CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2018-19954
https://notcve.org/view.php?id=CVE-2018-19954
02 Nov 2020 — The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station. If exploited, the vulnerability could allow remote attackers to inject malicious code. This issue affects: QNAP Systems Inc. Photo Station versions prior to 5.7.11; versions prior to 6.0.10. Se ha reportado una vulnerabilidad de tipo cross-site scripting afecta a versiones anteriores de Photo Station. • https://www.qnap.com/en/security-advisory/qsa-20-11 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) •
CVSS: 9.8EPSS: 88%CPEs: 8EXPL: 3CVE-2019-7195 – QNAP Photo Station Path Traversal Vulnerability
https://notcve.org/view.php?id=CVE-2019-7195
05 Dec 2019 — This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP recommend updating Photo Station to their latest versions. Esta vulnerabilidad de control externo del nombre de archivo o de ruta permite a atacantes remotos acceder o modificar archivos del sistema. Para corregir la vulnerabilidad, QNAP recomienda actualizar Photo Station a sus últimas versiones. QNAP QTS and Photo Station version 6.0.3 suffers from a remote comm... • https://packetstorm.news/files/id/180599 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.8EPSS: 88%CPEs: 8EXPL: 3CVE-2019-7194 – QNAP Photo Station Path Traversal Vulnerability
https://notcve.org/view.php?id=CVE-2019-7194
05 Dec 2019 — This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP recommend updating Photo Station to their latest versions. Esta vulnerabilidad de control externo del nombre de archivo o de ruta permite a atacantes remotos acceder o modificar archivos del sistema. Para corregir la vulnerabilidad, QNAP recomienda actualizar Photo Station a sus últimas versiones. QNAP QTS and Photo Station version 6.0.3 suffers from a remote comm... • https://packetstorm.news/files/id/180599 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.8EPSS: 94%CPEs: 8EXPL: 5CVE-2019-7192 – QNAP Photo Station Improper Access Control Vulnerability
https://notcve.org/view.php?id=CVE-2019-7192
05 Dec 2019 — This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. To fix these vulnerabilities, QNAP recommend updating Photo Station to their latest versions. Esta vulnerabilidad de control de acceso inapropiada permite a atacantes remotos conseguir acceso no autorizado al sistema. Para corregir estas vulnerabilidades, QNAP recomienda actualizar Photo Station a sus últimas versiones. QNAP QTS and Photo Station version 6.0.3 suffers from a remote command execution... • https://packetstorm.news/files/id/180599 • CWE-863: Incorrect Authorization •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2018-0722
https://notcve.org/view.php?id=CVE-2018-0722
01 Feb 2019 — Path Traversal vulnerability in Photo Station versions: 5.7.2 and earlier in QTS 4.3.4, 5.4.4 and earlier in QTS 4.3.3, 5.2.8 and earlier in QTS 4.2.6 could allow remote attackers to access sensitive information on the device. Existe una vulnerabilidad de salto de directorio en las siguientes versiones de Photo Station que podría permitir a los atacantes remotos acceder a información sensible en el dispositivo: 5.72 y anteriores en QTS 4.3.4, 5.44 y anteriores en QTS 4.3.3 y 5.28 y anteriores en QTS 4.2.6. • https://www.qnap.com/zh-tw/security-advisory/nas-201901-14 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.1EPSS: 3%CPEs: 1EXPL: 2CVE-2018-0715 – QNAP Photo Station 5.7.0 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2018-0715
27 Aug 2018 — Cross-site scripting vulnerability in QNAP Photo Station versions 5.7.0 and earlier could allow remote attackers to inject Javascript code in the compromised application. Vulnerabilidad Cross-Site Scripting (XSS) en QNAP Photo Station en versiones 5.7.0 y anteriores podría permitir que atacantes remotos inyecten código JavaScript en la aplicación comprometida. QNAP Photo Station version 5.7.0 suffers from a cross site scripting vulnerability. • https://packetstorm.news/files/id/149273 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2017-13073
https://notcve.org/view.php?id=CVE-2017-13073
23 Apr 2018 — Cross-site scripting (XSS) vulnerability in QNAP NAS application Photo Station versions 5.2.7, 5.4.3, and their earlier versions could allow remote attackers to inject arbitrary web script or HTML. Vulnerabilidad Cross-Site Scripting (XSS) en la aplicación Photo Station de QNAP NAS, en versiones 5.2.7, 5.4.3 y anteriores, permite que los atacantes remotos inyecten scripts web o HTML arbitrarios. • https://www.qnap.com/zh-tw/security-advisory/nas-201804-23 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2017-12072
https://notcve.org/view.php?id=CVE-2017-12072
20 Dec 2017 — Cross-site scripting (XSS) vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.8.0-3456 allows remote authenticated users to inject arbitrary web scripts or HTML via the id parameter. Vulnerabilidad de Cross-Site Scripting (XSS) en PixlrEditorHandler.php en Synology Photo Station en versiones anteriores a la 6.8.0-3456 permite que atacantes remotos autenticados inyecten scripts web o HTML arbitrarios mediante el parámetro id. • https://www.synology.com/en-global/support/security/Synology_SA_17_80 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2017-12071
https://notcve.org/view.php?id=CVE-2017-12071
08 Sep 2017 — Server-side request forgery (SSRF) vulnerability in file_upload.php in Synology Photo Station before 6.7.4-3433 and 6.3-2968 allows remote authenticated users to download arbitrary local files via the url parameter. Una vulnerabilidad Server-Side Request Forgery (SSRF) en file_upload.php en Synology Photo Station en versiones anteriores a la 6.7.4-3433 y 6.3-2968 permite que usuarios remotos autenticados descarguen archivos locales arbitrarios mediante el parámetro url. • https://www.synology.com/en-global/support/security/Synology_SA_17_35_PhotoStation • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2017-11161
https://notcve.org/view.php?id=CVE-2017-11161
08 Sep 2017 — Multiple SQL injection vulnerabilities in Synology Photo Station before 6.7.4-3433 and 6.3-2968 allow remote attackers to execute arbitrary SQL commands via the (1) article_id parameter to label.php; or (2) type parameter to synotheme.php. Existen múltiples vulnerabilidades de inyección SQL en Synology Photo Station en versiones anteriores a la 6.7.4-3433 y 6.3-2968 que permiten que los atacantes remotos ejecuten comandos SQL arbitrarios mediante (1) el parámetro article_id en label.php; o (2) el parámetro ... • https://www.synology.com/en-global/support/security/Synology_SA_17_35_PhotoStation • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •