Skip to content
OpenAdvisories
Medium · 6.5 CVE-2017-16774 EUVD-2017-7953GHSA-36vq-45p6-qv5c

Cross-site scripting (XSS) vulnerability in SYNO.Core.PersonalNotification.Event in Synology DiskStation Manager (DSM) before 6.1.4-15217-3…

Published Apr 1, 2019 · Updated Sep 16, 2024 · Assigned by synology

Vendor: Synology Product: DiskStation Manager (DSM)

Description

Cross-site scripting (XSS) vulnerability in SYNO.Core.PersonalNotification.Event in Synology DiskStation Manager (DSM) before 6.1.4-15217-3 allows remote authenticated users to inject arbitrary web script or HTML via the package parameter.

Affected products

VendorProductAffectedFixed
Synology DiskStation Manager (DSM) unspecified – < 6.1.4-15217-3 6.1.4-15217-3

References