Directory traversal

Directory traversal vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to write arbitrary files via the path parameter...

Unrestricted file upload

Unrestricted file upload vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to create arbitrary PHP scripts via the type parameter...

Information disclosure

An information exposure vulnerability in index.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to obtain sensitive system information via unspecified vectors...

CVE-2017-11155

An information exposure vulnerability in index.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to obtain sensitive system information via unspecified vectors...

CVE-2017-11152

Directory traversal vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to write arbitrary files via the path parameter...

CVE-2017-11151

CVE-2017-11151 affects Synology Photo Station. A vulnerability in synotheme_upload.php allows remote attackers to upload arbitrary files without authentication via the logo_upload action, exposing a path to remote code execution. Affected versions are Photo Station before 6.7.3-3432 and 6.3-2967....

CVE-2017-11153

CVE-2017-11153 is a deserialization vulnerability in Synology Photo Station (affecting versions prior to 6.7.3-3432 and 6.3-2967) that allows remote attackers to gain administrator privileges via a crafted serialized payload in synophoto_csPhotoMisc.php. The issue is part of a multi-vulnerability...

CVE-2017-11155

CVE-2017-11155 affects Synology Photo Station and is described as an information-disclosure vulnerability in index.php present in versions prior to 6.7.3-3432 and 6.3-2967. Remote attackers could obtain sensitive system information via unspecified vectors. The connected sources document this CVE ...

CVE-2017-11154

Affected product: Synology Photo Station. Vulnerability: Unrestricted file upload in PixlrEditorHandler.php that allows remote attackers to create arbitrary PHP scripts via the type parameter. Affected versions: before 6.7.3-3432 and before 6.3-2967. Root cause: file upload handler permits uncont...

CVE-2017-11152

CVE-2017-11152 is a directory traversal vulnerability in Synology Photo Station (PixlrEditorHandler.php) affecting versions prior to 6.7.3-3432 and 6.3-2967, enabling remote attackers to write arbitrary files via the path parameter. Connected sources describe a broader 4-vulnerability chain (CVE-...

CVE-2017-11151

A vulnerability in synothemeupload.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to upload arbitrary files without authentication via the logoupload action...

CVE-2017-11154

Unrestricted file upload vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to create arbitrary PHP scripts via the type parameter...

Installer of Qua station connection tool for Windows may insecurely load Dynamic Link Libraries

Overview Qua station provided KDDI CORPORATION is a 4G LTE photostrage. Qua station connection tool is used to view data saved on Qua station from a PC and/or save data on a PC. Installer of Qua station connection tool for Windows contains an issue with the DLL search path, which may lead to...

CVE-2017-11153: Deserialization of Untrusted Data

Deserialization vulnerability in synophotocsPhotoMisc.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to gain administrator privileges via a crafted serialized payload...

CVE-2017-11151: Improper Authentication

A vulnerability in synothemeupload.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to upload arbitrary files without authentication via the logoupload action...

Synology Photo Station Unauthenticated Remote Code Execution

Vulnerability Summary The following advisory describes a Remote Code Execution found in Synology Photo Station versions 6.7.3-3432 and earlier / 6.3-2967 and earlier. Personal Photo Station is an online photo album with blog owned and managed by a DSM user. Synology NAS provides the home/photo...

Synology Photo Station 6.7.3-3432 / 6.3-2967 Remote Code Execution

''' Source: https://blogs.securiteam.com/index.php/archives/3356 Vulnerability details The remote code execution is a combination of 4 different vulnerabilities: Upload arbitrary files to the specified directories Log in with a fake authentication mechanism Log in to Photo Station with any identi...

CVE-2017-11155: Observable Behavioral Discrepancy

An information exposure vulnerability in index.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to obtain sensitive system information via unspecified vectors...

Synology Photo Station 6.7.3-3432 6.3-2967 - Remote Code Execution

Synology Photo Station 6.7.3-3432 6.3-2967 - Remote Code Execution ''' Source: https://blogs.securiteam.com/index.php/archives/3356 Vulnerability details The remote code execution is a combination of 4 different vulnerabilities: Upload arbitrary files to the specified directories Log in with a fa...

CVE-2017-11152: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to write arbitrary files via the path parameter...