CveMateVulnerability intelligence

Synology Photo Station vulnerabilities

33 vulnerabilities

Known vulnerabilities in Synology Photo Station, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

CVE-2018-13282synologyphoto_station7y ago31-10-2018 16:00

Session fixation vulnerability in SYNO.PhotoStation.Auth in Synology Photo Station before 6.8.7-3481 allows remote attackers to hijack web sessions via the PHPSESSID parameter.CVE-2018-8925synologyphoto_station8y ago08-06-2018 13:00

Cross-site request forgery (CSRF) vulnerability in admin/user.php in Synology Photo Station before 6.8.5-3471 and before 6.3-2975 allows remote attackers to hijack the authentication of administrators via the (1) username, (2) password, (3) admin, (4) action, (5) uid, or (6) modify_admin parameter.CVE-2018-8926synologyphoto_station8y ago08-06-2018 13:00

Permissive regular expression vulnerability in synophoto_dsm_user in Synology Photo Station before 6.8.5-3471 and before 6.3-2975 allows remote authenticated users to conduct privilege escalation attacks via the fullname parameter.CVE-2021-29091synologyphoto_station+15y ago02-06-2021 02:00

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in file management component in Synology Photo Station before 6.8.14-3500 allows remote authenticated users to write arbitrary files via unspecified vectors.CVE-2021-29089synologyphoto_station+15y ago02-06-2021 02:15

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in thumbnail component in Synology Photo Station before 6.8.14-3500 allows remote attackers users to execute arbitrary SQL commands via unspecified vectors.CVE-2021-29092synologyphoto_station+15y ago01-06-2021 09:45

Unrestricted upload of file with dangerous type vulnerability in file management component in Synology Photo Station before 6.8.14-3500 allows remote authenticated users to execute arbitrary code via unspecified vectors.CVE-2021-29090synologyphoto_station+15y ago02-06-2021 02:00

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in PHP component in Synology Photo Station before 6.8.14-3500 allows remote authenticated users to execute arbitrary SQL command via unspecified vectors.CVE-2015-9102synologyphoto_station9y ago30-06-2017 13:00

Multiple cross-site scripting (XSS) vulnerabilities in Synology Photo Station 6.0 before 6.0-2638 and 6.3 before 6.3-2962 allow remote authenticated attackers to inject arbitrary web script or HTML via the (1) album name, (2) file name of uploaded photos, (3) description of photos, or (4) tag of the photos.CVE-2015-4656synologyphoto_station11y ago18-06-2015 18:00

Multiple cross-site scripting (XSS) vulnerabilities in Synology Photo Station before 6.3-2945 allow remote attackers to inject arbitrary web script or HTML via the (1) success parameter to login.php or (2) crafted URL parameters to index.php, as demonstrated by the t parameter to photo/.CVE-2016-10329synologyphoto_station+19y ago12-05-2017 20:00

Command injection vulnerability in login.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to execute arbitrary code via shell metacharacters in the crafted 'X-Forwarded-For' header.CVE-2016-10322synologyphoto_station9y ago10-04-2017 18:00

Synology Photo Station before 6.3-2958 allows remote authenticated guest users to execute arbitrary commands via shell metacharacters in the X-Forwarded-For HTTP header to photo/login.php.CVE-2016-10323synologyphoto_station9y ago10-04-2017 18:00

Synology Photo Station before 6.3-2958 allows local users to gain privileges by leveraging setuid execution of a "synophoto_dsm_user --copy-no-ea" command.CVE-2016-10331synologyphoto_station+19y ago12-05-2017 20:00

Directory traversal vulnerability in download.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to read arbitrary files via a full pathname in the id parameter.CVE-2016-10330synologyphoto_station+19y ago12-05-2017 20:00

Directory traversal vulnerability in synophoto_dsm_user, a SUID program, as used in Synology Photo Station before 6.5.3-3226 allows local users to write to arbitrary files via unspecified vectors.CVE-2022-22681synologyphoto_station4y ago06-07-2022 07:35

Session fixation vulnerability in access control management in Synology Photo Station before 6.8.16-3506 allows remote attackers to bypass security constraint via unspecified vectors.CVE-2017-16772synologyphoto_station8y ago22-03-2018 14:00

Improper input validation vulnerability in SYNOPHOTO_Flickr_MultiUpload in Synology Photo Station before 6.8.3-3463 and before 6.3-2971 allows remote authenticated users to execute arbitrary codes via the prog_id parameter.CVE-2017-16769synologyphoto_station+18y ago23-02-2018 22:00

Exposure of private information vulnerability in Photo Viewer in Synology Photo Station 6.8.1-3458 allows remote attackers to obtain metadata from password-protected photographs via the map viewer mode.CVE-2017-16771synologyphoto_station8y ago22-03-2018 14:00

Cross-site scripting (XSS) vulnerability in Log Viewer in Synology Photo Station before 6.8.3-3463 and before 6.3-2971 allows remote attackers to inject arbitrary web script or HTML via the username parameter.CVE-2017-11151synologyphoto_station+19y ago08-08-2017 15:00

A vulnerability in synotheme_upload.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to upload arbitrary files without authentication via the logo_upload action.CVE-2017-11161synologyphoto_station+19y ago08-09-2017 14:00

Multiple SQL injection vulnerabilities in Synology Photo Station before 6.7.4-3433 and 6.3-2968 allow remote attackers to execute arbitrary SQL commands via the (1) article_id parameter to label.php; or (2) type parameter to synotheme.php.