CVE-2015-9105: XSS
First published: Fri Jun 30 2017(Updated: )
Multiple cross-site scripting (XSS) vulnerabilities in Synology Video Station 1.2 before 1.2-0455, 1.5 before 1.5-0772, and 1.6 before 1.6-0847 allow remote authenticated attackers to inject arbitrary web script or HTML via the (1) file name or (2) collection name of videos.
Credit: security@synology.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Synology Video Station | =1.2-0439 | |
| Synology Video Station | =1.2-0443 | |
| Synology Video Station | =1.2-0447 | |
| Synology Video Station | =1.2-0451 | |
| Synology Video Station | =1.2-0453 | |
| Synology Video Station | =1.5-0753 | |
| Synology Video Station | =1.5-0754 | |
| Synology Video Station | =1.5-0757 | |
| Synology Video Station | =1.5-0763 | |
| Synology Video Station | =1.5-0770 | |
| Synology Video Station | =1.6-0835 | |
| Synology Video Station | =1.6-0840 | |
| Synology Video Station | =1.6-0841 | |
| Synology Video Station | =1.6-0844 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2015-9105?
CVE-2015-9105 has been classified as a medium severity vulnerability due to the potential for cross-site scripting attacks.
How do I fix CVE-2015-9105?
To fix CVE-2015-9105, upgrade to Synology Video Station version 1.2-0455, 1.5-0772, or 1.6-0847 or later.
Who is affected by CVE-2015-9105?
CVE-2015-9105 affects users of Synology Video Station versions before 1.2-0455, 1.5-0772, and 1.6-0847.
What type of vulnerabilities does CVE-2015-9105 include?
CVE-2015-9105 includes multiple cross-site scripting (XSS) vulnerabilities.
Can CVE-2015-9105 be exploited remotely?
Yes, CVE-2015-9105 can be exploited by remote authenticated attackers.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- agent/severity
- agent/author
- agent/weakness
- agent/references
- agent/tags
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- vendor/synology
- canonical/synology video station
- version/synology video station/1.2-0439
- version/synology video station/1.2-0443
- version/synology video station/1.2-0447
- version/synology video station/1.2-0451
- version/synology video station/1.2-0453
- version/synology video station/1.5-0753
- version/synology video station/1.5-0754
- version/synology video station/1.5-0757
- version/synology video station/1.5-0763
- version/synology video station/1.5-0770
- version/synology video station/1.6-0835
- version/synology video station/1.6-0840
- version/synology video station/1.6-0841
- version/synology video station/1.6-0844