CVE-2015-9104: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerabilities in Synology Audio Station 5.1 before 5.1-2550 and 5.4 before 5.4-2857 allows remote authenticated attackers to inject arbitrary web script or HTML via the album title...

PT-2017-7552

Name of the Vulnerable Software and Affected Versions Synology Video Station versions 1.2 before 1.2-0455 Synology Video Station versions 1.5 before 1.5-0772 Synology Video Station versions 1.6 before 1.6-0847 Description The issue allows remote authenticated attackers to inject arbitrary web...

CVE-2015-9103: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Synology Note Station 1.1-0212 and earlier allow remote authenticated attackers to inject arbitrary web script or HTML via the 1 note title or 2 file name of attachments...

PT-2017-7549

Name of the Vulnerable Software and Affected Versions Synology Photo Station versions 6.0 through 6.0-2637 Synology Photo Station versions 6.3 through 6.3-2961 Description The issue allows remote authenticated attackers to inject arbitrary web script or HTML via the album name, file name of...

PT-2017-7551

Name of the Vulnerable Software and Affected Versions Synology Audio Station versions 5.1 before 5.1-2550 Synology Audio Station versions 5.4 before 5.4-2857 Description The issue allows remote authenticated attackers to inject arbitrary web script or HTML via the album title, which can lead to...

Authorization

In EMC VNX2 versions prior to OE for File 8.1.9.211 and VNX1 versions prior to OE for File 7.1.80.8, a local authenticated user may potentially escalate their privileges to root due to authorization checks not being performed on certain perl scripts. This may potentially be exploited by an attack...

CVE-2017-4985

In EMC VNX2 versions prior to OE for File 8.1.9.211 and VNX1 versions prior to OE for File 7.1.80.8, a local authenticated user may potentially escalate their privileges to root due to authorization checks not being performed on certain perl scripts. This may potentially be exploited by an attack...

PT-2017-2638

Name of the Vulnerable Software and Affected Versions EMC VNX2 versions prior to 8.1.9.211 EMC VNX1 versions prior to 7.1.80.8 Description The issue is related to a lack of input sanitization, which may allow an unauthenticated remote attacker to elevate their permissions to root through a comman...

CVE-2017-4984: Improper Neutralization of Special Elements used in a Command

In EMC VNX2 versions prior to OE for File 8.1.9.211 and VNX1 versions prior to OE for File 7.1.80.8, an unauthenticated remote attacker may be able to elevate their permissions to root through a command injection. This may potentially be exploited by an attacker to run arbitrary code with...

PT-2017-16248

Name of the Vulnerable Software and Affected Versions EMC VNX2 versions prior to 8.1.9.211 EMC VNX1 versions prior to 7.1.80.8 Description A local authenticated user can load a maliciously crafted file in the search path, potentially allowing the attacker to execute arbitrary code on the targeted...

Weak Password Vulnerability in GoodWe PV Plant Monitoring System Android APP

GoodWe PV Plant Monitoring System Android APP is a very global PV plant monitoring app. GoodWe photovoltaic power plant monitoring Android APP system has a weak password vulnerability, the attacker can use the vulnerability to directly enter the remote end of the cell phone monitoring system,...

Shenzhen Sodo technology enterprise station CMS SQL injection vulnerability

Shenzhen Sodo Technology enterprise station CMS is a specialized product for enterprise station building. SQL injection vulnerability exists in Shenzhen Sodo Technology Enterprise Station Building CMS. Attackers can use this vulnerability to obtain database information...

Synology Photo Station Design Flaw Vulnerability

Synology Photo Station is a solution for sharing pictures, videos and blogs over the Internet from Synology, a Chinese company. A security vulnerability exists in the authentication in Synology Photo Station versions 6.0-2528 through 6.7.1-3419. A local attacker can exploit the vulnerability to...

Default credentials

A design flaw in authentication in Synology Photo Station 6.0-2528 through 6.7.1-3419 allows local users to obtain credentials via cmdline. Synology Photo Station employs the synophotodsmuser program to authenticate username and password by "synophotodsmuser --auth USERNAME PASSWORD", and local...

CVE-2017-9552

A design flaw in authentication in Synology Photo Station 6.0-2528 through 6.7.1-3419 allows local users to obtain credentials via cmdline. Synology Photo Station employs the synophotodsmuser program to authenticate username and password by "synophotodsmuser --auth USERNAME PASSWORD", and local...

CVE-2017-9552

A design flaw in authentication in Synology Photo Station 6.0-2528 through 6.7.1-3419 allows local users to obtain credentials via cmdline. Synology Photo Station employs the synophotodsmuser program to authenticate username and password by "synophotodsmuser --auth USERNAME PASSWORD", and local...

CVE-2017-9552

A design flaw in authentication in Synology Photo Station 6.0-2528 through 6.7.1-3419 allows local users to obtain credentials via cmdline. Synology Photo Station employs the synophotodsmuser program to authenticate username and password by "synophotodsmuser --auth USERNAME PASSWORD", and local...

CVE-2017-9552

CVE-2017-9552 concerns Synology Photo Station 6.0-2528 through 6.7.1-3419, where a design flaw in the authentication process allows local users to obtain credentials via the synophoto_dsm_user authentication flow and by sniffing /proc/*/cmdline. The vulnerability stems from how credentials are ha...

CVE-2017-9552: Insufficiently Protected Credentials

A design flaw in authentication in Synology Photo Station 6.0-2528 through 6.7.1-3419 allows local users to obtain credentials via cmdline. Synology Photo Station employs the synophotodsmuser program to authenticate username and password by "synophotodsmuser --auth USERNAME PASSWORD", and local...

PT-2017-19012

Name of the Vulnerable Software and Affected Versions Synology Photo Station versions 6.0-2528 through 6.7.1-3419 Description A design flaw in the authentication mechanism of Synology Photo Station allows local users to obtain credentials. The synophoto dsm user program is used for authentication...