CVE-2017-15890

Synology MailPlus Server is affected by a cross-site scripting (XSS) vulnerability in the Disclaimer module. The issue affects versions prior to 1.4.0-0415, where a remote authenticated user can inject arbitrary web script or HTML via the NAME parameter. Root cause is an unsanitized NAME input in...

CVE-2018-13296

CVE-2018-13296 affects Synology MailPlus Server; a TLS configuration flaw allows DoS via client-initiated renegotiation in versions before 2.0.5-0606. The issue is documented with CVSS v2/v3 scores (5.0/7.5) and a DoS impact. No exploitation details or fixes are provided in the connected document...

CVE-2017-16768

CVE-2017-16768 is a cross-site scripting (XSS) vulnerability in the User Policy editor of Synology MailPlus Server prior to version 1.4.0-0415. The issue allows remote authenticated users to inject arbitrary HTML via the name parameter, with impact described as partial integrity impact and low co...