MAL-2023-8393 Malicious code in z-dsm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6e2e8df0358f7f04a5b41981e5e7496d99d985f9e76087b0e3a233566f9ddfd0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Synology DiskStation Manager (DSM) < 3.1 Information Disclosure Vulnerability (Feb 2015)

Synology DiskStation Manager DSM is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

New Admin Takeover Vulnerability Exposed in Synology's DiskStation Manager

A medium-severity flaw has been discovered in Synology's DiskStation Manager DSM that could be exploited to decipher an administrator's password and remotely hijack the account. "Under some rare conditions, an attacker could leak enough information to restore the seed of the pseudorandom number...

CVE-2023-24847

Transient DOS in Modem while allocating DSM items...

CVE-2023-24847 NULL pointer Dereference in Modem

Transient DOS in Modem while allocating DSM items...

CVE-2023-24847 NULL pointer Dereference in Modem

Transient DOS in Modem while allocating DSM items...

CVE-2023-24847

CVE-2023-24847 describes a transient DoS in the modem when allocating DSM items. The core issue is a crash/hang in the modem component (Qualcomm closed‑source components) leading to denial of service with a CVSSv3.1 base score of 7.5 (Network, low attack complexity, no user interaction). Affected...

CVE-2023-28129

DSM 2022.2 SU2 and all prior versions allows a local low privileged account to execute arbitrary OS commands as the DSM software installation user...

CVE-2023-28129

DSM 2022.2 SU2 and all prior versions allows a local low privileged account to execute arbitrary OS commands as the DSM software installation user...

Design/Logic Flaw

DSM 2022.2 SU2 and all prior versions allows a local low privileged account to execute arbitrary OS commands as the DSM software installation user...

CVE-2023-28129

DSM 2022.2 SU2 and all prior versions allows a local low privileged account to execute arbitrary OS commands as the DSM software installation user...

CVE-2023-28129

DSM 2022.2 SU2 and all prior versions allows a local low privileged account to execute arbitrary OS commands as the DSM software installation user...

CVE-2023-28129

Ivanti DSM (Desktop and Server Management) 2022.2 SU2 and earlier versions are affected by CVE-2023-28129, where a local low-privileged user can execute arbitrary OS commands as the DSM installation user. The issue originates from DSM’s handling of installation-user privileges, enabling privilege...

CVE-2023-2729

Use of insufficiently random values vulnerability in User Management Functionality in Synology DiskStation Manager DSM before 7.2-64561 allows remote attackers to obtain user credential via unspecified vectors...

CVE-2023-0142

Uncontrolled search path element vulnerability in Backup Management functionality in Synology DiskStation Manager DSM before 6.2.4-25556-8, 7.0.1-42218-7 and 7.1-42661 allows remote authenticated users with administrator privileges to read or write arbitrary files via unspecified vectors...

CVE-2023-2729

CVE-2023-2729 affects Synology DiskStation Manager (DSM) prior to 7.2-64561, where the user management functionality relies on insufficiently random values, enabling remote attackers to obtain user credentials via unspecified vectors. Root cause: weak randomness in PRNG construction during admin ...

CVE-2023-0142

CVE-2023-0142 concerns an Uncontrolled search path element vulnerability in the Backup Management functionality of Synology DiskStation Manager (DSM). Affected products include DSM versions prior to fixed releases: 6.2.4-25556-8, 7.0.1-42218-7, and 7.1-42661. The underlying issue enables remote a...

SUSE CVE-2011-2914

Off-by-one error in the CSoundFile::ReadDSM function in src/loaddms.cpp in libmodplug before 0.8.8.4 allows remote attackers to cause a denial of service memory corruption and possibly execute arbitrary code via a crafted DSM file with a large number of samples...

SUSE CVE-2015-2809

The Multicast DNS mDNS responder in Synology DiskStation Manager DSM before 3.1 inadvertently responds to unicast queries with source addresses that are not link-local, which allows remote attackers to cause a denial of service traffic amplification or obtain potentially sensitive information via...

Synology DiskStation Manager (DSM) 5.2.x, 6.x < 6.2-23739 Multiple Vulnerabilities (Synology_SA_18:24)

Synology DiskStation Manager DSM is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...