CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 1CVE-2017-11152 – Synology Photo Station 6.7.3-3432 / 6.3-2967 - Remote Code Execution
https://notcve.org/view.php?id=CVE-2017-11152
Directory traversal vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to write arbitrary files via the path parameter. Una vulnerabilidad de salto de directorio en PixlrEditorHandler.php en Synology Photo Station en versiones anteriores a la 6.7.3-3432 y a la 6.3-2967 permite que atacantes remotos escriban archivos arbitrarios mediante el parámetro path. Synology Photo Station versions 6.7.3-3432 and 6.3-2967 suffer from a code execution vulnerability. • https://www.exploit-db.com/exploits/42434 https://www.synology.com/en-global/support/security/Synology_SA_17_34_PhotoStation • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 5.3EPSS: 3%CPEs: 1EXPL: 3CVE-2017-9554 – Synology DiskStation Manager (DSM) < 6.1.3-15152 - 'forget_passwd.cgi' User Enumeration
https://notcve.org/view.php?id=CVE-2017-9554
An information exposure vulnerability in forget_passwd.cgi in Synology DiskStation Manager (DSM) before 6.1.3-15152 allows remote attackers to enumerate valid usernames via unspecified vectors. Una vulnerabilidad de exposición de información en el archivo forget_passwd.cgi en Synology DiskStation Manager (DSM) anterior a la versión 6.1.3-15152, permite a los atacantes remotos enumerar nombres de usuario válidos por medio de vectores no especificados. Synology DiskStation Manager (DMS) versions prior to 6.1.3-15152 suffer from a forget_passwd.cgi user enumeration vulnerability. • https://www.exploit-db.com/exploits/43455 https://github.com/rfcl/Synology-DiskStation-User-Enumeration-CVE-2017-9554- https://github.com/Ez0-yf/CVE-2017-9554-Exploit-Tool https://www.synology.com/en-global/support/security/Synology_SA_17_29_DSM • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2017-9553
https://notcve.org/view.php?id=CVE-2017-9553
A design flaw in SYNO.API.Encryption in Synology DiskStation Manager (DSM) before 6.1.3-15152 allows remote attackers to bypass the encryption protection mechanism via the crafted version parameter. Un fallo de diseño en el archivo SYNO.API.Encryption en Synology DiskStation Manager (DSM) anterior a versión 6.1.3-15152 permite a los atacantes remotos omitir el mecanismo de protección de encriptación mediante el parámetro de versión creado. • https://www.2-sec.com/2017/06/2-secs-expert-team-uncovers-new-vulnerability-popular-synology-nas-device https://www.synology.com/en-global/support/security/Synology_SA_17_29_DSM •
CVSS: 5.4EPSS: 0%CPEs: 7EXPL: 0CVE-2015-9104
https://notcve.org/view.php?id=CVE-2015-9104
Cross-site scripting (XSS) vulnerabilities in Synology Audio Station 5.1 before 5.1-2550 and 5.4 before 5.4-2857 allows remote authenticated attackers to inject arbitrary web script or HTML via the album title. Vulnerabilidades de tipo cross-site scripting (XSS) en Synology Audio Station versión 5.1 y anteriores a la 5.1-2550, versión 5.4 y anteriores a la 5.4-2857, permiten a atacantes remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios a través del título del álbum. • http://www.fortiguard.com/zeroday/FG-VD-15-106 https://www.synology.com/en-global/support/security/Audio_Station_5_4_2857 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2015-9102
https://notcve.org/view.php?id=CVE-2015-9102
Multiple cross-site scripting (XSS) vulnerabilities in Synology Photo Station 6.0 before 6.0-2638 and 6.3 before 6.3-2962 allow remote authenticated attackers to inject arbitrary web script or HTML via the (1) album name, (2) file name of uploaded photos, (3) description of photos, or (4) tag of the photos. Varias vulnerabilidades de XSS (cross-site scripting) en Synology Photo Station versión 6.0 y anteriores a la 6.0-2638, versión 6.3 y anteriores a la 6.3-2962, permiten a atacantes remotos autenticados inyectar secuencias de comandos web o HTML a través del (1) nombre del álbum (2) nombre de las imágenes subidas, (3) descripción de fotos, o (4) etiqueta de las fotos. • http://www.fortiguard.com/zeroday/FG-VD-15-103 http://www.fortiguard.com/zeroday/FG-VD-15-104 http://www.fortiguard.com/zeroday/FG-VD-15-109 http://www.fortiguard.com/zeroday/FG-VD-15-112 https://www.synology.com/en-global/support/security/Photo_Station_6_3_2962 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •