CVEvulnerability
CVE-2015-9102
5.4 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2017-06-30
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 5.4 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- CVSS 2.0 ([email protected])
- 3.5 LOW — AV:N/AC:M/Au:S/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Multiple cross-site scripting (XSS) vulnerabilities in Synology Photo Station 6.0 before 6.0-2638 and 6.3 before 6.3-2962 allow remote authenticated attackers to inject arbitrary web script or HTML via the (1) album name, (2) file name of uploaded photos, (3) description of photos, or (4) tag of the photos.
Affected configurations
• synology photo station (<= 6.3-2960)
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://www.fortiguard.com/zeroday/FG-VD-15-103 Third Party Advisory
- http://www.fortiguard.com/zeroday/FG-VD-15-104 Third Party Advisory
- http://www.fortiguard.com/zeroday/FG-VD-15-109 Third Party Advisory
- http://www.fortiguard.com/zeroday/FG-VD-15-112 Third Party Advisory
- https://www.synology.com/en-global/support/security/Photo_Station_6_3_2962 Vendor Advisory
- http://www.fortiguard.com/zeroday/FG-VD-15-103 Third Party Advisory
- http://www.fortiguard.com/zeroday/FG-VD-15-104 Third Party Advisory
- http://www.fortiguard.com/zeroday/FG-VD-15-109 Third Party Advisory
- http://www.fortiguard.com/zeroday/FG-VD-15-112 Third Party Advisory
- https://www.synology.com/en-global/support/security/Photo_Station_6_3_2962 Vendor Advisory