5.4

CVE-2015-9105

Multiple cross-site scripting (XSS) vulnerabilities in Synology Video Station 1.2 before 1.2-0455, 1.5 before 1.5-0772, and 1.6 before 1.6-0847 allow remote authenticated attackers to inject arbitrary web script or HTML via the (1) file name or (2) collection name of videos.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Synology ≫ Video Station Version 1.2-0439
Synology ≫ Video Station Version 1.2-0443
Synology ≫ Video Station Version 1.2-0447
Synology ≫ Video Station Version 1.2-0451
Synology ≫ Video Station Version 1.2-0453
Synology ≫ Video Station Version 1.5-0753
Synology ≫ Video Station Version 1.5-0754
Synology ≫ Video Station Version 1.5-0757
Synology ≫ Video Station Version 1.5-0763
Synology ≫ Video Station Version 1.5-0770
Synology ≫ Video Station Version 1.6-0835
Synology ≫ Video Station Version 1.6-0840
Synology ≫ Video Station Version 1.6-0841
Synology ≫ Video Station Version 1.6-0844
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.82% 0.524
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 5.4 2.3 2.7
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
NIST 3.5 6.8 2.9
AV:N/AC:M/Au:S/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

http://www.fortiguard.com/zeroday/FG-VD-15-107
Third Party Advisory
http://www.fortiguard.com/zeroday/FG-VD-15-108
Third Party Advisory
https://www.synology.com/en-global/support/security/Video_station_1_5_0772
Vendor Advisory