Vulnerabilities > Synology > Photo Station > 6.8

DATE CVE VULNERABILITY TITLE RISK
2022-07-06 CVE-2022-22681 Unspecified vulnerability in Synology Photo Station
Session fixation vulnerability in access control management in Synology Photo Station before 6.8.16-3506 allows remote attackers to bypass security constraint via unspecified vectors.
network
low complexity
synology
7.5
2021-06-02 CVE-2021-29089 Unspecified vulnerability in Synology Photo Station
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in thumbnail component in Synology Photo Station before 6.8.14-3500 allows remote attackers users to execute arbitrary SQL commands via unspecified vectors.
network
low complexity
synology
critical
9.8
2021-06-02 CVE-2021-29090 Unspecified vulnerability in Synology Photo Station
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in PHP component in Synology Photo Station before 6.8.14-3500 allows remote authenticated users to execute arbitrary SQL command via unspecified vectors.
network
low complexity
synology
7.2
2021-06-02 CVE-2021-29091 Unspecified vulnerability in Synology Photo Station
Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in file management component in Synology Photo Station before 6.8.14-3500 allows remote authenticated users to write arbitrary files via unspecified vectors.
network
low complexity
synology
6.5
2021-06-01 CVE-2021-29092 Unspecified vulnerability in Synology Photo Station
Unrestricted upload of file with dangerous type vulnerability in file management component in Synology Photo Station before 6.8.14-3500 allows remote authenticated users to execute arbitrary code via unspecified vectors.
network
low complexity
synology
8.8
2019-06-30 CVE-2019-11822 Path Traversal vulnerability in Synology Photo Station
Relative path traversal vulnerability in SYNO.PhotoStation.File in Synology Photo Station before 6.8.11-3489 and before 6.3-2977 allows remote attackers to upload arbitrary files via the uploadphoto parameter.
network
low complexity
synology CWE-22
6.5
2019-06-30 CVE-2019-11821 SQL Injection vulnerability in Synology Photo Station
SQL injection vulnerability in synophoto_csPhotoDB.php in Synology Photo Station before 6.8.11-3489 and before 6.3-2977 allows remote attackers to execute arbitrary SQL command via the type parameter.
network
low complexity
synology CWE-89
critical
9.8
2018-10-31 CVE-2018-13282 Session Fixation vulnerability in Synology Photo Station
Session fixation vulnerability in SYNO.PhotoStation.Auth in Synology Photo Station before 6.8.7-3481 allows remote attackers to hijack web sessions via the PHPSESSID parameter.
network
low complexity
synology CWE-384
6.3
2018-03-22 CVE-2017-16772 Improper Input Validation vulnerability in Synology Photo Station
Improper input validation vulnerability in SYNOPHOTO_Flickr_MultiUpload in Synology Photo Station before 6.8.3-3463 and before 6.3-2971 allows remote authenticated users to execute arbitrary codes via the prog_id parameter.
network
low complexity
synology CWE-20
8.8
2018-03-22 CVE-2017-16771 Cross-site Scripting vulnerability in Synology Photo Station
Cross-site scripting (XSS) vulnerability in Log Viewer in Synology Photo Station before 6.8.3-3463 and before 6.3-2971 allows remote attackers to inject arbitrary web script or HTML via the username parameter.
network
low complexity
synology CWE-79
6.1