CVE-2015-9105

Multiple cross-site scripting (XSS) vulnerabilities in Synology Video Station 1.2 before 1.2-0455, 1.5 before 1.5-0772, and 1.6 before 1.6-0847 allow remote authenticated attackers to inject arbitrary web script or HTML via the (1) file name or (2) collection name of videos.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5.4 MEDIUM
NETWORK
LOW
LOW
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
synologyCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 47%
VendorProductVersion
synologyvideo_station
1.2-0439
synologyvideo_station
1.2-0443
synologyvideo_station
1.2-0447
synologyvideo_station
1.2-0451
synologyvideo_station
1.2-0453
synologyvideo_station
1.5-0753
synologyvideo_station
1.5-0754
synologyvideo_station
1.5-0757
synologyvideo_station
1.5-0763
synologyvideo_station
1.5-0770
synologyvideo_station
1.6-0835
synologyvideo_station
1.6-0840
synologyvideo_station
1.6-0841
synologyvideo_station
1.6-0844
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://www.fortiguard.com/zeroday/FG-VD-15-107
http://www.fortiguard.com/zeroday/FG-VD-15-108
https://www.synology.com/en-global/support/security/Video_station_1_5_0772
http://www.fortiguard.com/zeroday/FG-VD-15-107
http://www.fortiguard.com/zeroday/FG-VD-15-108
https://www.synology.com/en-global/support/security/Video_station_1_5_0772