Microchip Syncserver S200 vulnerabilities
7 vulnerabilities
Known vulnerabilities in Microchip Syncserver S200, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2020-9031microchipsyncserver_s100_firmware+4
EPSS score1.06%
Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow Directory Traversal via the FileName parameter to daemonlog.php.CVE-2020-9033microchipsyncserver_s100_firmware+4EPSS score1.35%
Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow Directory Traversal via the FileName parameter to authlog.php.CVE-2020-9029microchipsyncserver_s100_firmware+4EPSS score1.22%
Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow Directory Traversal via the FileName parameter to messagelog.php.CVE-2020-9032microchipsyncserver_s100_firmware+4EPSS score1.06%
Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow Directory Traversal via the FileName parameter to kernlog.php.CVE-2020-9030microchipsyncserver_s100_firmware+4EPSS score1.06%
Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow Directory Traversal via the FileName parameter to the syslog.php.CVE-2020-9034microchipsyncserver_s100_firmware+4EPSS score0.91%
Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices mishandle session validation, leading to unauthenticated creation, modification, or elimination of users.CVE-2020-9028microchipsyncserver_s100_firmware+4EPSS score0.67%
Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow stored XSS via the newUserName parameter on the "User Creation, Deletion and Password Maintenance" screen (when creating a new user).