CVE-2015-6909

概要

参考情報

• packetstormsecurity.com/files/133520/Synology-Download-Station-3.5-2956-3.5-2962-Cross-Site-Scripting.html
• seclists.org/fulldisclosure/2015/Sep/32
• securityfocus.com/archive/1/536428/100/0/threaded
• securify.nl/advisory/SFY20150809/multiple_cross_site_scripting_vulnerabilities_in_synology_download_station.html · Exploit
• synology.com/en-global/releaseNote/DownloadStation · Vendor Advisory
• synology.com/en-global/support/security/Download_Station_3_5_2962 · Vendor Advisory

download station のその他の脆弱性

• CVE-2021-34811中 4.3Server-Side Request Forgery (SSRF) vulnerability in task management component in Synology Download Station before 3.8.16-3566 allows remote …
• CVE-2021-34810高 8.8Improper privilege management vulnerability in cgi component in Synology Download Station before 3.8.16-3566 allows remote authenticated use…
• CVE-2021-34809高 8.8Improper neutralization of special elements used in a command ('Command Injection') vulnerability in task management component in Synology D…
• CVE-2021-33184高 7.7Server-Side request forgery (SSRF) vulnerability in task management component in Synology Download Station before 3.8.15-3563 allows remote …
• CVE-2017-11156高 7.8Synology Download Station 3.8.x before 3.8.5-3475 and 3.x before 3.5-2984 uses weak permissions (0777) for ui/dlm/btsearch directory, which …