PS
Product
Photo Station
34
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 7High 15Medium 11Low 0
Watch
Add Photo Station to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-10443 | 9.8 | Nov 15 | Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in Task Manager component in Synology BeePhotos before 1.0.2-10026 and… Affected: before 1.6.2-0720 |
| CVE-2021-29089 | 9.8 | Jun 2 | Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in thumbnail component in Synology Photo Station before 6.8.14-3500 allows… Affected: 6.8 before 6.8.14-3500 |
| CVE-2019-11821 | 9.8 | Jun 30 | SQL injection vulnerability in synophoto_csPhotoDB.php in Synology Photo Station before 6.8.11-3489 and before 6.3-2977 allows remote attackers to execute arbitrary SQL command… Affected: 6.3 before 6.3-2977; 6.8 before 6.8.11-3489 |
| CVE-2017-11161 | 9.8 | Sep 8 | Multiple SQL injection vulnerabilities in Synology Photo Station before 6.7.4-3433 and 6.3-2968 allow remote attackers to execute arbitrary SQL commands via the (1) article_id… Affected: through 6.3-2967; through 6.7.3-3432 |
| CVE-2017-11153 | 9.8 | Aug 8 | Deserialization vulnerability in synophoto_csPhotoMisc.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to gain administrator privileges via a… Affected: through 6.7.2-3429; 6.3-2967 |
| CVE-2017-11151 | 9.8 | Aug 8 | A vulnerability in synotheme_upload.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to upload arbitrary files without authentication via the… Affected: through 6.7.2-3429; 6.3-2967 |
| CVE-2016-10329 | 9.8 | May 12 | Command injection vulnerability in login.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to execute arbitrary code via shell metacharacters in the crafted… Affected: through 6.5.2-3225 |
| CVE-2021-29092 | 8.8 | Jun 1 | Unrestricted upload of file with dangerous type vulnerability in file management component in Synology Photo Station before 6.8.14-3500 allows remote authenticated users to… Affected: 6.8 before 6.8.14-3500 |
| CVE-2018-8926 | 8.8 | Jun 8 | Permissive regular expression vulnerability in synophoto_dsm_user in Synology Photo Station before 6.8.5-3471 and before 6.3-2975 allows remote authenticated users to conduct… Affected: 6.3-2958 through 6.3-2975; 6.8.0-3456 before 6.8.5-3471 |
| CVE-2018-8925 | 8.8 | Jun 8 | Cross-site request forgery (CSRF) vulnerability in admin/user.php in Synology Photo Station before 6.8.5-3471 and before 6.3-2975 allows remote attackers to hijack the… Affected: 6.3-2944 before 6.3-2975; 6.8.0-3456 before 6.8.5-3471 |
| CVE-2017-16772 | 8.8 | Mar 22 | Improper input validation vulnerability in SYNOPHOTO_Flickr_MultiUpload in Synology Photo Station before 6.8.3-3463 and before 6.3-2971 allows remote authenticated users to… Affected: 6.8 before 6.8.3-3463; 6.3 before 6.3-2971 |
| CVE-2016-10322 | 8.8 | Apr 10 | Synology Photo Station before 6.3-2958 allows remote authenticated guest users to execute arbitrary commands via shell metacharacters in the X-Forwarded-For HTTP header to… Affected: through 6.3-2954 |
| CVE-2017-9552 | 7.8 | Jun 13 | A design flaw in authentication in Synology Photo Station 6.0-2528 through 6.7.1-3419 allows local users to obtain credentials via cmdline Affected: 6.0-2528; 6.0-2636; 6.0-2638; 6.0-2639; 6.0-2640; 6.3-2944; +18 more |
| CVE-2016-10323 | 7.8 | Apr 10 | Synology Photo Station before 6.3-2958 allows local users to gain privileges by leveraging setuid execution of a "synophoto_dsm_user --copy-no-ea" command Affected: before 6.3-2958 |
| CVE-2022-22681 | 7.5 | Jul 6 | Session fixation vulnerability in access control management in Synology Photo Station before 6.8.16-3506 allows remote attackers to bypass security constraint via unspecified… Affected: before 6.8.16-3506 |
| CVE-2017-12079 | 7.5 | Dec 4 | Files or directories accessible to external parties vulnerability in picasa.php in Synology Photo Station before 6.8.1-3458 and before 6.3-2970 allows remote attackers to obtain… Affected: 6.8 before 6.8.1-3458; 6.3 before 6.3-2970 |
| CVE-2017-11155 | 7.5 | Aug 8 | An information exposure vulnerability in index.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to obtain sensitive system information via… Affected: through 6.7.2-3429; 6.3-2967 |
| CVE-2017-11152 | 7.5 | Aug 8 | Directory traversal vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to write arbitrary files via the path… Affected: through 6.7.2-3429; 6.3-2967 |
| CVE-2016-10331 | 7.5 | May 12 | Directory traversal vulnerability in download.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to read arbitrary files via a full pathname in the id… Affected: through 6.5.2-3225 |
| CVE-2021-29090 | 7.2 | Jun 2 | Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in PHP component in Synology Photo Station before 6.8.14-3500 allows remote… Affected: 6.8 before 6.8.14-3500 |
| CVE-2017-11154 | 7.2 | Aug 8 | Unrestricted file upload vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to create arbitrary PHP scripts… Affected: through 6.7.2-3429; 6.3-2967 |
| CVE-2016-10330 | 7.1 | May 12 | Directory traversal vulnerability in synophoto_dsm_user, a SUID program, as used in Synology Photo Station before 6.5.3-3226 allows local users to write to arbitrary files via… Affected: through 6.5.2-3225 |
| CVE-2021-29091 | 6.5 | Jun 2 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in file management component in Synology Photo Station before 6.8.14-3500 allows… Affected: 6.8 before 6.8.14-3500 |
| CVE-2019-11822 | 6.5 | Jun 30 | Relative path traversal vulnerability in SYNO.PhotoStation.File in Synology Photo Station before 6.8.11-3489 and before 6.3-2977 allows remote attackers to upload arbitrary files… Affected: 6.3 before 6.3-2977; 6.8 before 6.8.11-3489 |
| CVE-2017-12071 | 6.5 | Sep 8 | Server-side request forgery (SSRF) vulnerability in file_upload.php in Synology Photo Station before 6.7.4-3433 and 6.3-2968 allows remote authenticated users to download… Affected: through 6.3-2967; through 6.7.3-3432 |
| CVE-2017-11162 | 6.5 | Sep 8 | Directory traversal vulnerability in synphotoio in Synology Photo Station before 6.7.4-3433 and 6.3-2968 allows remote authenticated users to read arbitrary files via unspecified… Affected: through 6.3-2967; through 6.7.3-3432 |
| CVE-2018-13282 | 6.3 | Oct 31 | Session fixation vulnerability in SYNO.PhotoStation.Auth in Synology Photo Station before 6.8.7-3481 allows remote attackers to hijack web sessions via the PHPSESSID parameter Affected: 6.3 before 6.3-2976; 6.8 before 6.8.7-3481 |
| CVE-2017-16771 | 6.1 | Mar 22 | Cross-site scripting (XSS) vulnerability in Log Viewer in Synology Photo Station before 6.8.3-3463 and before 6.3-2971 allows remote attackers to inject arbitrary web script or… Affected: 6.8 before 6.8.3-3463; 6.3 before 6.3-2971 |
| CVE-2017-12072 | 5.4 | Dec 20 | Cross-site scripting (XSS) vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.8.0-3456 allows remote authenticated users to inject arbitrary web scripts or… Affected: before 6.8.0-3456 |
| CVE-2017-9555 | 5.4 | Aug 24 | Cross-site scripting (XSS) vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.0-3414 allows remote attackers to inject arbitrary web script or HTML via… Affected: through 6.6.3-3347 |
| CVE-2015-9102 | 5.4 | Jun 30 | Multiple cross-site scripting (XSS) vulnerabilities in Synology Photo Station 6.0 before 6.0-2638 and 6.3 before 6.3-2962 allow remote authenticated attackers to inject arbitrary… Affected: through 6.3-2960 |
| CVE-2017-16769 | 5.3 | Feb 23 | Exposure of private information vulnerability in Photo Viewer in Synology Photo Station 6.8.1-3458 allows remote attackers to obtain metadata from password-protected photographs… Affected: 6.8.1-3458 |
| CVE-2017-12080 | 5.3 | Dec 4 | An information exposure vulnerability in default HTTP configuration file in Synology Photo Station before 6.8.1-3458 and before 6.3-2970 allows remote attackers to obtain… Affected: 6.3 before 6.3-2970; 6.8 before 6.8.1-3458 |
| CVE-2015-4656 | – | Jun 18 | Multiple cross-site scripting (XSS) vulnerabilities in Synology Photo Station before 6.3-2945 allow remote attackers to inject arbitrary web script or HTML via the (1) success… Affected: through 6.3-2944 |
Showing 34