Sync In
Monthly
Username enumeration via observable timing discrepancy affects Sync-in Server versions prior to 2.2.0, exposing valid account names to unauthenticated remote attackers through a logic flaw in the /api/auth/login endpoint. The authentication handler short-circuits immediately when a submitted username does not exist in the database, producing responses averaging 95-100ms, while valid usernames that proceed to password hashing return in approximately 350-400ms - a 250-300ms gap measurable by automated tooling. No confirmed active exploitation (not in CISA KEV), but SSVC classifies this as automatable with a publicly validated proof-of-concept technique (TickTock Enum via Burp Suite); EPSS at 0.14% (34th percentile) suggests limited observed exploitation activity to date.
vulnerability in Sync-in Server versions up to 1.9.3 is affected by cross-site scripting (xss) (CVSS 6.1).
Directory traversal vulnerability in Sync In server thru 1.1.1 allowing authenticated attackers to gain read and write access to the system via FilesManager.saveMultipart function in. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Username enumeration via observable timing discrepancy affects Sync-in Server versions prior to 2.2.0, exposing valid account names to unauthenticated remote attackers through a logic flaw in the /api/auth/login endpoint. The authentication handler short-circuits immediately when a submitted username does not exist in the database, producing responses averaging 95-100ms, while valid usernames that proceed to password hashing return in approximately 350-400ms - a 250-300ms gap measurable by automated tooling. No confirmed active exploitation (not in CISA KEV), but SSVC classifies this as automatable with a publicly validated proof-of-concept technique (TickTock Enum via Burp Suite); EPSS at 0.14% (34th percentile) suggests limited observed exploitation activity to date.
vulnerability in Sync-in Server versions up to 1.9.3 is affected by cross-site scripting (xss) (CVSS 6.1).
Directory traversal vulnerability in Sync In server thru 1.1.1 allowing authenticated attackers to gain read and write access to the system via FilesManager.saveMultipart function in. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.