Synology File Station Information Disclosure Vulnerability

Synology File Station is a set of file management tools from Synology Inc. of Taiwan, China. The tool enables users to access files on Synology NAS devices via the Web. An information disclosure vulnerability exists in SYNO.FolderSharing.List in Synology File Station versions prior to 1.2.3-0252...

Synology Web Station Input Validation Error Vulnerability

Synology Web Station is an application that supports the creation of personal web sites by Synology Inc. of Taiwan, China. An input validation error vulnerability exists in Synology Web Station. An attacker could exploit this vulnerability to conduct a phishing attack with the help of a specially...

CVE-2018-8913

Missing custom error page vulnerability in Synology Web Station before 2.1.3-0139 allows remote attackers to conduct phishing attacks via a crafted URL...

CVE-2018-13288

Information exposure vulnerability in SYNO.FolderSharing.List in Synology File Station before 1.2.3-0252 and before 1.1.5-0125 allows remote attackers to obtain sensitive information via the 1 folderpath or 2 realpath parameter...

CVE-2018-8913

Missing custom error page vulnerability in Synology Web Station before 2.1.3-0139 allows remote attackers to conduct phishing attacks via a crafted URL...

Design/Logic Flaw

Missing custom error page vulnerability in Synology Web Station before 2.1.3-0139 allows remote attackers to conduct phishing attacks via a crafted URL...

CVE-2018-13288

Information exposure vulnerability in SYNO.FolderSharing.List in Synology File Station before 1.2.3-0252 and before 1.1.5-0125 allows remote attackers to obtain sensitive information via the 1 folderpath or 2 realpath parameter...

CVE-2018-13288

Information exposure vulnerability in SYNO.FolderSharing.List in Synology File Station before 1.2.3-0252 and before 1.1.5-0125 allows remote attackers to obtain sensitive information via the 1 folderpath or 2 realpath parameter...

CVE-2018-8913

Missing custom error page vulnerability in Synology Web Station before 2.1.3-0139 allows remote attackers to conduct phishing attacks via a crafted URL...

Information disclosure

Information exposure vulnerability in SYNO.FolderSharing.List in Synology File Station before 1.2.3-0252 and before 1.1.5-0125 allows remote attackers to obtain sensitive information via the 1 folderpath or 2 realpath parameter...

CVE-2018-13288

Synology File Station vulnerability CVE-2018-13288 affects SYNO.FolderSharing.List prior to 1.2.3-0252 and prior to 1.1.5-0125. The issue allows remote attackers to disclose information via the folder_path or real_path parameter, exposing sensitive data. Exploitation details beyond the descriptio...

CVE-2018-13288

Information exposure vulnerability in SYNO.FolderSharing.List in Synology File Station before 1.2.3-0252 and before 1.1.5-0125 allows remote attackers to obtain sensitive information via the 1 folderpath or 2 realpath parameter...

CVE-2018-8913

Missing custom error page vulnerability in Synology Web Station before 2.1.3-0139 allows remote attackers to conduct phishing attacks via a crafted URL...

CVE-2018-8913

The vulnerability CVE-2018-8913 affects Synology Web Station prior to version 2.1.3-0139, caused by a missing custom error page. This allows remote attackers to perform phishing attacks using a crafted URL. Impact is phishing capability with partial confidentiality/integrity exposure reported by ...

March 19, 2019—KB4489894 (OS Build 17134.677)

None None...

CVE-2018-17426

WUZHI CMS 4.1.0 has stored XSS via the "Extension module" "SMS in station" field under the index.php?m=core URI...

CVE-2018-17426

WUZHI CMS 4.1.0 has stored XSS via the "Extension module" "SMS in station" field under the index.php?m=core URI...

CVE-2018-17426

WUZHI CMS 4.1.0 has stored XSS via the "Extension module" "SMS in station" field under the index.php?m=core URI...

CVE-2018-17426

WUZHI CMS 4.1.0 is affected by a stored XSS vulnerability in the Extension module, specifically the "SMS in station" field under index.php?m=core. The issue is caused by improper input handling in that field, enabling arbitrary HTML/JS injection. No exploit details or remediation are provided in ...

QNAP TS-431 QTS Remote Command Execution

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'base64' class MetasploitModule 'QNAP TS-431 QTS %q This module creates a virtual web server and uploads the php payload into it. Admin privileges cannot access a...