Unrestricted file upload

Unrestricted file upload vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to create arbitrary PHP scripts via the type parameter...

Directory traversal

Directory traversal vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to write arbitrary files via the path parameter...

Deserialization of untrusted data

Deserialization vulnerability in synophotocsPhotoMisc.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to gain administrator privileges via a crafted serialized payload...

CVE-2017-11155

CVE-2017-11155 affects Synology Photo Station and is described as an information-disclosure vulnerability in index.php present in versions prior to 6.7.3-3432 and 6.3-2967. Remote attackers could obtain sensitive system information via unspecified vectors. The connected sources document this CVE ...

CVE-2017-11151

CVE-2017-11151 affects Synology Photo Station. A vulnerability in synotheme_upload.php allows remote attackers to upload arbitrary files without authentication via the logo_upload action, exposing a path to remote code execution. Affected versions are Photo Station before 6.7.3-3432 and 6.3-2967....

CVE-2017-11154

Unrestricted file upload vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to create arbitrary PHP scripts via the type parameter...

CVE-2017-11152

CVE-2017-11152 is a directory traversal vulnerability in Synology Photo Station (PixlrEditorHandler.php) affecting versions prior to 6.7.3-3432 and 6.3-2967, enabling remote attackers to write arbitrary files via the path parameter. Connected sources describe a broader 4-vulnerability chain (CVE-...

CVE-2017-11153

CVE-2017-11153 is a deserialization vulnerability in Synology Photo Station (affecting versions prior to 6.7.3-3432 and 6.3-2967) that allows remote attackers to gain administrator privileges via a crafted serialized payload in synophoto_csPhotoMisc.php. The issue is part of a multi-vulnerability...

CVE-2017-11152

Directory traversal vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to write arbitrary files via the path parameter...

CVE-2017-11154

Affected product: Synology Photo Station. Vulnerability: Unrestricted file upload in PixlrEditorHandler.php that allows remote attackers to create arbitrary PHP scripts via the type parameter. Affected versions: before 6.7.3-3432 and before 6.3-2967. Root cause: file upload handler permits uncont...

CVE-2017-11155

An information exposure vulnerability in index.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to obtain sensitive system information via unspecified vectors...

CVE-2017-11151

A vulnerability in synothemeupload.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to upload arbitrary files without authentication via the logoupload action...

Synology Photo Station Unauthenticated Remote Code Execution

Vulnerability Summary The following advisory describes a Remote Code Execution found in Synology Photo Station versions 6.7.3-3432 and earlier / 6.3-2967 and earlier. Personal Photo Station is an online photo album with blog owned and managed by a DSM user. Synology NAS provides the home/photo...

Synology Photo Station 6.7.3-3432 6.3-2967 - Remote Code Execution

Synology Photo Station 6.7.3-3432 6.3-2967 - Remote Code Execution ''' Source: https://blogs.securiteam.com/index.php/archives/3356 Vulnerability details The remote code execution is a combination of 4 different vulnerabilities: Upload arbitrary files to the specified directories Log in with a fa...

Synology Photo Station 6.7.3-3432 / 6.3-2967 Remote Code Execution

''' Source: https://blogs.securiteam.com/index.php/archives/3356 Vulnerability details The remote code execution is a combination of 4 different vulnerabilities: Upload arbitrary files to the specified directories Log in with a fake authentication mechanism Log in to Photo Station with any identi...

Synology Photo Station 6.7.3-3432 / 6.3-2967 - Remote Code Execution

''' Source: https://blogs.securiteam.com/index.php/archives/3356 Vulnerability details The remote code execution is a combination of 4 different vulnerabilities: Upload arbitrary files to the specified directories Log in with a fake authentication mechanism Log in to Photo Station with any identi...

Synology Photo Station Arbitrary File Download Vulnerability

Synology Photo Station is a Synology solution for sharing pictures, videos and blogs over the Internet. A server-side request forgery vulnerability exists in the fileupload.php file in Synology Photo Station versions prior to 6.7.4-3433 and 6.3-2968. A remote attacker can exploit the vulnerabilit...

Synology Photo Station Cross-Site Scripting Vulnerability

Synology Photo Station is a solution for sharing pictures, videos and blogs over the Internet from Synology, a Chinese company. A cross-site scripting vulnerability exists in Synology Photo Station. The vulnerability can be exploited by remote attackers to inject arbitrary web script or HTML via...

CVE-2015-9102

Multiple cross-site scripting XSS vulnerabilities in Synology Photo Station 6.0 before 6.0-2638 and 6.3 before 6.3-2962 allow remote authenticated attackers to inject arbitrary web script or HTML via the 1 album name, 2 file name of uploaded photos, 3 description of photos, or 4 tag of the photos...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Synology Photo Station 6.0 before 6.0-2638 and 6.3 before 6.3-2962 allow remote authenticated attackers to inject arbitrary web script or HTML via the 1 album name, 2 file name of uploaded photos, 3 description of photos, or 4 tag of the photos...