Vulnerabilidades

Resumen — últimos 7 días

Vulnerabilidades nuevas2997▼ 66 respecto a la semana anterior

Críticas / altas1460▲ 109 respecto a la semana anterior

Nueva explotación activa (KEV)4▼ 5 respecto a la semana anterior

Sin puntuar (sin CVSS)339▼ 171 respecto a la semana anterior

61 resultados, ordenados por fecha de publicación (más recientes primero)

CVE	Estado	Severidad	EPSS	Explotación activa	Tecnologías afectadas	Publicada ▼	Modificada	Descripción
CVE-2017-11151	Modificada	Crítica (9.8)	16%	💥 Exploit	Synology Photo Station	8/8/2017	17/6/2026	A vulnerability in synotheme_upload.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to upload arbitrary files without authentication via the logo_upload action.
CVE-2015-9102	Modificada	Media (5.4)	0.89%	—	Synology Photo Station	30/6/2017	17/6/2026	Multiple cross-site scripting (XSS) vulnerabilities in Synology Photo Station 6.0 before 6.0-2638 and 6.3 before 6.3-2962 allow remote authenticated attackers to inject arbitrary web script or HTML via the (1) album name, (2) file name of uploaded photos, (3) description of photos, or (4) tag of the photos.
CVE-2017-9552	Modificada	Alta (7.8)	0.31%	—	Synology Photo Station	13/6/2017	17/6/2026	A design flaw in authentication in Synology Photo Station 6.0-2528 through 6.7.1-3419 allows local users to obtain credentials via cmdline. Synology Photo Station employs the synophoto_dsm_user program to authenticate username and password by "synophoto_dsm_user --auth USERNAME PASSWORD", and local users are able to…
CVE-2016-10331	Modificada	Alta (7.5)	2.2%	—	Synology Photo Station	12/5/2017	17/6/2026	Directory traversal vulnerability in download.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to read arbitrary files via a full pathname in the id parameter.
CVE-2016-10330	Modificada	Alta (7.1)	0.69%	—	Synology Photo Station	12/5/2017	17/6/2026	Directory traversal vulnerability in synophoto_dsm_user, a SUID program, as used in Synology Photo Station before 6.5.3-3226 allows local users to write to arbitrary files via unspecified vectors.
CVE-2016-10329	Modificada	Crítica (9.8)	41%	—	Synology Photo Station	12/5/2017	17/6/2026	Command injection vulnerability in login.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to execute arbitrary code via shell metacharacters in the crafted 'X-Forwarded-For' header.
CVE-2016-10323	Modificada	Alta (7.8)	0.59%	—	Synology Photo Station	10/4/2017	17/6/2026	Synology Photo Station before 6.3-2958 allows local users to gain privileges by leveraging setuid execution of a "synophoto_dsm_user --copy-no-ea" command.
CVE-2016-10322	Modificada	Alta (8.8)	1.9%	—	Synology Photo Station	10/4/2017	17/6/2026	Synology Photo Station before 6.3-2958 allows remote authenticated guest users to execute arbitrary commands via shell metacharacters in the X-Forwarded-For HTTP header to photo/login.php.
CVE-2015-4656	Modificada	Media (4.3)	1.2%	—	Synology Photo Station	18/6/2015	17/6/2026	Multiple cross-site scripting (XSS) vulnerabilities in Synology Photo Station before 6.3-2945 allow remote attackers to inject arbitrary web script or HTML via the (1) success parameter to login.php or (2) crafted URL parameters to index.php, as demonstrated by the t parameter to photo/.
CVE-2012-1556	Modificada	Media (4.3)	3.3%	💥 Exploit	Synology Diskstation Manager Synology Photo Station	12/9/2014	16/6/2026	Cross-site scripting (XSS) vulnerability in Synology Photo Station 5 for DiskStation Manager (DSM) 3.2-1955 allows remote attackers to inject arbitrary web script or HTML via the name parameter to photo/photo_one.php.
CVE-2013-5760	Modificada	Media (5)	1.3%	—	Qnap Photo Station Firmware Qnap Photo Station	9/6/2014	16/6/2026	QNAP Photo Station before firmware 4.0.3 build0912 allows remote attackers to list OS user accounts via a request to photo/p/api/list.php.