PS
Product
Photo Station
33
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 6High 15Medium 11Low 0
Watch
Add Photo Station to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-29092 | 8.8 | Jun 1 | Unrestricted upload of file with dangerous type vulnerability in file management component in Synology Photo Station before 6.8.14-3500 allows remote authenticated users to… Affected: 6.8 before 6.8.14-3500 |
| CVE-2018-8926 | 8.8 | Jun 8 | Permissive regular expression vulnerability in synophoto_dsm_user in Synology Photo Station before 6.8.5-3471 and before 6.3-2975 allows remote authenticated users to conduct… Affected: 6.3-2958 through 6.3-2975; 6.8.0-3456 before 6.8.5-3471 |
| CVE-2018-8925 | 8.8 | Jun 8 | Cross-site request forgery (CSRF) vulnerability in admin/user.php in Synology Photo Station before 6.8.5-3471 and before 6.3-2975 allows remote attackers to hijack the… Affected: 6.3-2944 before 6.3-2975; 6.8.0-3456 before 6.8.5-3471 |
| CVE-2017-16772 | 8.8 | Mar 22 | Improper input validation vulnerability in SYNOPHOTO_Flickr_MultiUpload in Synology Photo Station before 6.8.3-3463 and before 6.3-2971 allows remote authenticated users to… Affected: 6.8 before 6.8.3-3463; 6.3 before 6.3-2971 |
| CVE-2016-10322 | 8.8 | Apr 10 | Synology Photo Station before 6.3-2958 allows remote authenticated guest users to execute arbitrary commands via shell metacharacters in the X-Forwarded-For HTTP header to… Affected: through 6.3-2954 |
| CVE-2017-9552 | 7.8 | Jun 13 | A design flaw in authentication in Synology Photo Station 6.0-2528 through 6.7.1-3419 allows local users to obtain credentials via cmdline Affected: 6.0-2528; 6.0-2636; 6.0-2638; 6.0-2639; 6.0-2640; 6.3-2944; +18 more |
| CVE-2016-10323 | 7.8 | Apr 10 | Synology Photo Station before 6.3-2958 allows local users to gain privileges by leveraging setuid execution of a "synophoto_dsm_user --copy-no-ea" command Affected: before 6.3-2958 |
| CVE-2022-22681 | 7.5 | Jul 6 | Session fixation vulnerability in access control management in Synology Photo Station before 6.8.16-3506 allows remote attackers to bypass security constraint via unspecified… Affected: before 6.8.16-3506 |
| CVE-2017-12079 | 7.5 | Dec 4 | Files or directories accessible to external parties vulnerability in picasa.php in Synology Photo Station before 6.8.1-3458 and before 6.3-2970 allows remote attackers to obtain… Affected: 6.8 before 6.8.1-3458; 6.3 before 6.3-2970 |
| CVE-2017-11155 | 7.5 | Aug 8 | An information exposure vulnerability in index.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to obtain sensitive system information via… Affected: through 6.7.2-3429; 6.3-2967 |
| CVE-2017-11152 | 7.5 | Aug 8 | Directory traversal vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to write arbitrary files via the path… Affected: through 6.7.2-3429; 6.3-2967 |
| CVE-2016-10331 | 7.5 | May 12 | Directory traversal vulnerability in download.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to read arbitrary files via a full pathname in the id… Affected: through 6.5.2-3225 |
| CVE-2021-29090 | 7.2 | Jun 2 | Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in PHP component in Synology Photo Station before 6.8.14-3500 allows remote… Affected: 6.8 before 6.8.14-3500 |
| CVE-2017-11154 | 7.2 | Aug 8 | Unrestricted file upload vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to create arbitrary PHP scripts… Affected: through 6.7.2-3429; 6.3-2967 |
| CVE-2016-10330 | 7.1 | May 12 | Directory traversal vulnerability in synophoto_dsm_user, a SUID program, as used in Synology Photo Station before 6.5.3-3226 allows local users to write to arbitrary files via… Affected: through 6.5.2-3225 |
Showing 15