CVE-2022-27625

A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the message processing functionality of Out-of-Band OOB Management. This allows remote attackers to execute arbitrary commands via unspecified vectors. The following models with Synology...

Race condition

A vulnerability regarding concurrent execution using shared resource with improper synchronization 'Race Condition' is found in the session processing functionality of Out-of-Band OOB Management. This allows remote attackers to execute arbitrary commands via unspecified vectors. The following...

Out-of-bounds

A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the message processing functionality of Out-of-Band OOB Management. This allows remote attackers to execute arbitrary commands via unspecified vectors. The following models with Synology...

CVE-2022-3576

CVE-2022-3576 is a vulnerability in Synology DiskStation Manager (DSM) Out-of-Band (OOB) Management session processing that causes an out-of-bounds read. The issue can allow remote attackers to obtain sensitive information via unspecified vectors, with impact on affected models DS3622xs+, FS3410,...

CVE-2022-27624

CVE-2022-27624 affects Synology DiskStation Manager (DSM) on DS3622xs+, FS3410, and HD6500, with DSM versions before 7.1.1-42962-2. The issue is an out-of-bounds operation in the OOB (Out-of-Band) Management packet decryption that can allow remote attackers to execute arbitrary commands over the ...

CVE-2022-27625

CVE-2022-27625 affects Synology DiskStation Manager (DSM) before 7.1.1-42962-2 on DSM models DS3622xs+, FS3410, and HD6500. The root cause is improper restriction of operations within the bounds of a memory buffer in the Out-of-Band (OOB) Management message processing functionality, enabling remo...

CVE-2022-27626

CVE-2022-27626 is a race-condition vulnerability in Synology DiskStation Manager (DSM) OOB Management session processing. The issue arises from concurrent execution using improperly synchronized shared resources, allowing remote attackers to execute arbitrary commands via unspecified vectors. Aff...

CVE-2022-27616

CVE-2022-27616 affects the webapi component of Synology DiskStation Manager (DSM). The issue is an OS command injection due to improper neutralization of special elements, allowing remote authenticated users to execute arbitrary commands via unspecified vectors in DSM builds prior to 7.0.1-42218-...

CVE-2022-22684

CVE-2022-22684 affects Synology DiskStation Manager (DSM) prior to 6.2.4-25553, in the task management component, due to improper neutralization of certain OS command elements. This OS Command Injection allows remote authenticated users to execute arbitrary commands via unspecified vectors. Remed...

CVE-2022-27610

The CVE-2022-27610 entry describes a path traversal vulnerability in the webapi component of Synology DiskStation Manager (DSM) prior to 6.2.3-25423. The flaw allows remote authenticated users to delete arbitrary files via unspecified vectors, due to improper limitation of a pathname to a restric...

HPE NonStop DSM/SCM Information Disclosure Vulnerability

HPE NonStop DSM/SCM is a tool from HPE USA for managing and configuring software installations on distributed target systems. An information disclosure vulnerability exists in HPE NonStop DSM/SCM version T6031H03^ADP, which can be exploited by an attacker to obtain sensitive information...

CVE-2022-28621

A remote disclosure of sensitive information vulnerability was discovered in HPE NonStop DSM/SCM version: T6031H03^ADP. HPE has provided a software update to resolve this vulnerability in HPE NonStop DSM/SCM...

Information disclosure

A remote disclosure of sensitive information vulnerability was discovered in HPE NonStop DSM/SCM version: T6031H03^ADP. HPE has provided a software update to resolve this vulnerability in HPE NonStop DSM/SCM...

CVE-2022-28621

CVE-2022-28621 describes a remote information-disclosure vulnerability in HPE NonStop DSM/SCM, affecting version T6031H03^ADP. The issue allows an attacker to obtain sensitive information and is reflected in public records with a partial confidentiality impact (NVD CVSS2/3.1: 5.0/7.5). HPE has pr...

CVE-2022-28621

A remote disclosure of sensitive information vulnerability was discovered in HPE NonStop DSM/SCM version: T6031H03^ADP. HPE has provided a software update to resolve this vulnerability in HPE NonStop DSM/SCM...

Memory corruption

Improper buffer size validation of DSM packet received can lead to memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Wearables...

CVE-2021-30341

Improper buffer size validation of DSM packet received can lead to memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Wearables...

CVE-2021-30341

CVE-2021-30341 describes memory corruption caused by improper buffer size validation of DSM packets in Qualcomm/Snapdragon components (Auto, Compute, Connectivity, Consumer Electronics Connectivity, Consumer IOT, Industrial IOT, Wearables). The CVSS v3.1 base score is 9.8 (CRITICAL) with NETWORK ...

QNAP Advises to Mitigate Remote Hacking Flaws Until Patches are Available

Network-attached storage NAS appliance maker QNAP on Wednesday said it's working on updating its QTS and QuTS operating systems after Netatalk last month released patches to contain seven security flaws in its software. Netatalk is an open-source implementation of the Apple Filing Protocol AFP,...

dsm-software.com Cross Site Scripting vulnerability OBB-2554106

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...