Page 3 of 31 results (0.018 seconds)

CVSS: 9.8EPSS: 77%CPEs: 2EXPL: 2

CVE-2017-11153 – Synology Photo Station 6.7.3-3432 / 6.3-2967 - Remote Code Execution

https://notcve.org/view.php?id=CVE-2017-11153

08 Aug 2017 — Deserialization vulnerability in synophoto_csPhotoMisc.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to gain administrator privileges via a crafted serialized payload. Una vulnerabilidad de deserialización en synophoto_csPhotoMisc.php en Synology Photo Station en versiones anteriores a la 6.7.3-3432 y a la 6.3-2967 permite que atacantes remotos consigan privilegios de administrador mediante un payload de diseño serializado manipulado. Synology Photo Station versions 6.... • https://packetstorm.news/files/id/143745 • CWE-502: Deserialization of Untrusted Data •

CVSS: 9.8EPSS: 52%CPEs: 2EXPL: 2

CVE-2017-11151 – Synology Photo Station 6.7.3-3432 / 6.3-2967 - Remote Code Execution

https://notcve.org/view.php?id=CVE-2017-11151

08 Aug 2017 — A vulnerability in synotheme_upload.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to upload arbitrary files without authentication via the logo_upload action. Una vulnerabilidad en synotheme_upload.php en Synology Photo Station en versiones anteriores a la 6.7.3-3432 y a la 6.3-2967 permite que atacantes remotos suban archivos arbitrarios sin autenticación mediante la acción logo_upload. Synology Photo Station versions 6.7.3-3432 and 6.3-2967 suffer from a code executi... • https://packetstorm.news/files/id/143745 • CWE-287: Improper Authentication •

CVSS: 7.2EPSS: 37%CPEs: 2EXPL: 2

CVE-2017-11154 – Synology Photo Station 6.7.3-3432 / 6.3-2967 - Remote Code Execution

https://notcve.org/view.php?id=CVE-2017-11154

08 Aug 2017 — Unrestricted file upload vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to create arbitrary PHP scripts via the type parameter. Una vulnerabilidad de subida de archivos sin restricciones en PixlrEditorHandler.php en Synology Photo Station en versiones anteriores a la 6.7.3-3432 y a la 6.3-2967 permite que atacantes remotos creen scripts PHP arbitrarios mediante el parámetro type. Synology Photo Station versions 6.7.3-3432 and 6.3-2967... • https://packetstorm.news/files/id/143745 • CWE-434: Unrestricted Upload of File with Dangerous Type •

CVSS: 7.5EPSS: 36%CPEs: 2EXPL: 2

CVE-2017-11155 – Synology Photo Station 6.7.3-3432 / 6.3-2967 - Remote Code Execution

https://notcve.org/view.php?id=CVE-2017-11155

08 Aug 2017 — An information exposure vulnerability in index.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to obtain sensitive system information via unspecified vectors. Una vulnerabilidad de exposición de información en index.php en Synology Photo Station en versiones anteriores a la 6.7.3-3432 y a la 6.3-2967 permite que atacantes remotos obtengan información sensible del sistema mediante vectores sin especificar. Synology Photo Station versions 6.7.3-3432 and 6.3-2967 suffer fro... • https://packetstorm.news/files/id/143745 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-205: Observable Behavioral Discrepancy •

CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0

CVE-2015-9102

https://notcve.org/view.php?id=CVE-2015-9102

30 Jun 2017 — Multiple cross-site scripting (XSS) vulnerabilities in Synology Photo Station 6.0 before 6.0-2638 and 6.3 before 6.3-2962 allow remote authenticated attackers to inject arbitrary web script or HTML via the (1) album name, (2) file name of uploaded photos, (3) description of photos, or (4) tag of the photos. Varias vulnerabilidades de XSS (cross-site scripting) en Synology Photo Station versión 6.0 y anteriores a la 6.0-2638, versión 6.3 y anteriores a la 6.3-2962, permiten a atacantes remotos autenticados i... • http://www.fortiguard.com/zeroday/FG-VD-15-103 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 9.8EPSS: 3%CPEs: 1EXPL: 3

CVE-2016-10329

https://notcve.org/view.php?id=CVE-2016-10329

12 May 2017 — Command injection vulnerability in login.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to execute arbitrary code via shell metacharacters in the crafted 'X-Forwarded-For' header. Vulnerabilidad de inyección de comandos en login.php en Synology Photo Station en versiones anteriores a la 6.5.3-3226, que permitiría a atacantes remotos ejecutar código arbitrario a través metacaracteres de shell en una cabecera 'X-Forwarded-For' manipulada. • http://seclists.org/oss-sec/2016/q1/236 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •

CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 3

CVE-2016-10330

https://notcve.org/view.php?id=CVE-2016-10330

12 May 2017 — Directory traversal vulnerability in synophoto_dsm_user, a SUID program, as used in Synology Photo Station before 6.5.3-3226 allows local users to write to arbitrary files via unspecified vectors. Vulnerabilidad de salto de directorio en synophoto_dsm_user, un programa SUID, tal como se utiliza en Synology Photo Station en versiones anteriores a la 6.5.3-3226, permite a usuarios locales escribir en ficheros arbitrarios a través de vectores no especificados. • http://seclists.org/oss-sec/2016/q1/236 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •

CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1

CVE-2016-10331

https://notcve.org/view.php?id=CVE-2016-10331

12 May 2017 — Directory traversal vulnerability in download.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to read arbitrary files via a full pathname in the id parameter. Vulnerabilidad de salto de directorio en download.php en Synology Photo Station en versiones anteriores a la 6.5.3-3226, que permitiría a atacantes remotos leer ficheros arbitrarios a través de una ruta completa en el parámetro id. • https://bamboofox.github.io/2017/03/20/Synology-Bug-Bounty-2016/#Vul-06-Local-File-Inclusion • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •

CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1

CVE-2016-10323

https://notcve.org/view.php?id=CVE-2016-10323

10 Apr 2017 — Synology Photo Station before 6.3-2958 allows local users to gain privileges by leveraging setuid execution of a "synophoto_dsm_user --copy-no-ea" command. Synology Photo Station en versiones anteriores a 6.3-2958 permite a los usuarios locales obtener privilegios aprovechando la ejecución de setuid de un comando "synophoto_dsm_user --copy-no-ea". • http://seclists.org/oss-sec/2016/q1/236 • CWE-264: Permissions, Privileges, and Access Controls •

CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1

CVE-2016-10322

https://notcve.org/view.php?id=CVE-2016-10322

10 Apr 2017 — Synology Photo Station before 6.3-2958 allows remote authenticated guest users to execute arbitrary commands via shell metacharacters in the X-Forwarded-For HTTP header to photo/login.php. Synology Photo Station en versiones anteriores a 6.3-2958 permite a los usuarios invitados autenticados remotos ejecutar comandos arbitrarios a través de metacaracteres de shell en el encabezado HTTP X-Forwarded-For a photo/login.php. • http://seclists.org/oss-sec/2016/q1/236 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •