Synology Download Station Cross-Site Request Forgery Vulnerability

Synology Download Station is a set of web-based download applications from Synology. The program supports BT, FTP and HTTP protocols to download files. A server-side request forgery vulnerability exists in Downloader in Synology Download Station version 3.8.x before 3.8.5-3475 and version 3.x...

Synology Photo Station Multiple Vulnerabilities

Synology Photo Station is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Biscom Secure File Transfer XSS Vulnerability

Biscom Secure File Transfer is prone to a cross-site scripting vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2017-11156

Synology Download Station 3.8.x before 3.8.5-3475 and 3.x before 3.5-2984 uses weak permissions 0777 for ui/dlm/btsearch directory, which allows remote authenticated users to execute arbitrary code by uploading an executable via unspecified vectors...

CVE-2017-11156

Synology Download Station 3.8.x before 3.8.5-3475 and 3.x before 3.5-2984 uses weak permissions 0777 for ui/dlm/btsearch directory, which allows remote authenticated users to execute arbitrary code by uploading an executable via unspecified vectors...

CVE-2017-11149

Server-side request forgery SSRF vulnerability in Downloader in Synology Download Station 3.8.x before 3.8.5-3475 and 3.x before 3.5-2984 allows remote authenticated users to download arbitrary local files via crafted URI...

Design/Logic Flaw

Synology Download Station 3.8.x before 3.8.5-3475 and 3.x before 3.5-2984 uses weak permissions 0777 for ui/dlm/btsearch directory, which allows remote authenticated users to execute arbitrary code by uploading an executable via unspecified vectors...

Server side request forgery (ssrf)

Server-side request forgery SSRF vulnerability in Downloader in Synology Download Station 3.8.x before 3.8.5-3475 and 3.x before 3.5-2984 allows remote authenticated users to download arbitrary local files via crafted URI...

CVE-2017-11149

Server-side request forgery SSRF vulnerability in Downloader in Synology Download Station 3.8.x before 3.8.5-3475 and 3.x before 3.5-2984 allows remote authenticated users to download arbitrary local files via crafted URI...

CVE-2017-11149

CVE-2017-11149 affects Synology Download Station’s Downloader, enabling a server-side request forgery (SSRF). The vulnerability exists in versions 3.8.x before 3.8.5-3475 and 3.x before 3.5-2984, where remote authenticated users can download arbitrary local files via crafted URIs. No exploitation...

CVE-2017-11156

Synology Download Station (versions affected: 3.8.x prior to 3.8.5-3475 and 3.x prior to 3.5-2984) uses weak permissions (0777) on the ui/dlm/btsearch directory. This allows remote authenticated users to upload an executable and execute arbitrary code. The vulnerability details are described acro...

CVE-2017-11156

Synology Download Station 3.8.x before 3.8.5-3475 and 3.x before 3.5-2984 uses weak permissions 0777 for ui/dlm/btsearch directory, which allows remote authenticated users to execute arbitrary code by uploading an executable via unspecified vectors...

CVE-2017-11156: Incorrect Default Permissions

Synology Download Station 3.8.x before 3.8.5-3475 and 3.x before 3.5-2984 uses weak permissions 0777 for ui/dlm/btsearch directory, which allows remote authenticated users to execute arbitrary code by uploading an executable via unspecified vectors...

PT-2017-11774

Name of the Vulnerable Software and Affected Versions Synology Download Station versions 3.8.x before 3.8.5-3475 Synology Download Station versions 3.x before 3.5-2984 Description A server-side request forgery SSRF issue in the Downloader component of Synology Download Station allows remote...

PT-2017-11781

Name of the Vulnerable Software and Affected Versions Synology Download Station versions 3.8.x before 3.8.5-3475 Synology Download Station versions 3.x before 3.5-2984 Description The issue allows remote authenticated users to execute arbitrary code by uploading an executable via unspecified...

CVE-2017-11149: Server-Side Request Forgery (SSRF)

Server-side request forgery SSRF vulnerability in Downloader in Synology Download Station 3.8.x before 3.8.5-3475 and 3.x before 3.5-2984 allows remote authenticated users to download arbitrary local files via crafted URI...

Wheat Home Edition Android App Has Logic Design Flaw

Wheat Home Edition app is a video surveillance software that provides PV monitoring services. Wheat Home Edition Android App has a logic flaw vulnerability. Allows an attacker to exploit the vulnerability to reset the password of any user of the power station with just the UID...

CVE-2017-9556

Cross-site scripting XSS vulnerability in Video Metadata Editor in Synology Video Station before 2.3.0-1435 allows remote authenticated attackers to inject arbitrary web script or HTML via the title parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in Video Metadata Editor in Synology Video Station before 2.3.0-1435 allows remote authenticated attackers to inject arbitrary web script or HTML via the title parameter...

CVE-2017-9556

Cross-site scripting XSS vulnerability in Video Metadata Editor in Synology Video Station before 2.3.0-1435 allows remote authenticated attackers to inject arbitrary web script or HTML via the title parameter...