Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 13

Export CSV
CVE-2021-47807

Sync Breeze 13.6.18 - 'Multiple' Unquoted Service Path

Sync Breeze 13.6.18 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in service binaries located in 'Program Files' directories to inject malicious executables and escalate privileges.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Flexense Syncbreeze
Products
Sync Breeze Syncbreeze Sync Breeze
CVE-2025-59901

authenticated reflected XSS vulnerability in Sync Breeze Enterprise Server

Disk Pulse Enterprise v10.4.18 has an authenticated reflected XSS vulnerability in the '/monitor_directory?sid=' endpoint, caused by insufficient validation of the 'monitor_directory' parameter sent by POST. An attacker could exploit this weakness to send malicious content to an authenticated user and steal information from their session.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Flexense
Products
Disk Pulse Enterprise Sync Breeze Enterprise Server
CVE-2020-37100

Sync Breeze Enterprise 12.4.18 - Unquoted Service Path

Sync Breeze Enterprise 12.4.18 contains an unquoted service path vulnerability that allows local attackers to execute arbitrary code with elevated system privileges. Attackers can exploit the unquoted binary path by placing malicious executables in specific file system locations to hijack the service startup process.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Flexense Syncbreeze
Products
Syncbreeze Sync Breeze
CVE-2025-59891

Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server

Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18. An authenticated user could cause another user to perform unwanted actions within the application they are logged into. This vulnerability is possible due to the lack of proper CSRF token implementation. Among other things, it is possible, using a POST request to change a user's password or create users via '/setup_login?sid=', affecting the 'username', 'password', and 'cpassword' parameters.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Flexense
Products
Disk Pulse Enterprise Diskpulse Sync Breeze Enterprise Server and 1 more
CVE-2025-59892

Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server

Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18. An authenticated user could cause another user to perform unwanted actions within the application they are logged into. This vulnerability is possible due to the lack of proper CSRF token implementation. Among other things, it is possible, using a POST request to delete commands individually via '/delete_command?sid=', using the 'cid' parameter.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Flexense
Products
Disk Pulse Enterprise Diskpulse Sync Breeze Enterprise Server and 1 more
CVE-2025-59893

Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server

Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18. An authenticated user could cause another user to perform unwanted actions within the application they are logged into. This vulnerability is possible due to the lack of proper CSRF token implementation. Among other things, it is possible, using a POST request to rename commands via '/rename_command?sid=', affecting the 'command_name' parameter.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Flexense
Products
Disk Pulse Enterprise Diskpulse Sync Breeze Enterprise Server and 1 more
CVE-2025-59894

Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server

Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18. An authenticated user could cause another user to perform unwanted actions within the application they are logged into. This vulnerability is possible due to the lack of proper CSRF token implementation. Among other things, it is possible, using a POST request to delete all commands via '/delete_all_commands?sid='.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Flexense
Products
Disk Pulse Enterprise Diskpulse Sync Breeze Enterprise Server and 1 more
CVE-2025-59895

Remote denial-of-service (DoS) vulnerability in Sync Breeze Enterprise Server

Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18 contain a remote denial-of-service (DoS) vulnerability in the configuration restore functionality. The issue is due to insufficient validation of user-supplied data during this process. An attacker could send malicious requests to alter the configuration file, causing the application to become unresponsive. In a successful scenario, the service may not recover on its own and require a complete reinstallation, as the configuration becomes corrupted and prevents the service from restarting, even manually.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Flexense
Products
Disk Pulse Enterprise Diskpulse Sync Breeze Enterprise Server and 1 more
CVE-2025-59896

Authenticated Cross-Site Scripting (XSS) vulnerability in Sync Breeze Enterprise Server

Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18 contain a persistent authenticated Cross-Site Scripting (XSS) vulnerability. An attacker could send malicious content to an authenticated user and steal information from their session due to insufficient validation of user input in '/add_command?sid=', affecting the 'command_name' parameter.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Flexense
Products
Disk Pulse Enterprise Diskpulse Sync Breeze Enterprise Server and 1 more
CVE-2025-59897

Authenticated Cross-Site Scripting (XSS) vulnerability in Sync Breeze Enterprise Server

Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18 contain a persistent authenticated Cross-Site Scripting (XSS) vulnerability. An attacker could send malicious content to an authenticated user and steal information from their session due to insufficient validation of user input in '/edit_command?sid=', affecting the 'source_dir' and ‘dest_dir’ parameters.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Flexense
Products
Disk Pulse Enterprise Diskpulse Sync Breeze Enterprise Server and 1 more
CVE-2025-59898

Authenticated Cross-Site Scripting (XSS) vulnerability in Sync Breeze Enterprise Server

Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18 contain a persistent authenticated Cross-Site Scripting (XSS) vulnerability. An attacker could send malicious content to an authenticated user and steal information from their session due to insufficient validation of user input in '/add_exclude_dir?sid=', affecting the 'exclude_dir' parameter.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Flexense
Products
Disk Pulse Enterprise Diskpulse Sync Breeze Enterprise Server and 1 more
CVE-2025-59899

Authenticated Cross-Site Scripting (XSS) vulnerability in Sync Breeze Enterprise Server

Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18 contain a persistent authenticated Cross-Site Scripting (XSS) vulnerability. An attacker could send malicious content to an authenticated user and steal information from their session due to insufficient validation of user input in  '/server_options?sid=', affecting the 'tasks_logs_dir', 'errors_logs_dir', 'error_notifications_address', 'status_notifications_address', and 'status_reports_address' parameters.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Flexense
Products
Disk Pulse Enterprise Diskpulse Sync Breeze Enterprise Server and 1 more
CVE-2025-59900

Authenticated Cross-Site Scripting (XSS) vulnerability in Sync Breeze Enterprise Server

Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18 contain a persistent authenticated Cross-Site Scripting (XSS) vulnerability. An attacker could send malicious content to an authenticated user and steal information from their session due to insufficient validation of user input in  '/server_options?sid=', affecting the 'tasks_logs_dir', 'errors_logs_dir', 'error_notifications_address', 'status_notifications_address', and 'status_reports_address' parameters.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Flexense
Products
Disk Pulse Enterprise Diskpulse Sync Breeze Enterprise Server and 1 more