Synology Photo_station
20 CVEs affecting Synology Photo_station. Latest disclosed: 2017-12-20. Critical: 4, High: 9.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-11161 | Critical | 9.8 | 2017-09-08 | Multiple SQL injection vulnerabilities in Synology Photo Station before 6.7.4-3433 and 6.3-2968 allow remote attackers to execute arbitrary SQL commands via th… |
CVE-2017-11153 | Critical | 9.8 | 2017-08-08 | Deserialization vulnerability in synophoto_csPhotoMisc.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to gain administrat… |
CVE-2017-11151 | Critical | 9.8 | 2017-08-08 | A vulnerability in synotheme_upload.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to upload arbitrary files without auth… |
CVE-2016-10329 | Critical | 9.8 | 2017-05-12 | Command injection vulnerability in login.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to execute arbitrary code via shell metacharac… |
CVE-2016-10322 | High | 8.8 | 2017-04-10 | Synology Photo Station before 6.3-2958 allows remote authenticated guest users to execute arbitrary commands via shell metacharacters in the X-Forwarded-For HT… |
CVE-2017-9552 | High | 7.8 | 2017-06-13 | A design flaw in authentication in Synology Photo Station 6.0-2528 through 6.7.1-3419 allows local users to obtain credentials via cmdline. Synology Photo Stat… |
CVE-2016-10323 | High | 7.8 | 2017-04-10 | Synology Photo Station before 6.3-2958 allows local users to gain privileges by leveraging setuid execution of a "synophoto_dsm_user --copy-no-ea" command. |
CVE-2017-12079 | High | 7.5 | 2017-12-04 | Files or directories accessible to external parties vulnerability in picasa.php in Synology Photo Station before 6.8.1-3458 and before 6.3-2970 allows remote a… |
CVE-2017-11155 | High | 7.5 | 2017-08-08 | An information exposure vulnerability in index.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to obtain sensitive system… |
CVE-2017-11152 | High | 7.5 | 2017-08-08 | Directory traversal vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to write arbitrary… |
CVE-2016-10331 | High | 7.5 | 2017-05-12 | Directory traversal vulnerability in download.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to read arbitrary files via a full pathna… |
CVE-2017-11154 | High | 7.2 | 2017-08-08 | Unrestricted file upload vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to create arb… |
CVE-2016-10330 | High | 7.1 | 2017-05-12 | Directory traversal vulnerability in synophoto_dsm_user, a SUID program, as used in Synology Photo Station before 6.5.3-3226 allows local users to write to arb… |
CVE-2017-12071 | Medium | 6.5 | 2017-09-08 | Server-side request forgery (SSRF) vulnerability in file_upload.php in Synology Photo Station before 6.7.4-3433 and 6.3-2968 allows remote authenticated users… |
CVE-2017-11162 | Medium | 6.5 | 2017-09-08 | Directory traversal vulnerability in synphotoio in Synology Photo Station before 6.7.4-3433 and 6.3-2968 allows remote authenticated users to read arbitrary fi… |
CVE-2017-12072 | Medium | 5.4 | 2017-12-20 | Cross-site scripting (XSS) vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.8.0-3456 allows remote authenticated users to inject arbi… |
CVE-2017-9555 | Medium | 5.4 | 2017-08-24 | Cross-site scripting (XSS) vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.0-3414 allows remote attackers to inject arbitrary web… |
CVE-2015-9102 | Medium | 5.4 | 2017-06-30 | Multiple cross-site scripting (XSS) vulnerabilities in Synology Photo Station 6.0 before 6.0-2638 and 6.3 before 6.3-2962 allow remote authenticated attackers… |
CVE-2017-12080 | Medium | 5.3 | 2017-12-04 | An information exposure vulnerability in default HTTP configuration file in Synology Photo Station before 6.8.1-3458 and before 6.3-2970 allows remote attacker… |
CVE-2015-4656 | | 2015-06-18 | Multiple cross-site scripting (XSS) vulnerabilities in Synology Photo Station before 6.3-2945 allow remote attackers to inject arbitrary web script or HTML via… |