U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

National Vulnerability Database

National Vulnerability Database

NVD

National Vulnerability Database
  1. VulnerabilitiesSearch And Statistics

Search Results (Refine Search)

Search Parameters:
  • CPE Product Version: cpe:/a:synology:photo_station:6.3-2975
There are 18 matching records.
Displaying matches 1 through 18.
Vuln ID Summary CVSS Severity
CVE-2022-22681

Session fixation vulnerability in access control management in Synology Photo Station before 6.8.16-3506 allows remote attackers to bypass security constraint via unspecified vectors.

Published: July 06, 2022; 4:15:07 AM -0400 		V3.1: 7.5 HIGH
 V2.0: 5.0 MEDIUM
CVE-2019-11822

Relative path traversal vulnerability in SYNO.PhotoStation.File in Synology Photo Station before 6.8.11-3489 and before 6.3-2977 allows remote attackers to upload arbitrary files via the uploadphoto parameter.

Published: June 30, 2019; 11:15:09 AM -0400 		V3.1: 6.5 MEDIUM
 V2.0: 4.0 MEDIUM
CVE-2019-11821

SQL injection vulnerability in synophoto_csPhotoDB.php in Synology Photo Station before 6.8.11-3489 and before 6.3-2977 allows remote attackers to execute arbitrary SQL command via the type parameter.

Published: June 30, 2019; 11:15:09 AM -0400 		V3.1: 9.8 CRITICAL
 V2.0: 7.5 HIGH
CVE-2018-13282

Session fixation vulnerability in SYNO.PhotoStation.Auth in Synology Photo Station before 6.8.7-3481 allows remote attackers to hijack web sessions via the PHPSESSID parameter.

Published: October 31, 2018; 12:29:00 PM -0400 		V3.0: 6.3 MEDIUM
 V2.0: 6.8 MEDIUM
CVE-2018-8926

Permissive regular expression vulnerability in synophoto_dsm_user in Synology Photo Station before 6.8.5-3471 and before 6.3-2975 allows remote authenticated users to conduct privilege escalation attacks via the fullname parameter.

Published: June 08, 2018; 9:29:01 AM -0400 		V3.0: 8.8 HIGH
 V2.0: 6.5 MEDIUM
CVE-2017-12072

Cross-site scripting (XSS) vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.8.0-3456 allows remote authenticated users to inject arbitrary web scripts or HTML via the id parameter.

Published: December 20, 2017; 1:29:00 PM -0500 		V3.0: 5.4 MEDIUM
 V2.0: 3.5 LOW
CVE-2017-12071

Server-side request forgery (SSRF) vulnerability in file_upload.php in Synology Photo Station before 6.7.4-3433 and 6.3-2968 allows remote authenticated users to download arbitrary local files via the url parameter.

Published: September 08, 2017; 10:29:00 AM -0400 		V3.0: 6.5 MEDIUM
 V2.0: 4.0 MEDIUM
CVE-2017-11162

Directory traversal vulnerability in synphotoio in Synology Photo Station before 6.7.4-3433 and 6.3-2968 allows remote authenticated users to read arbitrary files via unspecified vectors.

Published: September 08, 2017; 10:29:00 AM -0400 		V3.0: 6.5 MEDIUM
 V2.0: 4.0 MEDIUM
CVE-2017-11161

Multiple SQL injection vulnerabilities in Synology Photo Station before 6.7.4-3433 and 6.3-2968 allow remote attackers to execute arbitrary SQL commands via the (1) article_id parameter to label.php; or (2) type parameter to synotheme.php.

Published: September 08, 2017; 10:29:00 AM -0400 		V3.0: 9.8 CRITICAL
 V2.0: 7.5 HIGH
CVE-2017-9555

Cross-site scripting (XSS) vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.0-3414 allows remote attackers to inject arbitrary web script or HTML via the image parameter.

Published: August 24, 2017; 3:29:00 PM -0400 		V3.0: 5.4 MEDIUM
 V2.0: 3.5 LOW
CVE-2017-11155

An information exposure vulnerability in index.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to obtain sensitive system information via unspecified vectors.

Published: August 08, 2017; 11:29:07 AM -0400 		V3.0: 7.5 HIGH
 V2.0: 5.0 MEDIUM
CVE-2017-11154

Unrestricted file upload vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to create arbitrary PHP scripts via the type parameter.

Published: August 08, 2017; 11:29:07 AM -0400 		V3.0: 7.2 HIGH
 V2.0: 6.5 MEDIUM
CVE-2017-11153

Deserialization vulnerability in synophoto_csPhotoMisc.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to gain administrator privileges via a crafted serialized payload.

Published: August 08, 2017; 11:29:07 AM -0400 		V3.0: 9.8 CRITICAL
 V2.0: 7.5 HIGH
CVE-2017-11152

Directory traversal vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to write arbitrary files via the path parameter.

Published: August 08, 2017; 11:29:07 AM -0400 		V3.0: 7.5 HIGH
 V2.0: 5.0 MEDIUM
CVE-2017-11151

A vulnerability in synotheme_upload.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to upload arbitrary files without authentication via the logo_upload action.

Published: August 08, 2017; 11:29:07 AM -0400 		V3.0: 9.8 CRITICAL
 V2.0: 7.5 HIGH
CVE-2016-10331

Directory traversal vulnerability in download.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to read arbitrary files via a full pathname in the id parameter.

Published: May 12, 2017; 4:29:00 PM -0400 		V3.0: 7.5 HIGH
 V2.0: 5.0 MEDIUM
CVE-2016-10330

Directory traversal vulnerability in synophoto_dsm_user, a SUID program, as used in Synology Photo Station before 6.5.3-3226 allows local users to write to arbitrary files via unspecified vectors.

Published: May 12, 2017; 4:29:00 PM -0400 		V3.0: 7.1 HIGH
 V2.0: 4.6 MEDIUM
CVE-2016-10329

Command injection vulnerability in login.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to execute arbitrary code via shell metacharacters in the crafted 'X-Forwarded-For' header.

Published: May 12, 2017; 4:29:00 PM -0400 		V3.0: 9.8 CRITICAL
 V2.0: 7.5 HIGH