Browse CVEs

MEDIUM 6.5 CVE-2017-12071 Server-side request forgery (SSRF) vulnerability in file_upload.php in Synology Photo Station before 6.7.4-3433 and 6.3-2968 allows remote authentica… Photo Station after 6.7.3-3432 Fix from $1,6002017-09-08 HIGH 7.8 CVE-2017-11158 Multiple untrusted search path vulnerabilities in the installer in Synology Cloud Station Drive before 4.2.5-4396 on Windows allow local attackers to… Cloud Station Drive after 4.2.4-4393 Fix from $1,9502017-08-31 HIGH 7.8 CVE-2017-11157 Multiple untrusted search path vulnerabilities in the installer in Synology Cloud Station Backup before 4.2.5-4396 on Windows allow local attackers t… Cloud Station Backup after 4.2.4-4393 Fix from $1,9502017-08-30 MEDIUM 5.4 CVE-2017-9555 Cross-site scripting (XSS) vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.0-3414 allows remote attackers to inject arbi… Photo Station after 6.6.3-3347 Fix from $1,6002017-08-24 MEDIUM 6.5 CVE-2017-12074 Directory traversal vulnerability in the SYNO.DNSServer.Zone.MasterZoneConf in Synology DNS Server before 2.2.1-3042 allows remote authenticated atta… Dns Server after 2.2.0-3032 Fix from $1,6002017-08-24 HIGH 7.8 CVE-2017-11159 Multiple untrusted search path vulnerabilities in installer in Synology Photo Station Uploader before 1.4.2-084 on Windows allows local attackers to … Photo Station Uploader after 1.4.1-083 Fix from $1,9502017-08-23 HIGH 7.8 CVE-2017-11160 Multiple untrusted search path vulnerabilities in installer in Synology Assistant before 6.1-15163 on Windows allows local attackers to execute arbit… Assistant after 6.1-15030 Fix from $1,9502017-08-18 HIGH 7.8 CVE-2017-11150 Command injection vulnerability in Document.php in Synology Office 2.2.0-1502 and 2.2.1-1506 allows remote authenticated users to execute arbitrary c… Office Mitigation only Fix from $1,9502017-08-14 HIGH 7.8 CVE-2017-11156 Synology Download Station 3.8.x before 3.8.5-3475 and 3.x before 3.5-2984 uses weak permissions (0777) for ui/dlm/btsearch directory, which allows re… Download Station Mitigation only Fix from $1,9502017-08-14 MEDIUM 6.5 CVE-2017-11149 Server-side request forgery (SSRF) vulnerability in Downloader in Synology Download Station 3.8.x before 3.8.5-3475 and 3.x before 3.5-2984 allows re… Download Station Mitigation only Fix from $1,6002017-08-14 MEDIUM 5.4 CVE-2017-9556 Cross-site scripting (XSS) vulnerability in Video Metadata Editor in Synology Video Station before 2.3.0-1435 allows remote authenticated attackers t… Video Station after 2.2.1-1364 Fix from $1,6002017-08-11 MEDIUM 6.5 CVE-2017-11148 Server-side request forgery (SSRF) vulnerability in link preview in Synology Chat before 1.1.0-0806 allows remote authenticated users to access intra… Chat after 1.0.2-0159 Fix from $1,6002017-08-11 CRITICAL 9.8 CVE-2017-11151EPSS 16% A vulnerability in synotheme_upload.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to upload arbitrary files wi… Photo Station after 6.7.2-3429 Fix from $2,3002017-08-08 CRITICAL 9.8 CVE-2017-11153EPSS 12% Deserialization vulnerability in synophoto_csPhotoMisc.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to gain a… Photo Station after 6.7.2-3429 Fix from $2,3002017-08-08 HIGH 7.5 CVE-2017-11152EPSS 15% Directory traversal vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to write… Photo Station after 6.7.2-3429 Fix from $1,9502017-08-08 HIGH 7.5 CVE-2017-11155EPSS 47% An information exposure vulnerability in index.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to obtain sensiti… Photo Station after 6.7.2-3429 Fix from $1,9502017-08-08 HIGH 7.2 CVE-2017-11154EPSS 9% Unrestricted file upload vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to … Photo Station after 6.7.2-3429 Fix from $1,9502017-08-08 HIGH 7.5 CVE-2017-9553 A design flaw in SYNO.API.Encryption in Synology DiskStation Manager (DSM) before 6.1.3-15152 allows remote attackers to bypass the encryption protec… Diskstation Manager after 6.1.1-15101-4 Fix from $1,9502017-07-24 MEDIUM 5.3 CVE-2017-9554EPSS 77% An information exposure vulnerability in forget_passwd.cgi in Synology DiskStation Manager (DSM) before 6.1.3-15152 allows remote attackers to enumer… Diskstation Manager after 6.1.1-15101-4 Fix from $1,6002017-07-24 MEDIUM 5.4 CVE-2015-9102 Multiple cross-site scripting (XSS) vulnerabilities in Synology Photo Station 6.0 before 6.0-2638 and 6.3 before 6.3-2962 allow remote authenticated … Photo Station after 6.3-2960 Fix from $1,6002017-06-30 MEDIUM 5.4 CVE-2015-9103 Multiple cross-site scripting (XSS) vulnerabilities in Synology Note Station 1.1-0212 and earlier allow remote authenticated attackers to inject arbi… Note Station after 1.1-0212 Fix from $1,6002017-06-30 MEDIUM 5.4 CVE-2015-9104 Cross-site scripting (XSS) vulnerabilities in Synology Audio Station 5.1 before 5.1-2550 and 5.4 before 5.4-2857 allows remote authenticated attacker… Audio Station Mitigation only Fix from $1,6002017-06-30 MEDIUM 5.4 CVE-2015-9105 Multiple cross-site scripting (XSS) vulnerabilities in Synology Video Station 1.2 before 1.2-0455, 1.5 before 1.5-0772, and 1.6 before 1.6-0847 allow… Video Station Mitigation only Fix from $1,6002017-06-30 HIGH 7.8 CVE-2017-9552 A design flaw in authentication in Synology Photo Station 6.0-2528 through 6.7.1-3419 allows local users to obtain credentials via cmdline. Synology … Photo Station Mitigation only Fix from $1,9502017-06-13 CRITICAL 9.8 CVE-2016-10329EPSS 41% Command injection vulnerability in login.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to execute arbitrary code via shell … Photo Station after 6.5.2-3225 Fix from $2,3002017-05-12 HIGH 7.5 CVE-2016-10331 Directory traversal vulnerability in download.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to read arbitrary files via a f… Photo Station after 6.5.2-3225 Fix from $1,9502017-05-12 HIGH 7.1 CVE-2016-10330 Directory traversal vulnerability in synophoto_dsm_user, a SUID program, as used in Synology Photo Station before 6.5.3-3226 allows local users to wr… Photo Station after 6.5.2-3225 Fix from $1,9502017-05-12 HIGH 8.8 CVE-2016-10322 Synology Photo Station before 6.3-2958 allows remote authenticated guest users to execute arbitrary commands via shell metacharacters in the X-Forwar… Photo Station after 6.3-2954 Fix from $1,9502017-04-10 HIGH 7.8 CVE-2016-10323 Synology Photo Station before 6.3-2958 allows local users to gain privileges by leveraging setuid execution of a "synophoto_dsm_user --copy-no-ea" co… Photo Station 6.3-2958+ Fix from $1,9502017-04-10 HIGH 10.0 CVE-2015-6912EPSS 12% Synology Video Station before 1.5-0763 allows remote attackers to execute arbitrary shell commands via shell metacharacters in the subtitle_codepage … Video Station after 1.5-0757 Fix from $1,9502015-09-11