Vulnerabilities > Synology > Photo Station > 6.8.9.3483

DATE CVE VULNERABILITY TITLE RISK
2022-07-06 CVE-2022-22681 Unspecified vulnerability in Synology Photo Station
Session fixation vulnerability in access control management in Synology Photo Station before 6.8.16-3506 allows remote attackers to bypass security constraint via unspecified vectors.
network
low complexity
synology
7.5
2021-06-02 CVE-2021-29089 Unspecified vulnerability in Synology Photo Station
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in thumbnail component in Synology Photo Station before 6.8.14-3500 allows remote attackers users to execute arbitrary SQL commands via unspecified vectors.
network
low complexity
synology
critical
9.8
2021-06-02 CVE-2021-29090 Unspecified vulnerability in Synology Photo Station
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in PHP component in Synology Photo Station before 6.8.14-3500 allows remote authenticated users to execute arbitrary SQL command via unspecified vectors.
network
low complexity
synology
7.2
2021-06-02 CVE-2021-29091 Unspecified vulnerability in Synology Photo Station
Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in file management component in Synology Photo Station before 6.8.14-3500 allows remote authenticated users to write arbitrary files via unspecified vectors.
network
low complexity
synology
6.5
2021-06-01 CVE-2021-29092 Unspecified vulnerability in Synology Photo Station
Unrestricted upload of file with dangerous type vulnerability in file management component in Synology Photo Station before 6.8.14-3500 allows remote authenticated users to execute arbitrary code via unspecified vectors.
network
low complexity
synology
8.8
2019-06-30 CVE-2019-11822 Path Traversal vulnerability in Synology Photo Station
Relative path traversal vulnerability in SYNO.PhotoStation.File in Synology Photo Station before 6.8.11-3489 and before 6.3-2977 allows remote attackers to upload arbitrary files via the uploadphoto parameter.
network
low complexity
synology CWE-22
6.5
2019-06-30 CVE-2019-11821 SQL Injection vulnerability in Synology Photo Station
SQL injection vulnerability in synophoto_csPhotoDB.php in Synology Photo Station before 6.8.11-3489 and before 6.3-2977 allows remote attackers to execute arbitrary SQL command via the type parameter.
network
low complexity
synology CWE-89
critical
9.8