CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Synology : Security Vulnerabilities

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2023-0077 190 Overflow 2023-01-05 2023-01-11
0.0
 None ??? ??? ??? ??? ??? ???
Integer overflow or wraparound vulnerability in CGI component in Synology Router Manager (SRM) before 1.2.5-8227-6 and 1.3.1-9346-3 allows remote attackers to overflow buffers via unspecified vectors.
2 CVE-2022-43932 74 2023-01-05 2023-01-11
0.0
 None ??? ??? ??? ??? ??? ???
Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in CGI component in Synology Router Manager (SRM) before 1.2.5-8227-6 and 1.3.1-9346-3 allows remote attackers to read arbitrary files via unspecified vectors.
3 CVE-2022-43749 269 Bypass 2022-10-26 2022-10-28
0.0
 None ??? ??? ??? ??? ??? ???
Improper privilege management vulnerability in summary report management in Synology Presto File Server before 2.1.2-1601 allows remote authenticated users to bypass security constraint via unspecified vectors.
4 CVE-2022-43748 22 Dir. Trav. 2022-10-26 2022-10-28
0.0
 None ??? ??? ??? ??? ??? ???
Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in file operation management in Synology Presto File Server before 2.1.2-1601 allows remote attackers to write arbitrary files via unspecified vectors.
5 CVE-2022-27623 306 2022-10-25 2022-10-26
0.0
 None ??? ??? ??? ??? ??? ???
Missing authentication for critical function vulnerability in iSCSI management functionality in Synology DiskStation Manager (DSM) before 7.1-42661 allows remote attackers to read or write arbitrary files via unspecified vectors.
6 CVE-2022-27622 918 2022-10-25 2022-10-26
0.0
 None ??? ??? ??? ??? ??? ???
Server-Side Request Forgery (SSRF) vulnerability in Package Center functionality in Synology DiskStation Manager (DSM) before 7.1-42661 allows remote authenticated users to access intranet resources via unspecified vectors.
7 CVE-2022-27619 319 +Info 2022-08-03 2022-08-09
0.0
 None ??? ??? ??? ??? ??? ???
Cleartext transmission of sensitive information vulnerability in authentication management in Synology Note Station Client before 2.2.2-609 allows man-in-the-middle attackers to obtain sensitive information via unspecified vectors.
8 CVE-2022-27616 78 Exec Code 2022-08-03 2022-08-10
0.0
 None ??? ??? ??? ??? ??? ???
Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in webapi component in Synology DiskStation Manager (DSM) before 7.0.1-42218-3 allows remote authenticated users to execute arbitrary commands via unspecified vectors.
9 CVE-2022-27615 22 Dir. Trav. 2022-07-28 2022-08-03
0.0
 None ??? ??? ??? ??? ??? ???
Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in cgi component in Synology DNS Server before 2.2.2-5027 allows remote authenticated users to delete arbitrary files via unspecified vectors.
10 CVE-2022-27613 89 Sql 2022-07-28 2022-08-03
0.0
 None ??? ??? ??? ??? ??? ???
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in webapi component in Synology CardDAV Server before 6.0.10-0153 allows remote authenticated users to inject SQL commands via unspecified vectors.
11 CVE-2022-27612 120 Exec Code Overflow 2022-07-28 2023-01-24
0.0
 None ??? ??? ??? ??? ??? ???
Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in cgi component in Synology Audio Station before 6.5.4-3367 allows remote attackers to execute arbitrary commands via unspecified vectors.
12 CVE-2022-27611 22 Dir. Trav. 2022-07-28 2022-08-03
0.0
 None ??? ??? ??? ??? ??? ???
Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology Audio Station before 6.5.4-3367 allows remote authenticated users to delete arbitrary files via unspecified vectors.
13 CVE-2022-27610 22 Dir. Trav. 2022-07-27 2022-08-02
0.0
 None ??? ??? ??? ??? ??? ???
Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology DiskStation Manager (DSM) before 6.2.3-25423 allows remote authenticated users to delete arbitrary files via unspecified vectors.
14 CVE-2022-22688 77 Exec Code 2022-03-25 2022-03-30
6.5
 None Remote Low ??? Partial Partial Partial
Improper neutralization of special elements used in a command ('Command Injection') vulnerability in File service functionality in Synology DiskStation Manager (DSM) before 6.2.4-25556-2 allows remote authenticated users to execute arbitrary commands via unspecified vectors.
15 CVE-2022-22687 120 Exec Code Overflow 2022-03-25 2022-03-30
7.5
 None Remote Low Not required Partial Partial Partial
Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in Authentication functionality in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via unspecified vectors.
16 CVE-2022-22686 352 CSRF 2022-07-26 2022-08-01
0.0
 None ??? ??? ??? ??? ??? ???
Cross-Site Request Forgery (CSRF) vulnerability in webapi component in Synology Calendar before 2.3.4-0631 allows remote authenticated users to hijack the authentication of administrators via unspecified vectors.
17 CVE-2022-22685 22 Dir. Trav. 2022-07-28 2022-08-03
0.0
 None ??? ??? ??? ??? ??? ???
Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology WebDAV Server before 2.4.0-0062 allows remote authenticated users to delete arbitrary files via unspecified vectors.
18 CVE-2022-22684 78 Exec Code 2022-07-28 2022-08-03
0.0
 None ??? ??? ??? ??? ??? ???
Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in task management component in Synology DiskStation Manager (DSM) before 6.2.4-25553 allows remote authenticated users to execute arbitrary commands via unspecified vectors.
19 CVE-2022-22682 79 XSS 2022-07-12 2022-07-15
3.5
 None Remote Medium ??? None Partial None
Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Event Management in Synology Calendar before 2.4.5-10930 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
20 CVE-2022-22681 384 Bypass 2022-07-06 2022-07-14
5.0
 None Remote Low Not required None Partial None
Session fixation vulnerability in access control management in Synology Photo Station before 6.8.16-3506 allows remote attackers to bypass security constraint via unspecified vectors.
21 CVE-2022-22680 +Info 2022-02-07 2022-02-10
5.0
 None Remote Low Not required Partial None None
Exposure of sensitive information to an unauthorized actor vulnerability in Web Server in Synology DiskStation Manager (DSM) before 7.0.1-42218-2 allows remote attackers to obtain sensitive information via unspecified vectors.
22 CVE-2022-22679 22 Dir. Trav. 2022-02-07 2022-02-10
4.0
 None Remote Low ??? None Partial None
Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in support service management in Synology DiskStation Manager (DSM) before 7.0.1-42218-2 allows remote authenticated users to write arbitrary files via unspecified vectors.
23 CVE-2021-44142 125 Exec Code 2022-02-21 2022-02-23
9.0
 None Remote Low ??? Complete Complete Complete
The Samba vfs_fruit module uses extended file attributes (EA, xattr) to provide "...enhanced compatibility with Apple SMB clients and interoperability with a Netatalk 3 AFP fileserver." Samba versions prior to 4.13.17, 4.14.12 and 4.15.5 with vfs_fruit configured allow out-of-bounds heap read and write via specially crafted extended file attributes. A remote attacker with write access to extended file attributes can execute arbitrary code with the privileges of smbd, typically root.
24 CVE-2021-43929 74 2022-02-07 2022-02-10
4.0
 None Remote Low ??? None Partial None
Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in work flow management in Synology DiskStation Manager (DSM) before 7.0.1-42218-2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
25 CVE-2021-43928 78 Exec Code 2022-02-07 2022-05-13
6.5
 None Remote Low ??? Partial Partial Partial
Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in mail sending and receiving component in Synology Mail Station before 20211105-10315 allows remote authenticated users to execute arbitrary commands via unspecified vectors.
26 CVE-2021-43927 89 Sql 2022-02-07 2022-02-10
7.5
 None Remote Low Not required Partial Partial Partial
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Security Management functionality in Synology DiskStation Manager (DSM) before 7.0.1-42218-2 allows remote attackers to inject SQL commands via unspecified vectors.
27 CVE-2021-43926 89 Sql 2022-02-07 2022-02-10
7.5
 None Remote Low Not required Partial Partial Partial
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Log Management functionality in Synology DiskStation Manager (DSM) before 7.0.1-42218-2 allows remote attackers to inject SQL commands via unspecified vectors.
28 CVE-2021-43925 89 Sql 2022-02-07 2022-02-10
7.5
 None Remote Low Not required Partial Partial Partial
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Log Management functionality in Synology DiskStation Manager (DSM) before 7.0.1-42218-2 allows remote attackers to inject SQL commands via unspecified vectors.
29 CVE-2021-34812 798 +Info 2021-06-18 2021-06-24
5.0
 None Remote Low Not required Partial None None
Use of hard-coded credentials vulnerability in php component in Synology Calendar before 2.4.0-0761 allows remote attackers to obtain sensitive information via unspecified vectors.
30 CVE-2021-34811 918 2021-06-18 2021-06-23
4.0
 None Remote Low ??? Partial None None
Server-Side Request Forgery (SSRF) vulnerability in task management component in Synology Download Station before 3.8.16-3566 allows remote authenticated users to access intranet resources via unspecified vectors.
31 CVE-2021-34810 269 Exec Code 2021-06-18 2021-06-24
6.5
 None Remote Low ??? Partial Partial Partial
Improper privilege management vulnerability in cgi component in Synology Download Station before 3.8.16-3566 allows remote authenticated users to execute arbitrary code via unspecified vectors.
32 CVE-2021-34809 77 Exec Code 2021-06-18 2021-06-24
6.5
 None Remote Low ??? Partial Partial Partial
Improper neutralization of special elements used in a command ('Command Injection') vulnerability in task management component in Synology Download Station before 3.8.16-3566 allows remote authenticated users to execute arbitrary code via unspecified vectors.
33 CVE-2021-34808 918 2021-06-18 2021-06-23
5.0
 None Remote Low Not required Partial None None
Server-Side Request Forgery (SSRF) vulnerability in cgi component in Synology Media Server before 1.8.3-2881 allows remote attackers to access intranet resources via unspecified vectors.
34 CVE-2021-33184 918 2021-06-01 2021-06-10
4.0
 None Remote Low ??? Partial None None
Server-Side request forgery (SSRF) vulnerability in task management component in Synology Download Station before 3.8.15-3563 allows remote authenticated users to read arbitrary files via unspecified vectors.
35 CVE-2021-33183 22 Dir. Trav. 2021-06-01 2021-06-10
3.6
 None Local Low Not required Partial Partial None
Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability container volume management component in Synology Docker before 18.09.0-0515 allows local users to read or write arbitrary files via unspecified vectors.
36 CVE-2021-33182 22 Dir. Trav. 2021-06-01 2021-06-09
4.0
 None Remote Low ??? Partial None None
Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in PDF Viewer component in Synology DiskStation Manager (DSM) before 6.2.4-25553 allows remote authenticated users to read limited files via unspecified vectors.
37 CVE-2021-33181 918 2021-06-01 2021-06-10
6.5
 None Remote Low ??? Partial Partial Partial
Server-Side Request Forgery (SSRF) vulnerability in webapi component in Synology Video Station before 2.4.10-1632 allows remote authenticated users to send arbitrary request to intranet resources via unspecified vectors.
38 CVE-2021-33180 89 Exec Code Sql 2021-06-01 2021-06-09
7.5
 None Remote Low Not required Partial Partial Partial
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in cgi component in Synology Media Server before 1.8.1-2876 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
39 CVE-2021-31439 122 Exec Code 2021-05-21 2021-05-27
5.8
 None Local Network Low Not required Partial Partial Partial
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Synology DiskStation Manager. Authentication is not required to exploit this vulnerablity. The specific flaw exists within the processing of DSI structures in Netatalk. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-12326.
40 CVE-2021-29092 434 Exec Code 2021-06-01 2021-06-09
6.5
 None Remote Low ??? Partial Partial Partial
Unrestricted upload of file with dangerous type vulnerability in file management component in Synology Photo Station before 6.8.14-3500 allows remote authenticated users to execute arbitrary code via unspecified vectors.
41 CVE-2021-29091 22 Dir. Trav. 2021-06-02 2021-06-10
4.0
 None Remote Low ??? None Partial None
Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in file management component in Synology Photo Station before 6.8.14-3500 allows remote authenticated users to write arbitrary files via unspecified vectors.
42 CVE-2021-29090 89 Exec Code Sql 2021-06-02 2021-06-10
9.0
 None Remote Low ??? Complete Complete Complete
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in PHP component in Synology Photo Station before 6.8.14-3500 allows remote authenticated users to execute arbitrary SQL command via unspecified vectors.
43 CVE-2021-29089 89 Exec Code Sql 2021-06-02 2021-06-10
10.0
 None Remote Low Not required Complete Complete Complete
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in thumbnail component in Synology Photo Station before 6.8.14-3500 allows remote attackers users to execute arbitrary SQL commands via unspecified vectors.
44 CVE-2021-29088 22 Exec Code Dir. Trav. 2021-06-01 2021-06-09
4.6
 None Local Low Not required Partial Partial Partial
Improper limitation of a pathname to a restricted directory ('Path Traversal') in cgi component in Synology DiskStation Manager (DSM) before 6.2.4-25553 allows local users to execute arbitrary code via unspecified vectors.
45 CVE-2021-29087 22 Dir. Trav. 2021-06-23 2021-06-29
5.0
 None Remote Low Not required None Partial None
Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to write arbitrary files via unspecified vectors.
46 CVE-2021-29086 200 +Info 2021-06-23 2021-06-29
5.0
 None Remote Low Not required Partial None None
Exposure of sensitive information to an unauthorized actor vulnerability in webapi component in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to obtain sensitive information via unspecified vectors.
47 CVE-2021-29085 74 2021-06-23 2021-06-29
5.0
 None Remote Low Not required Partial None None
Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in file sharing management component in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to read arbitrary files via unspecified vectors.
48 CVE-2021-29084 74 2021-06-23 2021-06-29
5.0
 None Remote Low Not required Partial None None
Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in Security Advisor report management component in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to read arbitrary files via unspecified vectors.
49 CVE-2021-29083 78 Exec Code 2021-04-01 2021-04-07
9.0
 None Remote Low ??? Complete Complete Complete
Improper neutralization of special elements used in an OS command in SYNO.Core.Network.PPPoE in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote authenticated users to execute arbitrary code via realname parameter.
50 CVE-2021-27649 416 Exec Code 2021-06-23 2021-06-29
7.5
 None Remote Low Not required Partial Partial Partial
Use after free vulnerability in file transfer protocol component in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via unspecified vectors.
Total number of vulnerabilities : 222   Page : 1 (This Page)2 3 4 5
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.