Cross site scripting

Cross-site scripting XSS vulnerability in the "Create download task via file upload" feature in Synology Download Station before 3.5-2962 allows remote attackers to inject arbitrary web script or HTML via the name element in the Info dictionary in a torrent file...

CVE-2015-6909

Cross-site scripting XSS vulnerability in the "Create download task via file upload" feature in Synology Download Station before 3.5-2962 allows remote attackers to inject arbitrary web script or HTML via the name element in the Info dictionary in a torrent file...

CVE-2015-6911

SQL injection vulnerability in Synology Video Station before 1.5-0763 allows remote attackers to execute arbitrary SQL commands via the id parameter to watchstatus.cgi...

CVE-2015-6912

Synology Video Station before 1.5-0763 allows remote attackers to execute arbitrary shell commands via shell metacharacters in the subtitlecodepage parameter to subtitle.cgi...

CVE-2015-6909

The CVE-2015-6909 entry concerns Synology Download Station (pre-3.5-2962). A cross-site scripting (XSS) vulnerability exists in the "Create download task via file upload" feature, exploitable by injecting arbitrary web script or HTML through the name element in the Info directory of a torrent fil...

CVE-2015-6912

CVE-2015-6912 affects Synology Video Station prior to version 1.5-0763. The vulnerability allows remote attackers to execute arbitrary shell commands through shell metacharacters in the subtitle_codepage parameter of subtitle.cgi. This is a remote command-injection issue that can lead to complete...

CVE-2015-6910

SQL injection vulnerability in Synology Video Station before 1.5-0757 allows remote attackers to execute arbitrary SQL commands via the id parameter to audiotrack.cgi...

CVE-2015-6913

Affected product: Synology Download Station. Vulnerability: Cross-site scripting (XSS) in theCreate download task via URL feature. Component/entry point: add_url_task action to dlm/downloadman.cgi. Version range: vulnerable prior to 3.5-2967. Root cause/impact: attacker can inject arbitrary web s...

CVE-2015-6911

Synology Video Station is affected by CVE-2015-6911 (versions before 1.5-0763). The vulnerability is a SQL injection in the watchstatus.cgi endpoint triggered via the id parameter, allowing remote attackers to execute arbitrary SQL commands. Affected product: Synology Video Station (before 1.5-07...

CVE-2015-6913

Cross-site scripting XSS vulnerability in the "Create download task via URL" feature in Synology Download Station before 3.5-2967 allows remote attackers to inject arbitrary web script or HTML via the urls parameter in an addurltask action to dlm/downloadman.cgi...

CVE-2015-6910

The CVE-2015-6910 entry concerns a SQL injection in Synology Video Station prior to version 1.5-0757. The vulnerability exists in the audiotrack.cgi endpoint, where the id parameter can be manipulated to execute arbitrary SQL commands. Affected product: Synology Video Station (Video Manager) befo...

PT-2015-7396

Name of the Vulnerable Software and Affected Versions Synology Download Station versions prior to 3.5-2962 Description A cross-site scripting XSS issue exists in the "Create download task via file upload" feature, allowing remote attackers to inject arbitrary web script or HTML via the name eleme...

PT-2015-7399

Name of the Vulnerable Software and Affected Versions Synology Video Station versions prior to 1.5-0763 Description The issue allows remote attackers to execute arbitrary shell commands. This is achieved by injecting shell metacharacters into the subtitle codepage parameter of the "subtitle.cgi"...

PT-2015-7400

Name of the Vulnerable Software and Affected Versions Synology Download Station versions prior to 3.5-2967 Description A cross-site scripting XSS issue exists in the "Create download task via URL" feature, allowing remote attackers to inject arbitrary web script or HTML via the urls parameter in ...

CVE-2015-6911: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Synology Video Station before 1.5-0763 allows remote attackers to execute arbitrary SQL commands via the id parameter to watchstatus.cgi...

CVE-2015-6909: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the "Create download task via file upload" feature in Synology Download Station before 3.5-2962 allows remote attackers to inject arbitrary web script or HTML via the name element in the Info dictionary in a torrent file...

CVE-2015-6912: Improper Neutralization of Special Elements used in a Command

Synology Video Station before 1.5-0763 allows remote attackers to execute arbitrary shell commands via shell metacharacters in the subtitlecodepage parameter to subtitle.cgi...

PT-2015-7397

Name of the Vulnerable Software and Affected Versions Synology Video Station versions prior to 1.5-0757 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the id parameter to the "audiotrack.cgi" endpoint. Recommendations For versions prior to...

CVE-2015-6910: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Synology Video Station before 1.5-0757 allows remote attackers to execute arbitrary SQL commands via the id parameter to audiotrack.cgi...

PT-2015-7398

Name of the Vulnerable Software and Affected Versions Synology Video Station versions prior to 1.5-0763 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the id parameter to the "watchstatus.cgi" endpoint. Recommendations For versions prior to...