CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2019-11825
https://notcve.org/view.php?id=CVE-2019-11825
Cross-site scripting (XSS) vulnerability in Event Editor in Synology Calendar before 2.3.0-0615 allows remote attackers to inject arbitrary web script or HTML via the title parameter. Una vulnerabilidad de tipo cross-site scripting (XSS) en el Editor de eventos en Synology Calendar anterior a versión 2.3.0-0615, permite a los atacantes remotos inyectar script web o HTML arbitrario por medio del parámetro title. • https://www.synology.com/security/advisory/Synology_SA_19_04 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2019-11820
https://notcve.org/view.php?id=CVE-2019-11820
Information exposure through process environment vulnerability in Synology Calendar before 2.3.3-0620 allows local users to obtain credentials via cmdline. La exposición a la información a través de la vulnerabilidad del entorno de procesos en Synology Calendar, versiones anteriores a 2.3.3-0620, permite a los usuarios locales obtener credenciales a través de cmdline. • https://www.synology.com/security/advisory/Synology_SA_19_21 • CWE-522: Insufficiently Protected Credentials •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-13299
https://notcve.org/view.php?id=CVE-2018-13299
Relative path traversal vulnerability in Attachment Uploader in Synology Calendar before 2.2.2-0532 allows remote authenticated users to upload arbitrary files via the filename parameter. Una vulnerabilidad de salto de directorio relativo en el actualizador de adjuntos en Synology Calendar, en versiones anteriores a la 2.2.2-0532, permite a los usuarios remotos autenticados subir archivos arbitrarios mediante el parámetro "filename". • https://www.synology.com/security/advisory/Synology_SA_18_54 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-23: Relative Path Traversal •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-8927
https://notcve.org/view.php?id=CVE-2018-8927
Improper authorization vulnerability in SYNO.Cal.Event in Calendar before 2.1.2-0511 allows remote authenticated users to create arbitrary events via the (1) cal_id or (2) original_cal_id parameter. Vulnerabilidad de autorización indebida en SYNO.Cal.Event en Calendar en versiones anteriores a la 2.1.2-0511 permite que usuarios remotos autenticados creen eventos arbitrarios mediante los parámetros (1) cal_id o (2) original_cal_id. • https://www.synology.com/en-global/support/security/Synology_SA_18_16 • CWE-863: Incorrect Authorization •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-8915
https://notcve.org/view.php?id=CVE-2018-8915
Cross-site scripting (XSS) vulnerability in Notification Center in Synology Calendar before 2.1.1-0502 allows remote authenticated users to inject arbitrary web script or HTML via title parameter. Vulnerabilidad de Cross-Site Scripting (XSS) en Notification Center en Synology Calendar en versiones anteriores a la 2.1.1-0502 permite que atacantes remotos autenticados inyecten scripts web o HTML arbitrarios mediante el parámetro title. • https://www.synology.com/en-global/support/security/Synology_SA_18_06 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •