Vulnerabilities > Synology > Calendar > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2021-06-18 | CVE-2021-34812 | Use of Hard-coded Credentials vulnerability in Synology Calendar Use of hard-coded credentials vulnerability in php component in Synology Calendar before 2.4.0-0761 allows remote attackers to obtain sensitive information via unspecified vectors. | 5.0 |
| 2019-06-30 | CVE-2019-11825 | Cross-site Scripting vulnerability in Synology Calendar Cross-site scripting (XSS) vulnerability in Event Editor in Synology Calendar before 2.3.0-0615 allows remote attackers to inject arbitrary web script or HTML via the title parameter. | 5.4 |
| 2019-04-01 | CVE-2018-13299 | Path Traversal vulnerability in Synology Calendar Relative path traversal vulnerability in Attachment Uploader in Synology Calendar before 2.2.2-0532 allows remote authenticated users to upload arbitrary files via the filename parameter. | 4.0 |
| 2018-06-14 | CVE-2018-8927 | Incorrect Authorization vulnerability in Synology Calendar Improper authorization vulnerability in SYNO.Cal.Event in Calendar before 2.1.2-0511 allows remote authenticated users to create arbitrary events via the (1) cal_id or (2) original_cal_id parameter. | 4.0 |
| 2017-12-08 | CVE-2017-15891 | Unspecified vulnerability in Synology Calendar Improper access control vulnerability in SYNO.Cal.EventBase in Synology Calendar before 2.0.1-0242 allows remote authenticated users to modify calendar event via unspecified vectors. | 4.0 |