Synology Carddav Server vulnerabilities

3 vulnerabilities

Known vulnerabilities in Synology Carddav Server, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

6.5CVE-2018-8928synologycarddav_server
EPSS score
0.80%
Cross-site scripting (XSS) vulnerability in Address Book Editor in Synology CardDAV Server before 6.0.8-0086 allows remote authenticated users to inject arbitrary web script or HTML via the (1) family_name, (2) given_name, or (3) additional_name parameter.8.8CVE-2022-27613synologycarddav_server
EPSS score
1.09%
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in webapi component in Synology CardDAV Server before 6.0.10-0153 allows remote authenticated users to inject SQL commands via unspecified vectors.9.8CVE-2017-15887synologycarddav_server+1
EPSS score
1.94%
An improper restriction of excessive authentication attempts vulnerability in /principals in Synology CardDAV Server before 6.0.7-0085 allows remote attackers to obtain user credentials via a brute-force attack.