CVE-2015-9102

Опубликовано: 30 июн. 2017

Источник: nvd

CVSS3: 5.4

CVSS2: 3.5

EPSS Низкий

Описание

Multiple cross-site scripting (XSS) vulnerabilities in Synology Photo Station 6.0 before 6.0-2638 and 6.3 before 6.3-2962 allow remote authenticated attackers to inject arbitrary web script or HTML via the (1) album name, (2) file name of uploaded photos, (3) description of photos, or (4) tag of the photos.

Ссылки

http://www.fortiguard.com/zeroday/FG-VD-15-103
Third Party Advisory
http://www.fortiguard.com/zeroday/FG-VD-15-104
Third Party Advisory
http://www.fortiguard.com/zeroday/FG-VD-15-109
Third Party Advisory
http://www.fortiguard.com/zeroday/FG-VD-15-112
Third Party Advisory
https://www.synology.com/en-global/support/security/Photo_Station_6_3_2962
Vendor Advisory
http://www.fortiguard.com/zeroday/FG-VD-15-103
Third Party Advisory
http://www.fortiguard.com/zeroday/FG-VD-15-104
Third Party Advisory
http://www.fortiguard.com/zeroday/FG-VD-15-109
Third Party Advisory
http://www.fortiguard.com/zeroday/FG-VD-15-112
Third Party Advisory
https://www.synology.com/en-global/support/security/Photo_Station_6_3_2962
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:synology:photo_station:*:*:*:*:*:*:*:*

Версия до 6.3-2960 (включая)

EPSS

Процентиль: 55%

0.00327

Низкий

5.4 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-qj43-2xgx-mhc3