO | YES |
Signals from CVEs in this vendor scope (8 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Synametrics.
Media articles that mention a CVE ID that affects a product developed by Synametrics — matched by CVE ID, not by vendor name.