CVE-2013-6987

Related Files

Diskstation Manager 4.3-3810 Data Append / Code Execution

Posted Mar 25, 2014

Authored by tiamat451

webman/imageSelector.cgi in Synology DiskStation Manager (DSM) 4.0 before 4.0-2259, 4.2 before 4.2-3243, and 4.3 before 4.3-3810 Update 1 allows remote attackers to append data to arbitrary files, and consequently execute arbitrary code, via a pathname in the SLICEUPLOAD X-TMP-FILE HTTP header.

tags | advisory, remote, web, arbitrary, cgi

advisories | CVE-2013-6955, CVE-2013-6987

SHA-256 | d20d6eda27bee2e48fd7dddd353b5841c8f19f449a5657951a591227c486e56e

Download | Favorite | View

Synology DSM 4.3-3810 Directory Traversal

Posted Dec 23, 2013

Authored by Andrea Fabrizi

Synology DSM versions 4.3-3810 and below suffer from multiple directory traversal vulnerabilities.

tags | exploit, vulnerability, file inclusion

advisories | CVE-2013-6987

SHA-256 | baddc783cba3ba3012c1d9f37e58531b749662074b81d95266d64e6544b90e21

Download | Favorite | View