CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2017-16774
https://notcve.org/view.php?id=CVE-2017-16774
Cross-site scripting (XSS) vulnerability in SYNO.Core.PersonalNotification.Event in Synology DiskStation Manager (DSM) before 6.1.4-15217-3 allows remote authenticated users to inject arbitrary web script or HTML via the package parameter. Una vulnerabilidad de Cross-Site Scripting (XSS) en SYNO.Core.PersonalNotification.Event en Synology DiskStation Manager (DSM), en versiones anteriores a la 6.1.4-15217-3, permite a los usuarios remotos autenticados inyectar scripts web o HTML arbitrarios mediante el parámetro "package". • https://www.synology.com/security/advisory/Synology_SA_18_26 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2018-8913
https://notcve.org/view.php?id=CVE-2018-8913
Missing custom error page vulnerability in Synology Web Station before 2.1.3-0139 allows remote attackers to conduct phishing attacks via a crafted URL. Una vulnerabilidad de ausencia de página de error personalizado en Synology Web Station, en versiones 2.1.3-0139, permite a los atacantes remotos realizar ataques de phishing mediante una URL manipulada • https://www.synology.com/security/advisory/Synology_SA_18_29 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') CWE-756: Missing Custom Error Page •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-8917
https://notcve.org/view.php?id=CVE-2018-8917
Cross-site scripting (XSS) vulnerability in info.cgi in Synology DiskStation Manager (DSM) before 6.1.6-15266 allows remote attackers to inject arbitrary web script or HTML via the host parameter. Vulnerabilidad Cross-Site Scripting (XSS) en info.cgi en Synology DiskStation Manager (DSM) en versiones anteriores a la 6.1.6-15266 permite que atacantes remotos inyecten scripts web o HTML arbitrarios mediante el parámetro host. • https://www.synology.com/security/advisory/Synology_SA_18_14 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0CVE-2018-8920
https://notcve.org/view.php?id=CVE-2018-8920
Improper neutralization of escape vulnerability in Log Exporter in Synology DiskStation Manager (DSM) before 6.1.6-15266 allows remote attackers to inject arbitrary content to have an unspecified impact by exporting an archive in CSV format. Neutralización incorrecta de la vulnerabilidad de escapado en Log Exporter en Synology DiskStation Manager (DSM) en versiones anteriores a la 6.1.6-15266 permite que atacantes remotos inyecten contenido arbitrario para que cause un impacto sin especificar al exportar un archivo en formato CSV. • https://www.synology.com/security/advisory/Synology_SA_18_14 • CWE-116: Improper Encoding or Escaping of Output •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-8919
https://notcve.org/view.php?id=CVE-2018-8919
Information exposure vulnerability in SYNO.Core.Desktop.SessionData in Synology DiskStation Manager (DSM) before 6.1.6-15266 allows remote attackers to steal credentials via unspecified vectors. Vulnerabilidad de exposición de información en SYNO.Core.Desktop.SessionData en Synology DiskStation Manager (DSM) en versiones anteriores a la 6.1.6-15266 permite que atacantes remotos roben credenciales mediante vectores sin especificar. • https://www.synology.com/security/advisory/Synology_SA_18_14 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •