Synology DiskStation Manager SLICEUPLOAD Code Execution (CVE-2013-6955)

An arbitrary file upload vulnerability exists in Synology DiskStation Manager. The vulnerability exists in webman/imageSelector.cgi. A remote unauthenticated attacker can append data to files by sending specially crafted HTTP requests to the server and execute arbitrary code through that...

CVE-2013-6955

Summary of CVE-2013-6955 – Synology DiskStation Manager Affected product: Synology DiskStation Manager (DSM) with webman/imageSelector.cgi as part of the File Station component. Vulnerability: Remote code execution via SLICEUPLOAD. An attacker can append data to an arbitrary file by sending a spe...

PT-2014-3236 · Synology · Synology Diskstation Manager

Name of the Vulnerable Software and Affected Versions: Synology DiskStation Manager DSM versions 4.0 through 4.0-2258 Synology DiskStation Manager DSM versions 4.2 through 4.2-3242 Synology DiskStation Manager DSM versions 4.3 through 4.3-3809 Description: The issue allows remote attackers to...

CVE-2013-6955: Undefined Security Weakness

webman/imageSelector.cgi in Synology DiskStation Manager DSM 4.0 before 4.0-2259, 4.2 before 4.2-3243, and 4.3 before 4.3-3810 Update 1 allows remote attackers to append data to arbitrary files, and consequently execute arbitrary code, via a pathname in the SLICEUPLOAD X-TMP-FILE HTTP header...