CVE-2015-9102

Multiple cross-site scripting XSS vulnerabilities in Synology Photo Station 6.0 before 6.0-2638 and 6.3 before 6.3-2962 allow remote authenticated attackers to inject arbitrary web script or HTML via the 1 album name, 2 file name of uploaded photos, 3 description of photos, or 4 tag of the photos...

CVE-2015-9102

Affected product: Synology Photo Station. Vulnerability: Multiple cross-site scripting (XSS) vulnerabilities that allow remote authenticated attackers to inject arbitrary web script or HTML via (1) album name, (2) photo filename, (3) photo description, or (4) photo tag. Versions affected: Photo S...

Synology Photo Station Design Flaw Vulnerability

Synology Photo Station is a solution for sharing pictures, videos and blogs over the Internet from Synology, a Chinese company. A security vulnerability exists in the authentication in Synology Photo Station versions 6.0-2528 through 6.7.1-3419. A local attacker can exploit the vulnerability to...

Default credentials

A design flaw in authentication in Synology Photo Station 6.0-2528 through 6.7.1-3419 allows local users to obtain credentials via cmdline. Synology Photo Station employs the synophotodsmuser program to authenticate username and password by "synophotodsmuser --auth USERNAME PASSWORD", and local...

CVE-2017-9552

A design flaw in authentication in Synology Photo Station 6.0-2528 through 6.7.1-3419 allows local users to obtain credentials via cmdline. Synology Photo Station employs the synophotodsmuser program to authenticate username and password by "synophotodsmuser --auth USERNAME PASSWORD", and local...

CVE-2017-9552

A design flaw in authentication in Synology Photo Station 6.0-2528 through 6.7.1-3419 allows local users to obtain credentials via cmdline. Synology Photo Station employs the synophotodsmuser program to authenticate username and password by "synophotodsmuser --auth USERNAME PASSWORD", and local...

CVE-2017-9552

CVE-2017-9552 concerns Synology Photo Station 6.0-2528 through 6.7.1-3419, where a design flaw in the authentication process allows local users to obtain credentials via the synophoto_dsm_user authentication flow and by sniffing /proc/*/cmdline. The vulnerability stems from how credentials are ha...

CVE-2017-9552

A design flaw in authentication in Synology Photo Station 6.0-2528 through 6.7.1-3419 allows local users to obtain credentials via cmdline. Synology Photo Station employs the synophotodsmuser program to authenticate username and password by "synophotodsmuser --auth USERNAME PASSWORD", and local...

Synology Photo Station Command Injection Vulnerability

Synology Photo Station is a solution for sharing pictures, videos and blogs over the Internet from Synology, a Chinese company. A command injection vulnerability exists in the login.php file in Synology Photo Station versions prior to 6.5.3-3226. A remote attacker can exploit the vulnerability to...

Synology Photo Station Directory Traversal Vulnerability

Synology Photo Station is a solution for sharing pictures, videos and blogs over the Internet from Synology, a Chinese company. A directory traversal vulnerability exists in synophotodsmuser used in Synology Photo Station versions prior to 6.5.3-3226. A local attacker can exploit the vulnerabilit...

Synology Photo Station Directory Traversal Vulnerability (CNVD-2017-06921)

Synology Photo Station is a solution for sharing pictures, videos and blogs over the Internet from Synology, a Chinese company. A directory traversal vulnerability exists in the download.php file in Synology Photo Station versions prior to 6.5.3-3226. A remote attacker can exploit the vulnerabili...

Command injection

Command injection vulnerability in login.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to execute arbitrary code via shell metacharacters in the crafted 'X-Forwarded-For' header...

Directory traversal

Directory traversal vulnerability in download.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to read arbitrary files via a full pathname in the id parameter...

CVE-2016-10331

Directory traversal vulnerability in download.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to read arbitrary files via a full pathname in the id parameter...

CVE-2016-10330

Directory traversal vulnerability in synophotodsmuser, a SUID program, as used in Synology Photo Station before 6.5.3-3226 allows local users to write to arbitrary files via unspecified vectors...

CVE-2016-10331

Directory traversal vulnerability in download.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to read arbitrary files via a full pathname in the id parameter...

CVE-2016-10329

Command injection vulnerability in login.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to execute arbitrary code via shell metacharacters in the crafted 'X-Forwarded-For' header...

CVE-2016-10330

Directory traversal vulnerability in synophotodsmuser, a SUID program, as used in Synology Photo Station before 6.5.3-3226 allows local users to write to arbitrary files via unspecified vectors...

Directory traversal

Directory traversal vulnerability in synophotodsmuser, a SUID program, as used in Synology Photo Station before 6.5.3-3226 allows local users to write to arbitrary files via unspecified vectors...

CVE-2016-10329

Command injection vulnerability in login.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to execute arbitrary code via shell metacharacters in the crafted 'X-Forwarded-For' header...