CVE-2015-4656

Multiple cross-site scripting XSS vulnerabilities in Synology Photo Station before 6.3-2945 allow remote attackers to inject arbitrary web script or HTML via the 1 success parameter to login.php or 2 crafted URL parameters to index.php, as demonstrated by the t parameter to photo/...

CVE-2015-4656: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Synology Photo Station before 6.3-2945 allow remote attackers to inject arbitrary web script or HTML via the 1 success parameter to login.php or 2 crafted URL parameters to index.php, as demonstrated by the t parameter to photo/...

PT-2015-6656

Name of the Vulnerable Software and Affected Versions Synology Photo Station versions prior to 6.3-2945 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the success parameter to "login.php" or crafted URL parameters to "index.php", suc...

Microsoft Windows Station Memory Misreference Vulnerability

Microsoft Windows is a popular operating system. A memory misreference vulnerability exists in Microsoft Windows Station, which allows local attackers to exploit the vulnerability to execute arbitrary code with elevated privileges...

CVE-2015-1723: Use After Free

Use-after-free vulnerability in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges...

Synology Cloud Station Elevation of Privilege Vulnerability

Synology Cloud Station is a solution for synchronizing data between all devices using a cloud station. A security vulnerability in the clientchown tool in the Synology Cloud Station's synchronization client client for OS X-based platforms allows a local attacker to change the ownership of arbitra...

Command injection vulnerability in Synology Photo Station

------------------------------------------------------------------------ Command injection vulnerability in Synology Photo Station ------------------------------------------------------------------------ Han Sahin, May 2015 ------------------------------------------------------------------------...

Synology Photo Station multiple Cross-Site Scripting vulnerabilities

------------------------------------------------------------------------ Synology Photo Station multiple Cross-Site Scripting vulnerabilities ------------------------------------------------------------------------ Han Sahin, May 2015...

CVE-2015-2851

clientchown in the sync client in Synology Cloud Station 1.1-2291 through 3.1-3320 on OS X allows local users to change the ownership of arbitrary files, and consequently obtain root access, by specifying a filename...

Code injection

clientchown in the sync client in Synology Cloud Station 1.1-2291 through 3.1-3320 on OS X allows local users to change the ownership of arbitrary files, and consequently obtain root access, by specifying a filename...

CVE-2015-2851

The CVE-2015-2851 issue affects Synology Cloud Station sync client on macOS, specifically versions 1.1-2291 through 3.1-3320. A setuid root executable, client_chown, allows local users to alter file ownership by supplying a filename, enabling escalation to root privileges. Impact is local and pro...

PT-2015-5936

Name of the Vulnerable Software and Affected Versions Synology Cloud Station versions 1.1-2291 through 3.1-3320 Description The issue allows local users to change the ownership of arbitrary files and consequently obtain root access by specifying a filename. This is related to the client chown...

CVE-2015-2851: Undefined Security Weakness

clientchown in the sync client in Synology Cloud Station 1.1-2291 through 3.1-3320 on OS X allows local users to change the ownership of arbitrary files, and consequently obtain root access, by specifying a filename...

Synology Fixes File-Takeover Flaw in Cloud Station OS X Client

There is a vulnerability in some versions of Synology’s Cloud Station client for OS X that can enable any user to take over system files and gain complete control of the machine. Cloud Station is a system that allows users to sync files across a number of devices. The system saves changes to file...

Synology Photo Station Cross-Site Scripting Vulnerability

Synology Photo Station is a solution for sharing pictures, videos and blogs over the Internet. A cross-site scripting vulnerability exists in Synology Photo Station, which can be exploited by remote attackers to inject malicious scripts or HTML code, which can be used to obtain sensitive...

Synology Photo Station 6.2-2858 Command Injection

------------------------------------------------------------------------ Command injection vulnerability in Synology Photo Station ------------------------------------------------------------------------ Han Sahin, May 2015 ------------------------------------------------------------------------...

Synology Photo Station Command Injection and multiple Cross Site Scripting Vulnerabilities

Synology Photo Station is prone to a command injection vulnerability and multiple cross-site scripting vulnerabilities because it fails to sanitize user-supplied input. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright...

Synology Photo Station 6.2-2858 Cross Site Scripting

------------------------------------------------------------------------ Synology Photo Station multiple Cross-Site Scripting vulnerabilities ------------------------------------------------------------------------ Han Sahin, May 2015...

Synology Photo Station Detection

The script sends a connection request to the server and attempts to extract the version number from the reply. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifie...

Synology Cloud Station sync client for OS X allows regular users to claim ownership of system files

Overview The Synology Cloud Station sync client for OS X contains a setuid root executable that allows regular users to claim ownership of system files. Description CWE-276: Incorrect Default Permissions - CVE-2015-2851The Synology Cloud Station sync client for OS X contains an executable named...