📦

carddav_server

Vendor: synology

Login to add this product to WatchStack
Actively Exploited 0 CISA KEV List
PoC / Exploits 0 Code Available
Total RCEs 0 Remote Access
Total CVEs 21 Total Indexed
Avg. EPSS 1.22% Exploit Prob.
Latest CVE CVE-2022-27613 Jul 28

Security Vulnerability Index

Page 1 / 3
8.3 CVSS
CVE-2022-27613

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in webapi component in Synology CardDAV Server before 6.0.10-0153 allows remote authenticated users to inject SQL commands via unspecified vectors.

EPSS: 0.91%
6.5 CVSS
CVE-2018-8928

Cross-site scripting (XSS) vulnerability in Address Book Editor in Synology CardDAV Server before 6.0.8-0086 allows remote authenticated users to inject arbitrary web script or HTML via the (1) family_name, (2) given_name, or (3) additional_name parameter.

EPSS: 0.80%
9.8 CVSS
CVE-2017-15887

An improper restriction of excessive authentication attempts vulnerability in /principals in Synology CardDAV Server before 6.0.7-0085 allows remote attackers to obtain user credentials via a brute-force attack.

EPSS: 1.94%