Synology Moments vulnerabilities

2 CVEs affecting Synology Moments, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-11826, published 2019-06-30.

More from Synology.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2019-11826, published 2019-06-30. High severity, CVSS 8.8. EPSS: 1.7% chance of exploitation in the next 30 days. Relative path traversal vulnerability in SYNO.PhotoTeam.Upload.Item in Synology Moments before 1.3.0-0691 allows remote authenticated users to upload arbitrary files via the name parameter.
• CVE-2018-13298, published 2019-04-01. High severity, CVSS 8.1. EPSS: 0.9% chance of exploitation in the next 30 days. Channel accessible by non-endpoint vulnerability in privacy page in Synology Android Moments before 1.2.3-199 allows man-in-the-middle attackers to execute arbitrary code via unspecified vectors.