Lucene search
K
Database
Vendors
Products
Timeline
Vulnerabilities
Perimeter Scanner
Scanning
Projects
Scanner
Agent Scanning
API Scanning
Manual Audit
Email
Webhook
Resources
Documents
Blog
Glossary
FAQ
Plugins
Pricing
Contacts
About Us
Partners
Branding Guideline
Settings
Sign in
SynologyPhoto Station*

31 matches found

CVE
CVE•added 2021/06/01 2:15 p.m.•145 views

CVE-2021-29092

Unrestricted upload of file with dangerous type vulnerability in file management component in Synology Photo Station before 6.8.14-3500 allows remote authenticated users to execute arbitrary code via unspecified vectors.

8.8CVSS8.6AI score0.01896EPSS
CVE
CVE•added 2021/06/02 3:15 a.m.•77 views

CVE-2021-29089

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in thumbnail component in Synology Photo Station before 6.8.14-3500 allows remote attackers users to execute arbitrary SQL commands via unspecified vectors.

10CVSS9.8AI score0.01023EPSS
CVE
CVE•added 2021/06/02 2:15 a.m.•75 views

CVE-2021-29090

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in PHP component in Synology Photo Station before 6.8.14-3500 allows remote authenticated users to execute arbitrary SQL command via unspecified vectors.

9CVSS7.2AI score0.01405EPSS
CVE
CVE•added 2021/06/02 2:15 a.m.•75 views

CVE-2021-29091

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in file management component in Synology Photo Station before 6.8.14-3500 allows remote authenticated users to write arbitrary files via unspecified vectors.

7.7CVSS6.1AI score0.00147EPSS
CVE
CVE•added 2019/06/30 3:15 p.m.•72 views

CVE-2019-11822

Relative path traversal vulnerability in SYNO.PhotoStation.File in Synology Photo Station before 6.8.11-3489 and before 6.3-2977 allows remote attackers to upload arbitrary files via the uploadphoto parameter.

6.5CVSS6.6AI score0.00204EPSS
CVE
CVE•added 2022/07/06 8:15 a.m.•64 views

CVE-2022-22681

Session fixation vulnerability in access control management in Synology Photo Station before 6.8.16-3506 allows remote attackers to bypass security constraint via unspecified vectors.

8.1CVSS7.5AI score0.00356EPSS
CVE
CVE•added 2019/06/30 3:15 p.m.•63 views

CVE-2019-11821

SQL injection vulnerability in synophoto_csPhotoDB.php in Synology Photo Station before 6.8.11-3489 and before 6.3-2977 allows remote attackers to execute arbitrary SQL command via the type parameter.

9.8CVSS9.9AI score0.00392EPSS
CVE
CVE•added 2017/08/08 3:29 p.m.•61 views

CVE-2017-11155

An information exposure vulnerability in index.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to obtain sensitive system information via unspecified vectors.

7.5CVSS7.2AI score0.35175EPSS
CVE
CVE•added 2017/08/08 3:29 p.m.•57 views

CVE-2017-11151

A vulnerability in synotheme_upload.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to upload arbitrary files without authentication via the logo_upload action.

9.8CVSS9.5AI score0.14779EPSS
CVE
CVE•added 2017/09/08 2:29 p.m.•50 views

CVE-2017-11161

Multiple SQL injection vulnerabilities in Synology Photo Station before 6.7.4-3433 and 6.3-2968 allow remote attackers to execute arbitrary SQL commands via the (1) article_id parameter to label.php; or (2) type parameter to synotheme.php.

9.8CVSS10AI score0.00585EPSS
CVE
CVE•added 2017/12/04 7:29 p.m.•49 views

CVE-2017-12079

Files or directories accessible to external parties vulnerability in picasa.php in Synology Photo Station before 6.8.1-3458 and before 6.3-2970 allows remote attackers to obtain arbitrary files via prog_id field.

7.5CVSS7.5AI score0.00297EPSS
CVE
CVE•added 2017/12/20 6:29 p.m.•48 views

CVE-2017-12072

Cross-site scripting (XSS) vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.8.0-3456 allows remote authenticated users to inject arbitrary web scripts or HTML via the id parameter.

5.4CVSS5.1AI score0.00187EPSS
CVE
CVE•added 2017/08/08 3:29 p.m.•47 views

CVE-2017-11153

Deserialization vulnerability in synophoto_csPhotoMisc.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to gain administrator privileges via a crafted serialized payload.

9.8CVSS9.3AI score0.15084EPSS
CVE
CVE•added 2018/03/22 2:29 p.m.•46 views

CVE-2017-16772

Improper input validation vulnerability in SYNOPHOTO_Flickr_MultiUpload in Synology Photo Station before 6.8.3-3463 and before 6.3-2971 allows remote authenticated users to execute arbitrary codes via the prog_id parameter.

8.8CVSS8.5AI score0.01375EPSS
CVE
CVE•added 2017/04/10 6:59 p.m.•44 views

CVE-2016-10323

Synology Photo Station before 6.3-2958 allows local users to gain privileges by leveraging setuid execution of a "synophoto_dsm_user --copy-no-ea" command.

7.8CVSS7.6AI score0.0004EPSS
CVE
CVE•added 2017/08/08 3:29 p.m.•43 views

CVE-2017-11154

Unrestricted file upload vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to create arbitrary PHP scripts via the type parameter.

7.2CVSS7.5AI score0.06862EPSS
CVE
CVE•added 2017/09/08 2:29 p.m.•43 views

CVE-2017-12071

Server-side request forgery (SSRF) vulnerability in file_upload.php in Synology Photo Station before 6.7.4-3433 and 6.3-2968 allows remote authenticated users to download arbitrary local files via the url parameter.

6.5CVSS6.8AI score0.00344EPSS
CVE
CVE•added 2017/05/12 8:29 p.m.•42 views

CVE-2016-10329

Command injection vulnerability in login.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to execute arbitrary code via shell metacharacters in the crafted 'X-Forwarded-For' header.

9.8CVSS9.7AI score0.15108EPSS
CVE
CVE•added 2017/09/08 2:29 p.m.•41 views

CVE-2017-11162

Directory traversal vulnerability in synphotoio in Synology Photo Station before 6.7.4-3433 and 6.3-2968 allows remote authenticated users to read arbitrary files via unspecified vectors.

6.5CVSS6.6AI score0.00375EPSS
CVE
CVE•added 2015/06/18 6:59 p.m.•40 views

CVE-2015-4656

Multiple cross-site scripting (XSS) vulnerabilities in Synology Photo Station before 6.3-2945 allow remote attackers to inject arbitrary web script or HTML via the (1) success parameter to login.php or (2) crafted URL parameters to index.php, as demonstrated by the t parameter to photo/.

4.3CVSS5.9AI score0.00285EPSS
CVE
CVE•added 2017/08/08 3:29 p.m.•40 views

CVE-2017-11152

Directory traversal vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to write arbitrary files via the path parameter.

7.5CVSS7.9AI score0.14053EPSS
CVE
CVE•added 2017/12/04 7:29 p.m.•40 views

CVE-2017-12080

An information exposure vulnerability in default HTTP configuration file in Synology Photo Station before 6.8.1-3458 and before 6.3-2970 allows remote attackers to obtain sensitive system information via .htaccess file.

5.3CVSS5.1AI score0.0023EPSS
CVE
CVE•added 2018/03/22 2:29 p.m.•39 views

CVE-2017-16771

Cross-site scripting (XSS) vulnerability in Log Viewer in Synology Photo Station before 6.8.3-3463 and before 6.3-2971 allows remote attackers to inject arbitrary web script or HTML via the username parameter.

6.1CVSS6AI score0.0025EPSS
CVE
CVE•added 2017/04/10 6:59 p.m.•38 views

CVE-2016-10322

Synology Photo Station before 6.3-2958 allows remote authenticated guest users to execute arbitrary commands via shell metacharacters in the X-Forwarded-For HTTP header to photo/login.php.

8.8CVSS8.7AI score0.02815EPSS
CVE
CVE•added 2017/08/24 7:29 p.m.•38 views

CVE-2017-9555

Cross-site scripting (XSS) vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.0-3414 allows remote attackers to inject arbitrary web script or HTML via the image parameter.

5.4CVSS5.4AI score0.00234EPSS
CVE
CVE•added 2018/06/08 1:29 p.m.•38 views

CVE-2018-8926

Permissive regular expression vulnerability in synophoto_dsm_user in Synology Photo Station before 6.8.5-3471 and before 6.3-2975 allows remote authenticated users to conduct privilege escalation attacks via the fullname parameter.

8.8CVSS8.5AI score0.00428EPSS
CVE
CVE•added 2018/06/08 1:29 p.m.•37 views

CVE-2018-8925

Cross-site request forgery (CSRF) vulnerability in admin/user.php in Synology Photo Station before 6.8.5-3471 and before 6.3-2975 allows remote attackers to hijack the authentication of administrators via the (1) username, (2) password, (3) admin, (4) action, (5) uid, or (6) modify_admin parameter.

8.8CVSS8.9AI score0.00145EPSS
CVE
CVE•added 2017/06/30 1:29 p.m.•35 views

CVE-2015-9102

Multiple cross-site scripting (XSS) vulnerabilities in Synology Photo Station 6.0 before 6.0-2638 and 6.3 before 6.3-2962 allow remote authenticated attackers to inject arbitrary web script or HTML via the (1) album name, (2) file name of uploaded photos, (3) description of photos, or (4) tag of th...

5.4CVSS5.1AI score0.00327EPSS
CVE
CVE•added 2017/05/12 8:29 p.m.•34 views

CVE-2016-10331

Directory traversal vulnerability in download.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to read arbitrary files via a full pathname in the id parameter.

7.5CVSS7.4AI score0.00391EPSS
CVE
CVE•added 2017/05/12 8:29 p.m.•32 views

CVE-2016-10330

Directory traversal vulnerability in synophoto_dsm_user, a SUID program, as used in Synology Photo Station before 6.5.3-3226 allows local users to write to arbitrary files via unspecified vectors.

7.1CVSS6.7AI score0.00054EPSS
CVE
CVE•added 2018/10/31 4:29 p.m.•31 views

CVE-2018-13282

Session fixation vulnerability in SYNO.PhotoStation.Auth in Synology Photo Station before 6.8.7-3481 allows remote attackers to hijack web sessions via the PHPSESSID parameter.

6.8CVSS6.3AI score0.00276EPSS