CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2017-16769
https://notcve.org/view.php?id=CVE-2017-16769
Exposure of private information vulnerability in Photo Viewer in Synology Photo Station 6.8.1-3458 allows remote attackers to obtain metadata from password-protected photographs via the map viewer mode. Vulnerabilidad de exposición de información privada en Photo Viewer en Synology Photo Station 6.8.1-3458 permite que atacantes remotos obtengan metadatos de fotografías protegidas con contraseña mediante el modo de vista de mapa. • https://www.synology.com/en-global/support/security/Synology_SA_17_76 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-359: Exposure of Private Personal Information to an Unauthorized Actor •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2017-12072
https://notcve.org/view.php?id=CVE-2017-12072
Cross-site scripting (XSS) vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.8.0-3456 allows remote authenticated users to inject arbitrary web scripts or HTML via the id parameter. Vulnerabilidad de Cross-Site Scripting (XSS) en PixlrEditorHandler.php en Synology Photo Station en versiones anteriores a la 6.8.0-3456 permite que atacantes remotos autenticados inyecten scripts web o HTML arbitrarios mediante el parámetro id. • https://www.synology.com/en-global/support/security/Synology_SA_17_80 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2017-12080
https://notcve.org/view.php?id=CVE-2017-12080
An information exposure vulnerability in default HTTP configuration file in Synology Photo Station before 6.8.1-3458 and before 6.3-2970 allows remote attackers to obtain sensitive system information via .htaccess file. Una vulnerabilidad de exposición de información en el archivo de configuración HTTP por defecto en Synology Photo Station en versiones anteriores a la 6.8.1-3458 y a la 6.3-2970 permite que atacantes remotos obtengan información sensible del sistema mediante el archivo .htaccess. • https://www.synology.com/en-global/support/security/Synology_SA_17_63_Photo_Station • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2017-12079
https://notcve.org/view.php?id=CVE-2017-12079
Files or directories accessible to external parties vulnerability in picasa.php in Synology Photo Station before 6.8.1-3458 and before 6.3-2970 allows remote attackers to obtain arbitrary files via prog_id field. Vulnerabilidad de archivos o directorios accesibles para terceros en picasa.php en Synology Photo Station en versiones anteriores a la 6.8.1-3458 y a la 6.3-2970 permite que atacantes remotos obtengan archivos arbitrarios mediante el campo prog_id. • https://www.synology.com/en-global/support/security/Synology_SA_17_63_Photo_Station • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-552: Files or Directories Accessible to External Parties •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2017-11162
https://notcve.org/view.php?id=CVE-2017-11162
Directory traversal vulnerability in synphotoio in Synology Photo Station before 6.7.4-3433 and 6.3-2968 allows remote authenticated users to read arbitrary files via unspecified vectors. Una vulnerabilidad de salto de directorio en synphotoio en Synology Photo Station en versiones anteriores a la 6.7.4-3433 y a la 6.3-2968 permite que atacantes remotos autenticados lean archivos arbitrarios mediante vectores no especificados. • https://www.synology.com/en-global/support/security/Synology_SA_17_35_PhotoStation • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •