CVE-2017-11148

Synology Chat contains a Server-Side Request Forgery (SSRF) in the link preview component that affects versions prior to 1.1.0-0806. Remote authenticated users can access intranet resources via unspecified vectors. The CNVD/NVD entries confirm the vulnerability in Synology Chat and warn about the...

CVE-2017-15892

Synology Chat's Slash Command Creator contains multiple XSS vulnerabilities that allow remote authenticated users to inject arbitrary script or HTML via the COMMAND, COMMANDS INSTRUCTION, or DESCRIPTION parameters, in versions prior to 2.0.0-1124. The CVE-2017-15892 entry notes a MEDIUM-severity ...

CVE-2017-15886

The CVE-2017-15886 vulnerability affects Synology Chat’s Link Preview component and is triggered by an authenticated user via a crafted URI to perform server‑side request forgery (SSRF). The issue allows downloading arbitrary local files on the server when exploiting Link Preview on Synology Chat...