CVE-2016-10329: Improper Neutralization of Special Elements used in a Command

Command injection vulnerability in login.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to execute arbitrary code via shell metacharacters in the crafted 'X-Forwarded-For' header...

CVE-2016-10331: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in download.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to read arbitrary files via a full pathname in the id parameter...

QNAP Photo Station and Music Station Authentication Bypass Vulnerability

QNAP Photo Station, Music Station is an application that displays photos and music stored in all shared folders. An authentication bypass vulnerability exists in QNAP Photo Station version 5.2.4 and Music Station version 4.8.4. The vulnerability allows attackers to bypass authentication to enter...

VulnCheck KEV: CVE-2017-20210

Photo Station 5.4.1 & 5.2.7 include the security fix for the vulnerability related to the XMR mining programs identified by internal research...

Synology Photo Station Security Bypass Vulnerability

Synology Photo Station is a Synology solution for sharing pictures, videos and blogs over the Internet. A security bypass vulnerability exists in Synology Photo Station versions prior to 6.3-2958. The vulnerability can be exploited by a remote attacker to execute arbitrary commands by sending an...

Synology Photo Station Elevation of Privilege Vulnerability

Synology Photo Station is a Synology solution for sharing pictures, videos and blogs over the Internet. An elevation of privilege vulnerability exists in Synology Photo Station. A local attacker can exploit this vulnerability to gain privileges...

CVE-2016-10322

Synology Photo Station before 6.3-2958 allows remote authenticated guest users to execute arbitrary commands via shell metacharacters in the X-Forwarded-For HTTP header to photo/login.php...

CVE-2016-10323

Synology Photo Station before 6.3-2958 allows local users to gain privileges by leveraging setuid execution of a "synophotodsmuser --copy-no-ea" command...

Design/Logic Flaw

Synology Photo Station before 6.3-2958 allows remote authenticated guest users to execute arbitrary commands via shell metacharacters in the X-Forwarded-For HTTP header to photo/login.php...

Command injection

Synology Photo Station before 6.3-2958 allows local users to gain privileges by leveraging setuid execution of a "synophotodsmuser --copy-no-ea" command...

CVE-2016-10323

Synology Photo Station before 6.3-2958 allows local users to gain privileges by leveraging setuid execution of a "synophotodsmuser --copy-no-ea" command...

CVE-2016-10322

Synology Photo Station before 6.3-2958 allows remote authenticated guest users to execute arbitrary commands via shell metacharacters in the X-Forwarded-For HTTP header to photo/login.php...

CVE-2016-10322

Synology Photo Station before 6.3-2958 allows remote authenticated guest users to execute arbitrary commands via shell metacharacters in the X-Forwarded-For HTTP header to photo/login.php...

CVE-2016-10323

Synology Photo Station before 6.3-2958 allows local users to gain privileges by leveraging setuid execution of a "synophotodsmuser --copy-no-ea" command...

CVE-2016-10323

Synology Photo Station prior to version 6.3-2958 contains an elevation of privilege due to a setuid execution flaw in the command "synophoto_dsm_user --copy-no-ea", allowing local users to gain privileges. This is documented across multiple sources (CVE-2016-10323, including Red Hat and CVE recor...

CVE-2016-10322

Synology Photo Station (pre-6.3-2958) is affected by CVE-2016-10322. Remote authenticated guest users can inject shell metacharacters in the X-Forwarded-For header to photo/login.php and execute arbitrary commands. Impact is described as remote code execution with the attacker in a low-privilege ...

CVE-2016-10323: Undefined Security Weakness

Synology Photo Station before 6.3-2958 allows local users to gain privileges by leveraging setuid execution of a "synophotodsmuser --copy-no-ea" command...

CVE-2016-10322: Improper Neutralization of Special Elements used in a Command

Synology Photo Station before 6.3-2958 allows remote authenticated guest users to execute arbitrary commands via shell metacharacters in the X-Forwarded-For HTTP header to photo/login.php...

PT-2017-7860

Name of the Vulnerable Software and Affected Versions Synology Photo Station versions prior to 6.3-2958 Description The issue allows remote authenticated guest users to execute arbitrary commands. This can be achieved by using shell metacharacters in the X-Forwarded-For HTTP header to the...

PT-2017-7861

Name of the Vulnerable Software and Affected Versions Synology Photo Station versions prior to 6.3-2958 Description The issue allows local users to gain privileges. This is achieved by leveraging setuid execution of a command. The command in question is synophoto dsm user --copy-no-ea...