Command injection

Command injection vulnerability in Document.php in Synology Office 2.2.0-1502 and 2.2.1-1506 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the crafted file name of RTF documents...

Design/Logic Flaw

Synology Download Station 3.8.x before 3.8.5-3475 and 3.x before 3.5-2984 uses weak permissions 0777 for ui/dlm/btsearch directory, which allows remote authenticated users to execute arbitrary code by uploading an executable via unspecified vectors...

CVE-2017-11149

Server-side request forgery SSRF vulnerability in Downloader in Synology Download Station 3.8.x before 3.8.5-3475 and 3.x before 3.5-2984 allows remote authenticated users to download arbitrary local files via crafted URI...

CVE-2017-11149

Server-side request forgery SSRF vulnerability in Downloader in Synology Download Station 3.8.x before 3.8.5-3475 and 3.x before 3.5-2984 allows remote authenticated users to download arbitrary local files via crafted URI...

CVE-2017-11150

Command injection vulnerability in Document.php in Synology Office 2.2.0-1502 and 2.2.1-1506 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the crafted file name of RTF documents...

CVE-2017-11150

CVE-2017-11150 affects Synology Office, affecting Document.php in versions 2.2.0-1502 and 2.2.1-1506. A command-injection flaw allows remote authenticated users to execute arbitrary commands by supplying shell metacharacters in the filename of crafted RTF documents. The underlying cause is input ...

EulerOS 2.0 SP2 : mercurial (EulerOS-SA-2017-1133)

According to the version of the mercurial package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - In Mercurial before 4.1.3, 'hg serve --stdio' allows remote authenticated users to launch the Python debugger, and consequently execute arbitrary...

Cross site scripting

Cross-site scripting XSS vulnerability in Fortinet FortiManager 5.0.x before 5.0.11, 5.2.x before 5.2.2 allows remote authenticated users to inject arbitrary web script or HTML via vectors involving unspecified parameters and a privilege escalation attack...

CVE-2015-3615

Fortinet FortiManager is affected by a Cross‑Site Scripting (XSS) vulnerability in FortiManager 5.0.x before 5.0.11 and 5.2.x before 5.2.2. A remote authenticated user can inject arbitrary web script or HTML via unspecified parameters, with privilege escalation potential. Root cause and exact exp...

CVE-2015-3615

Cross-site scripting XSS vulnerability in Fortinet FortiManager 5.0.x before 5.0.11, 5.2.x before 5.2.2 allows remote authenticated users to inject arbitrary web script or HTML via vectors involving unspecified parameters and a privilege escalation attack...

CVE-2017-11148

Server-side request forgery SSRF vulnerability in link preview in Synology Chat before 1.1.0-0806 allows remote authenticated users to access intranet resources via unspecified vectors...

Server side request forgery (ssrf)

Server-side request forgery SSRF vulnerability in link preview in Synology Chat before 1.1.0-0806 allows remote authenticated users to access intranet resources via unspecified vectors...

CVE-2017-11148

Synology Chat contains a Server-Side Request Forgery (SSRF) in the link preview component that affects versions prior to 1.1.0-0806. Remote authenticated users can access intranet resources via unspecified vectors. The CNVD/NVD entries confirm the vulnerability in Synology Chat and warn about the...

Cross site scripting

Cross-site scripting XSS vulnerability in Telescope before 0.9.3 allows remote authenticated users to inject arbitrary web script or HTML via crafted markdown...

CVE-2014-5144

Cross-site scripting XSS vulnerability in Telescope before 0.9.3 allows remote authenticated users to inject arbitrary web script or HTML via crafted markdown...

CVE-2015-0783

The FileViewer class in Novell ZENworks Configuration Management ZCM allows remote authenticated users to read arbitrary files via the filename variable...

Design/Logic Flaw

The FileViewer class in Novell ZENworks Configuration Management ZCM allows remote authenticated users to read arbitrary files via the filename variable...

CVE-2015-0783

The FileViewer class in Novell ZENworks Configuration Management ZCM allows remote authenticated users to read arbitrary files via the filename variable...

CVE-2014-5144

Cross-site scripting XSS vulnerability in Telescope before 0.9.3 allows remote authenticated users to inject arbitrary web script or HTML via crafted markdown...

CVE-2014-5144

The CVE-2014-5144 entry describes a persistent XSS in Telescope prior to 0.9.3. An authenticated user can inject arbitrary web script or HTML via crafted markdown, with exploitation tied to parsing of markdown input and lack of sanitisation. Affected software: Telescope