Secunia

Two vulnerabilities have been identified in P-Synch Total Password Management Solution, allowing malicious people to conduct Cross Site Scripting and to see the physical installation path.

By requesting "psynch/nph-psa.exe?lang=" the physical path is returned as part of the error message.

It is possible to conduct Cross Site Scripting in two ways:
Traditional:
psynch/nph-psf.exe?css="><malicious_script_or_html>
Including a remote file:
psynch/nph-psf.exe?css=http://somesite/file

Solution
Use a firewall or proxy server with URL filtering capabilities to filter malicious requests.
Further details available in Customer Area

Provided and/or discovered by
JeiAr of GulfTech Computers

Changelog
Further details available in Customer Area

Deep Links
Links available in Customer Area