CVE-2015-6913

Cross-site scripting XSS vulnerability in the "Create download task via URL" feature in Synology Download Station before 3.5-2967 allows remote attackers to inject arbitrary web script or HTML via the urls parameter in an addurltask action to dlm/downloadman.cgi...

CVE-2015-6913

Affected product: Synology Download Station. Vulnerability: Cross-site scripting (XSS) in theCreate download task via URL feature. Component/entry point: add_url_task action to dlm/downloadman.cgi. Version range: vulnerable prior to 3.5-2967. Root cause/impact: attacker can inject arbitrary web s...