CVE-2019-11828

Synology Office’s Chart component is affected by a Cross‑Site Scripting (XSS) vulnerability in versions prior to 3.1.4-2771. The issue arises from insufficient client data validation, enabling remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. Impact is web...

CVE-2018-8924

CVE-2018-8924 affects Synology Office: the Title Tootip component allows XSS via a malicious filename. Vulnerable in versions before 3.0.3-2143; exploitation requires remote authenticated access. Mitigation: upgrade to 3.0.3-2143 or later (per CNVD/NVD descriptions). If exploitation details are n...

CVE-2017-11150

CVE-2017-11150 affects Synology Office, affecting Document.php in versions 2.2.0-1502 and 2.2.1-1506. A command-injection flaw allows remote authenticated users to execute arbitrary commands by supplying shell metacharacters in the filename of crafted RTF documents. The underlying cause is input ...