Synology Photo Station Directory Traversal Vulnerability (CNVD-2017-06921)

Synology Photo Station is a solution for sharing pictures, videos and blogs over the Internet from Synology, a Chinese company. A directory traversal vulnerability exists in the download.php file in Synology Photo Station versions prior to 6.5.3-3226. A remote attacker can exploit the vulnerabili...

CVE-2016-10329

Command injection vulnerability in login.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to execute arbitrary code via shell metacharacters in the crafted 'X-Forwarded-For' header...

Directory traversal

Directory traversal vulnerability in synophotodsmuser, a SUID program, as used in Synology Photo Station before 6.5.3-3226 allows local users to write to arbitrary files via unspecified vectors...

Command injection

Command injection vulnerability in login.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to execute arbitrary code via shell metacharacters in the crafted 'X-Forwarded-For' header...

Directory traversal

Directory traversal vulnerability in download.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to read arbitrary files via a full pathname in the id parameter...

CVE-2016-10330

Directory traversal vulnerability in synophotodsmuser, a SUID program, as used in Synology Photo Station before 6.5.3-3226 allows local users to write to arbitrary files via unspecified vectors...

CVE-2016-10331

Directory traversal vulnerability in download.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to read arbitrary files via a full pathname in the id parameter...

CVE-2016-10329

Command injection vulnerability in login.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to execute arbitrary code via shell metacharacters in the crafted 'X-Forwarded-For' header...

CVE-2016-10330

Directory traversal vulnerability in synophotodsmuser, a SUID program, as used in Synology Photo Station before 6.5.3-3226 allows local users to write to arbitrary files via unspecified vectors...

CVE-2016-10331

Directory traversal vulnerability in download.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to read arbitrary files via a full pathname in the id parameter...

CVE-2016-10329

Command injection vulnerability in login.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to execute arbitrary code via shell metacharacters in the crafted 'X-Forwarded-For' header...

CVE-2016-10330

Directory traversal vulnerability in synophotodsmuser, a SUID program, as used in Synology Photo Station before 6.5.3-3226 allows local users to write to arbitrary files via unspecified vectors...

CVE-2016-10331

Directory traversal vulnerability in download.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to read arbitrary files via a full pathname in the id parameter...

CVE-2016-10330

Synology Photo Station contains a directory traversal vulnerability in the synophoto_dsm_user SUID binary. A local attacker can write to arbitrary files due to path traversal in versions prior to 6.5.3-3226. Remediation: upgrade to Photo Station 6.5.3-3226 or later.

CVE-2016-10329

Affected product: Synology Photo Station (prior to version 6.5.3-3226). Vulnerability: Command injection in login.php that allows remote attackers to execute arbitrary code through shell metacharacters in a crafted X-Forwarded-For header. Impact: Remote code execution with high risk (as noted by ...

CVE-2016-10331

The vulnerability CVE-2016-10331 affects Synology Photo Station before version 6.5.3-3226. A directory traversal flaw exists in download.php that allows remote attackers to read arbitrary files by supplying a full pathname in the id parameter, due to improper path handling. The issue is confirmed...

CVE-2016-10330: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in synophotodsmuser, a SUID program, as used in Synology Photo Station before 6.5.3-3226 allows local users to write to arbitrary files via unspecified vectors...

PT-2017-7868

Name of the Vulnerable Software and Affected Versions Synology Photo Station versions prior to 6.5.3-3226 Description The issue allows remote attackers to read arbitrary files via a full pathname in the id parameter in the "download.php" file. Recommendations For versions prior to 6.5.3-3226,...

PT-2017-7867

Name of the Vulnerable Software and Affected Versions Synology Photo Station versions prior to 6.5.3-3226 Description A directory traversal issue exists, allowing local users to write to arbitrary files. Recommendations For versions prior to 6.5.3-3226, update to version 6.5.3-3226 or later to...

PT-2017-7866

Name of the Vulnerable Software and Affected Versions Synology Photo Station versions prior to 6.5.3-3226 Description A command injection issue exists, allowing remote attackers to execute arbitrary code by including shell metacharacters in a crafted X-Forwarded-For header. Recommendations For...