Skip to content
OpenAdvisories
Medium · 6.5 CVE-2018-8928 EUVD-2018-20536GHSA-j99q-wf38-m4gj

Cross-site scripting (XSS) vulnerability in Address Book Editor in Synology CardDAV Server before 6.0.8-0086 allows remote authenticated us…

Published Jul 5, 2018 · Updated Sep 17, 2024 · Assigned by synology

Vendor: Synology Product: CardDAV Server

Description

Cross-site scripting (XSS) vulnerability in Address Book Editor in Synology CardDAV Server before 6.0.8-0086 allows remote authenticated users to inject arbitrary web script or HTML via the (1) family_name, (2) given_name, or (3) additional_name parameter.

Affected products

VendorProductAffectedFixed
Synology CardDAV Server unspecified – < 6.0.8-0086 6.0.8-0086

References