CVE-2015-9102

EUVD-2015-8955
Multiple cross-site scripting (XSS) vulnerabilities in Synology Photo Station 6.0 before 6.0-2638 and 6.3 before 6.3-2962 allow remote authenticated attackers to inject arbitrary web script or HTML via the (1) album name, (2) file name of uploaded photos, (3) description of photos, or (4) tag of the photos.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.4 MEDIUM
NETWORK
LOW
LOW
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 55%
Affected Products (NVD)
VendorProductVersion
synologyphoto_station
𝑥
≤ 6.3-2960
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://www.fortiguard.com/zeroday/FG-VD-15-103
http://www.fortiguard.com/zeroday/FG-VD-15-104
http://www.fortiguard.com/zeroday/FG-VD-15-109
http://www.fortiguard.com/zeroday/FG-VD-15-112
https://www.synology.com/en-global/support/security/Photo_Station_6_3_2962
http://www.fortiguard.com/zeroday/FG-VD-15-103
http://www.fortiguard.com/zeroday/FG-VD-15-104
http://www.fortiguard.com/zeroday/FG-VD-15-109
http://www.fortiguard.com/zeroday/FG-VD-15-112
https://www.synology.com/en-global/support/security/Photo_Station_6_3_2962