Synology » Photo Station : Security Vulnerabilities, CVEs,
Session fixation vulnerability in access control management in Synology Photo Station before 6.8.16-3506 allows remote attackers to bypass security constraint via unspecified vectors.
Max CVSS
8.1
EPSS Score
0.08%
Published
2022-07-06
Updated
2022-07-14
Unrestricted upload of file with dangerous type vulnerability in file management component in Synology Photo Station before 6.8.14-3500 allows remote authenticated users to execute arbitrary code via unspecified vectors.
Max CVSS
8.8
EPSS Score
0.07%
Published
2021-06-01
Updated
2021-06-09
Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in file management component in Synology Photo Station before 6.8.14-3500 allows remote authenticated users to write arbitrary files via unspecified vectors.
Max CVSS
7.7
EPSS Score
0.06%
Published
2021-06-02
Updated
2021-06-10
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in PHP component in Synology Photo Station before 6.8.14-3500 allows remote authenticated users to execute arbitrary SQL command via unspecified vectors.
Max CVSS
9.0
EPSS Score
0.07%
Published
2021-06-02
Updated
2021-06-10
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in thumbnail component in Synology Photo Station before 6.8.14-3500 allows remote attackers users to execute arbitrary SQL commands via unspecified vectors.
Max CVSS
10.0
EPSS Score
0.07%
Published
2021-06-02
Updated
2021-06-10
Relative path traversal vulnerability in SYNO.PhotoStation.File in Synology Photo Station before 6.8.11-3489 and before 6.3-2977 allows remote attackers to upload arbitrary files via the uploadphoto parameter.
Max CVSS
6.5
EPSS Score
0.06%
Published
2019-06-30
Updated
2023-01-30
SQL injection vulnerability in synophoto_csPhotoDB.php in Synology Photo Station before 6.8.11-3489 and before 6.3-2977 allows remote attackers to execute arbitrary SQL command via the type parameter.
Max CVSS
9.8
EPSS Score
0.07%
Published
2019-06-30
Updated
2023-01-30
Session fixation vulnerability in SYNO.PhotoStation.Auth in Synology Photo Station before 6.8.7-3481 allows remote attackers to hijack web sessions via the PHPSESSID parameter.
Max CVSS
6.8
EPSS Score
0.10%
Published
2018-10-31
Updated
2019-10-09
Permissive regular expression vulnerability in synophoto_dsm_user in Synology Photo Station before 6.8.5-3471 and before 6.3-2975 allows remote authenticated users to conduct privilege escalation attacks via the fullname parameter.
Max CVSS
8.8
EPSS Score
0.07%
Published
2018-06-08
Updated
2019-10-09
Cross-site request forgery (CSRF) vulnerability in admin/user.php in Synology Photo Station before 6.8.5-3471 and before 6.3-2975 allows remote attackers to hijack the authentication of administrators via the (1) username, (2) password, (3) admin, (4) action, (5) uid, or (6) modify_admin parameter.
Max CVSS
8.8
EPSS Score
0.06%
Published
2018-06-08
Updated
2019-10-09
Improper input validation vulnerability in SYNOPHOTO_Flickr_MultiUpload in Synology Photo Station before 6.8.3-3463 and before 6.3-2971 allows remote authenticated users to execute arbitrary codes via the prog_id parameter.
Max CVSS
8.8
EPSS Score
0.07%
Published
2018-03-22
Updated
2019-10-09
Cross-site scripting (XSS) vulnerability in Log Viewer in Synology Photo Station before 6.8.3-3463 and before 6.3-2971 allows remote attackers to inject arbitrary web script or HTML via the username parameter.
Max CVSS
6.1
EPSS Score
0.13%
Published
2018-03-22
Updated
2019-10-09
Exposure of private information vulnerability in Photo Viewer in Synology Photo Station 6.8.1-3458 allows remote attackers to obtain metadata from password-protected photographs via the map viewer mode.
Max CVSS
5.3
EPSS Score
0.13%
Published
2018-02-23
Updated
2019-10-09
An information exposure vulnerability in default HTTP configuration file in Synology Photo Station before 6.8.1-3458 and before 6.3-2970 allows remote attackers to obtain sensitive system information via .htaccess file.
Max CVSS
5.3
EPSS Score
0.13%
Published
2017-12-04
Updated
2019-10-09
Files or directories accessible to external parties vulnerability in picasa.php in Synology Photo Station before 6.8.1-3458 and before 6.3-2970 allows remote attackers to obtain arbitrary files via prog_id field.
Max CVSS
7.5
EPSS Score
0.13%
Published
2017-12-04
Updated
2019-10-09
Cross-site scripting (XSS) vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.8.0-3456 allows remote authenticated users to inject arbitrary web scripts or HTML via the id parameter.
Max CVSS
5.4
EPSS Score
0.05%
Published
2017-12-20
Updated
2019-10-09
Server-side request forgery (SSRF) vulnerability in file_upload.php in Synology Photo Station before 6.7.4-3433 and 6.3-2968 allows remote authenticated users to download arbitrary local files via the url parameter.
Max CVSS
6.5
EPSS Score
0.06%
Published
2017-09-08
Updated
2019-10-09
Directory traversal vulnerability in synphotoio in Synology Photo Station before 6.7.4-3433 and 6.3-2968 allows remote authenticated users to read arbitrary files via unspecified vectors.
Max CVSS
6.5
EPSS Score
0.06%
Published
2017-09-08
Updated
2019-10-09
Multiple SQL injection vulnerabilities in Synology Photo Station before 6.7.4-3433 and 6.3-2968 allow remote attackers to execute arbitrary SQL commands via the (1) article_id parameter to label.php; or (2) type parameter to synotheme.php.
Max CVSS
9.8
EPSS Score
0.07%
Published
2017-09-08
Updated
2019-10-09
An information exposure vulnerability in index.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to obtain sensitive system information via unspecified vectors.
Max CVSS
7.5
EPSS Score
45.78%
Published
2017-08-08
Updated
2019-10-09
Unrestricted file upload vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to create arbitrary PHP scripts via the type parameter.
Max CVSS
7.2
EPSS Score
45.11%
Published
2017-08-08
Updated
2019-10-09
Deserialization vulnerability in synophoto_csPhotoMisc.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to gain administrator privileges via a crafted serialized payload.
Max CVSS
9.8
EPSS Score
80.35%
Published
2017-08-08
Updated
2019-10-09
Directory traversal vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to write arbitrary files via the path parameter.
Max CVSS
7.5
EPSS Score
0.19%
Published
2017-08-08
Updated
2019-10-09
A vulnerability in synotheme_upload.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to upload arbitrary files without authentication via the logo_upload action.
Max CVSS
9.8
EPSS Score
61.01%
Published
2017-08-08
Updated
2019-10-09
Cross-site scripting (XSS) vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.0-3414 allows remote attackers to inject arbitrary web script or HTML via the image parameter.
Max CVSS
5.4
EPSS Score
0.05%
Published
2017-08-24
Updated
2019-10-09