Posted by disclosure via Fulldisclosure on Aug 06 0day Rubbish Research Team is publicly disclosing 2 vulnerabilities in Xeams 10.3 build 6449 (Synametrics

Technologies). The research is published and a proof-of-concept is available.

Vulnerability 1: Pre-authentication root RCE (CVSS 9.8, pre-authentication)

A framework-level debug write primitive in the rules engine reads an attacker-controlled MIME header,

X-SM_SAVE_BODY_4DEBUGGING, as an absolute file path and the message body as the file...