Cross site scripting

2017-06-3013:29:00

PRIOn knowledge base

www.prio-n.com

5.7 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

52.3%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in Synology Photo Station 6.0 before 6.0-2638 and 6.3 before 6.3-2962 allow remote authenticated attackers to inject arbitrary web script or HTML via the (1) album name, (2) file name of uploaded photos, (3) description of photos, or (4) tag of the photos.

CPENameOperatorVersion
photo_stationeq<= 6.3-2960

CPE	Name	Operator	Version
	photo_station	eq	<= 6.3-2960

References

www.fortiguard.com/zeroday/FG-VD-15-103

www.fortiguard.com/zeroday/FG-VD-15-104

www.fortiguard.com/zeroday/FG-VD-15-109

www.fortiguard.com/zeroday/FG-VD-15-112

www.synology.com/en-global/support/security/Photo_Station_6_3_2962