CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2018-19954
https://notcve.org/view.php?id=CVE-2018-19954
02 Nov 2020 — The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station. If exploited, the vulnerability could allow remote attackers to inject malicious code. This issue affects: QNAP Systems Inc. Photo Station versions prior to 5.7.11; versions prior to 6.0.10. Se ha reportado una vulnerabilidad de tipo cross-site scripting afecta a versiones anteriores de Photo Station. • https://www.qnap.com/en/security-advisory/qsa-20-11 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) •
CVSS: 9.8EPSS: 88%CPEs: 8EXPL: 3CVE-2019-7195 – QNAP Photo Station Path Traversal Vulnerability
https://notcve.org/view.php?id=CVE-2019-7195
05 Dec 2019 — This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP recommend updating Photo Station to their latest versions. Esta vulnerabilidad de control externo del nombre de archivo o de ruta permite a atacantes remotos acceder o modificar archivos del sistema. Para corregir la vulnerabilidad, QNAP recomienda actualizar Photo Station a sus últimas versiones. QNAP QTS and Photo Station version 6.0.3 suffers from a remote comm... • https://packetstorm.news/files/id/180599 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.8EPSS: 88%CPEs: 8EXPL: 3CVE-2019-7194 – QNAP Photo Station Path Traversal Vulnerability
https://notcve.org/view.php?id=CVE-2019-7194
05 Dec 2019 — This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP recommend updating Photo Station to their latest versions. Esta vulnerabilidad de control externo del nombre de archivo o de ruta permite a atacantes remotos acceder o modificar archivos del sistema. Para corregir la vulnerabilidad, QNAP recomienda actualizar Photo Station a sus últimas versiones. QNAP QTS and Photo Station version 6.0.3 suffers from a remote comm... • https://packetstorm.news/files/id/180599 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.8EPSS: 94%CPEs: 8EXPL: 5CVE-2019-7192 – QNAP Photo Station Improper Access Control Vulnerability
https://notcve.org/view.php?id=CVE-2019-7192
05 Dec 2019 — This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. To fix these vulnerabilities, QNAP recommend updating Photo Station to their latest versions. Esta vulnerabilidad de control de acceso inapropiada permite a atacantes remotos conseguir acceso no autorizado al sistema. Para corregir estas vulnerabilidades, QNAP recomienda actualizar Photo Station a sus últimas versiones. QNAP QTS and Photo Station version 6.0.3 suffers from a remote command execution... • https://packetstorm.news/files/id/180599 • CWE-863: Incorrect Authorization •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2017-12072
https://notcve.org/view.php?id=CVE-2017-12072
20 Dec 2017 — Cross-site scripting (XSS) vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.8.0-3456 allows remote authenticated users to inject arbitrary web scripts or HTML via the id parameter. Vulnerabilidad de Cross-Site Scripting (XSS) en PixlrEditorHandler.php en Synology Photo Station en versiones anteriores a la 6.8.0-3456 permite que atacantes remotos autenticados inyecten scripts web o HTML arbitrarios mediante el parámetro id. • https://www.synology.com/en-global/support/security/Synology_SA_17_80 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2017-12071
https://notcve.org/view.php?id=CVE-2017-12071
08 Sep 2017 — Server-side request forgery (SSRF) vulnerability in file_upload.php in Synology Photo Station before 6.7.4-3433 and 6.3-2968 allows remote authenticated users to download arbitrary local files via the url parameter. Una vulnerabilidad Server-Side Request Forgery (SSRF) en file_upload.php en Synology Photo Station en versiones anteriores a la 6.7.4-3433 y 6.3-2968 permite que usuarios remotos autenticados descarguen archivos locales arbitrarios mediante el parámetro url. • https://www.synology.com/en-global/support/security/Synology_SA_17_35_PhotoStation • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2017-11161
https://notcve.org/view.php?id=CVE-2017-11161
08 Sep 2017 — Multiple SQL injection vulnerabilities in Synology Photo Station before 6.7.4-3433 and 6.3-2968 allow remote attackers to execute arbitrary SQL commands via the (1) article_id parameter to label.php; or (2) type parameter to synotheme.php. Existen múltiples vulnerabilidades de inyección SQL en Synology Photo Station en versiones anteriores a la 6.7.4-3433 y 6.3-2968 que permiten que los atacantes remotos ejecuten comandos SQL arbitrarios mediante (1) el parámetro article_id en label.php; o (2) el parámetro ... • https://www.synology.com/en-global/support/security/Synology_SA_17_35_PhotoStation • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2017-11162
https://notcve.org/view.php?id=CVE-2017-11162
08 Sep 2017 — Directory traversal vulnerability in synphotoio in Synology Photo Station before 6.7.4-3433 and 6.3-2968 allows remote authenticated users to read arbitrary files via unspecified vectors. Una vulnerabilidad de salto de directorio en synphotoio en Synology Photo Station en versiones anteriores a la 6.7.4-3433 y a la 6.3-2968 permite que atacantes remotos autenticados lean archivos arbitrarios mediante vectores no especificados. • https://www.synology.com/en-global/support/security/Synology_SA_17_35_PhotoStation • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2017-9555
https://notcve.org/view.php?id=CVE-2017-9555
24 Aug 2017 — Cross-site scripting (XSS) vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.0-3414 allows remote attackers to inject arbitrary web script or HTML via the image parameter. Una vulnerabildad de tipo Cross-Site Scripting (XSS) en PixlrEditorHandler.php en Synology Photo Station en versiones anteriores a la 6.7.0-3414 permite que atacantes remotos inyecten script web o HTML arbitrario mediante el parámetro image. • https://www.synology.com/en-global/support/security/Synology_SA_17_47_Photo_Station • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 18%CPEs: 2EXPL: 2CVE-2017-11151 – Synology Photo Station 6.7.3-3432 / 6.3-2967 - Remote Code Execution
https://notcve.org/view.php?id=CVE-2017-11151
08 Aug 2017 — A vulnerability in synotheme_upload.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to upload arbitrary files without authentication via the logo_upload action. Una vulnerabilidad en synotheme_upload.php en Synology Photo Station en versiones anteriores a la 6.7.3-3432 y a la 6.3-2967 permite que atacantes remotos suban archivos arbitrarios sin autenticación mediante la acción logo_upload. Synology Photo Station versions 6.7.3-3432 and 6.3-2967 suffer from a code executi... • https://packetstorm.news/files/id/143745 • CWE-287: Improper Authentication •