Synology Photo Station

6.0-2528 through 6.7.1-3419

OTHER 1 CVE

6.8.1-3458

OTHER 1 CVE

before 6.7.3-3432 and 6.3-2967

OTHER 5 CVEs

unspecified

OTHER 4 CVEs

before 6.7.4-3433 and 6.3-2968

OTHER 3 CVEs

All versions prior to version 6.5.3-3226

OTHER 3 CVEs

before 6.7.0-3414

OTHER 1 CVE

CVE-2021-29089

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in thumbnail component in Synology Photo Station before 6.8.14-3500 allows remote attackers users to execute arbitrary SQL commands via unspecified vectors.

CRITICAL Jun 02, 2021

CVE-2021-29090

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in PHP component in Synology Photo Station before 6.8.14-3500 allows remote authenticated users to execute arbitrary SQL command via unspecified vectors.

HIGH Jun 02, 2021

CVE-2021-29091

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in file management component in Synology Photo Station before 6.8.14-3500 allows remote authenticated users to write arbitrary files via unspecified vectors.

HIGH Jun 02, 2021

CVE-2021-29092

Unrestricted upload of file with dangerous type vulnerability in file management component in Synology Photo Station before 6.8.14-3500 allows remote authenticated users to execute arbitrary code via unspecified vectors.

HIGH Jun 01, 2021