CVE-2015-9105

MEDIUM

Synology Video Station 1.2-0455 1.5-0772 1.6-0847 - Authenticated Cross-Site Scripting via File or Collection Name

Title source: llm
STIX 2.1

Description

Multiple cross-site scripting (XSS) vulnerabilities in Synology Video Station 1.2 before 1.2-0455, 1.5 before 1.5-0772, and 1.6 before 1.6-0847 allow remote authenticated attackers to inject arbitrary web script or HTML via the (1) file name or (2) collection name of videos.

References (3)

Core 3
Core References
Third Party Advisory x_refsource_misc
http://www.fortiguard.com/zeroday/FG-VD-15-107
Third Party Advisory x_refsource_misc
http://www.fortiguard.com/zeroday/FG-VD-15-108

Scores

CVSS v3 5.4
EPSS 0.0025
EPSS Percentile 47.9%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (17)
Synology/Video Station 1.2
Synology/Video Station 1.5
Synology/Video Station 1.6
synology/video_station 1.2-0439
synology/video_station 1.2-0443
synology/video_station 1.2-0447
synology/video_station 1.2-0451
synology/video_station 1.2-0453
synology/video_station 1.5-0753
synology/video_station 1.5-0754
... and 7 more
Published Jun 30, 2017
Tracked Since Feb 18, 2026