Back to Database
Status published
Medium
CVE-2015-6909
Cross-site scripting (XSS) vulnerability in the "Create download task via...
Vulnerability Description
Cross-site scripting (XSS) vulnerability in the "Create download task via file upload" feature in Synology Download Station before 3.5-2962 allows remote attackers to inject arbitrary web script or HTML via the name element in the Info dictionary in a torrent file.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2015-6909
Credits & Attribution
No credits recorded in the NVD database.
References
- http://www.securityfocus.com/archive/1/536428/100/0/threaded
- http://packetstormsecurity.com/files/133520/Synology-Download-Station-3.5-2956-3.5-2962-Cross-Site-Scripting.html
- https://www.synology.com/en-global/releaseNote/DownloadStation?model=DS715
- https://www.securify.nl/advisory/SFY20150809/multiple_cross_site_scripting_vulnerabilities_in_synology_download_station.html
- https://www.synology.com/en-global/support/security/Download_Station_3_5_2962
- http://seclists.org/fulldisclosure/2015/Sep/32
More from synology
View All →CVE-2017-9554
An information exposure vulnerability in forget_passwd.cgi in Synology DiskStation Manager...
Medium
5.3
CVE-2017-9553
A design flaw in SYNO.API.Encryption in Synology DiskStation Manager (DSM)...
High
7.5
CVE-2017-16768
Cross-site scripting (XSS) vulnerability in User Policy editor in Synology...
Medium
4.8
CVE-2017-12077
Uncontrolled Resource Consumption vulnerability in SYNO.Core.PortForwarding.Rules in Synology Router Manager...
Medium
4.9
CVE-2017-12076
Uncontrolled Resource Consumption vulnerability in SYNO.Core.PortForwarding.Rules in Synology DiskStation (DSM)...
Medium
4.9
Affected Vendor
synology
View all reports →Affected Software
download station
Vulnerable Versions:
0
Timeline
Official Publish:
September 11th, 2015
Last Modified:
August 6th, 2024
Added to House:
July 19th, 2026
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.