Synology Download Station crossite scripting

Few crossite scripging possibilities...

CVE-2015-6913

Cross-site scripting XSS vulnerability in the "Create download task via URL" feature in Synology Download Station before 3.5-2967 allows remote attackers to inject arbitrary web script or HTML via the urls parameter in an addurltask action to dlm/downloadman.cgi...

CVE-2015-6912

Synology Video Station before 1.5-0763 allows remote attackers to execute arbitrary shell commands via shell metacharacters in the subtitlecodepage parameter to subtitle.cgi...

CVE-2015-6911

SQL injection vulnerability in Synology Video Station before 1.5-0763 allows remote attackers to execute arbitrary SQL commands via the id parameter to watchstatus.cgi...

CVE-2015-6910

SQL injection vulnerability in Synology Video Station before 1.5-0757 allows remote attackers to execute arbitrary SQL commands via the id parameter to audiotrack.cgi...

CVE-2015-6909

Cross-site scripting XSS vulnerability in the "Create download task via file upload" feature in Synology Download Station before 3.5-2962 allows remote attackers to inject arbitrary web script or HTML via the name element in the Info dictionary in a torrent file...

Sql injection

SQL injection vulnerability in Synology Video Station before 1.5-0757 allows remote attackers to execute arbitrary SQL commands via the id parameter to audiotrack.cgi...

Cross site scripting

Cross-site scripting XSS vulnerability in the "Create download task via file upload" feature in Synology Download Station before 3.5-2962 allows remote attackers to inject arbitrary web script or HTML via the name element in the Info dictionary in a torrent file...

Cross site scripting

Cross-site scripting XSS vulnerability in the "Create download task via URL" feature in Synology Download Station before 3.5-2967 allows remote attackers to inject arbitrary web script or HTML via the urls parameter in an addurltask action to dlm/downloadman.cgi...

Sql injection

SQL injection vulnerability in Synology Video Station before 1.5-0763 allows remote attackers to execute arbitrary SQL commands via the id parameter to watchstatus.cgi...

Design/Logic Flaw

Synology Video Station before 1.5-0763 allows remote attackers to execute arbitrary shell commands via shell metacharacters in the subtitlecodepage parameter to subtitle.cgi...

CVE-2015-6909

The CVE-2015-6909 entry concerns Synology Download Station (pre-3.5-2962). A cross-site scripting (XSS) vulnerability exists in the "Create download task via file upload" feature, exploitable by injecting arbitrary web script or HTML through the name element in the Info directory of a torrent fil...

CVE-2015-6910

SQL injection vulnerability in Synology Video Station before 1.5-0757 allows remote attackers to execute arbitrary SQL commands via the id parameter to audiotrack.cgi...

CVE-2015-6910

The CVE-2015-6910 entry concerns a SQL injection in Synology Video Station prior to version 1.5-0757. The vulnerability exists in the audiotrack.cgi endpoint, where the id parameter can be manipulated to execute arbitrary SQL commands. Affected product: Synology Video Station (Video Manager) befo...

CVE-2015-6909

Cross-site scripting XSS vulnerability in the "Create download task via file upload" feature in Synology Download Station before 3.5-2962 allows remote attackers to inject arbitrary web script or HTML via the name element in the Info dictionary in a torrent file...

CVE-2015-6911

SQL injection vulnerability in Synology Video Station before 1.5-0763 allows remote attackers to execute arbitrary SQL commands via the id parameter to watchstatus.cgi...

CVE-2015-6913

Affected product: Synology Download Station. Vulnerability: Cross-site scripting (XSS) in theCreate download task via URL feature. Component/entry point: add_url_task action to dlm/downloadman.cgi. Version range: vulnerable prior to 3.5-2967. Root cause/impact: attacker can inject arbitrary web s...

CVE-2015-6912

CVE-2015-6912 affects Synology Video Station prior to version 1.5-0763. The vulnerability allows remote attackers to execute arbitrary shell commands through shell metacharacters in the subtitle_codepage parameter of subtitle.cgi. This is a remote command-injection issue that can lead to complete...

CVE-2015-6913

Cross-site scripting XSS vulnerability in the "Create download task via URL" feature in Synology Download Station before 3.5-2967 allows remote attackers to inject arbitrary web script or HTML via the urls parameter in an addurltask action to dlm/downloadman.cgi...

CVE-2015-6911

Synology Video Station is affected by CVE-2015-6911 (versions before 1.5-0763). The vulnerability is a SQL injection in the watchstatus.cgi endpoint triggered via the id parameter, allowing remote attackers to execute arbitrary SQL commands. Affected product: Synology Video Station (before 1.5-07...