CVE-2021-26569

CVE-2021-26569 describes a race-condition vulnerability in the iscsi_snapshot_comm_core component of Synology DiskStation Manager (DSM) versions prior to 6.2.3-25426-3. A remote attacker can trigger arbitrary code execution via crafted web requests, with impact evidenced as remote code execution ...

CVE-2021-27647

The CVE-2021-27647 issue affects Synology DiskStation Manager (DSM) before 6.2.3-25426-3, in the iscsi_snapshot_comm_core module. It is an out-of-bounds read that allows remote attackers to execute arbitrary code via crafted web requests. Affected software is DSM, with the root cause described as...

CVE-2021-26560

Cleartext transmission of sensitive information vulnerability in synoagentregisterd in Synology DiskStation Manager DSM before 6.2.3-25426-3 allows man-in-the-middle attackers to spoof servers via an HTTP session...

Design/Logic Flaw

Cleartext transmission of sensitive information vulnerability in synoagentregisterd in Synology DiskStation Manager DSM before 6.2.3-25426-3 allows man-in-the-middle attackers to spoof servers via an HTTP session...

Stack overflow

Stack-based buffer overflow vulnerability in synoagentregisterd in Synology DiskStation Manager DSM before 6.2.3-25426-3 allows man-in-the-middle attackers to execute arbitrary code via synofindersite HTTP header...

Session fixation

Cleartext transmission of sensitive information vulnerability in synorelayd in Synology DiskStation Manager DSM before 6.2.3-25426-3 allows man-in-the-middle attackers to obtain sensitive information via an HTTP session...

CVE-2021-26566

CVE-2021-26566 affects Synology DiskStation Manager (DSM) via the synorelayd component, where a vulnerability prior to DSM 6.2.3-25426-3 allows a remote attacker to induce insertion of sensitive information into outbound data through inbound QuickConnect traffic, enabling a man‑in‑the‑middle to e...

CVE-2021-26565

Synology DiskStation Manager (DSM) prior to version 6.2.3-25426-3 contains a cleartext transmission vulnerability in synorelayd that can allow MITM attackers to obtain sensitive information via HTTP sessions. The issue affects DSM running on Synology NAS devices and is documented in multiple sour...

CVE-2021-26563

CVE-2021-26563 affects Synology DiskStation Manager (DSM) with the synoagentregisterd component, prior to DSM 6.2.4-25553. The root cause is an incorrect/improper access control that allows local users to execute arbitrary code via unspecified vectors, potentially enabling root access. In TALOS-2...

CVE-2021-26564

CVE-2021-26564 is a vulnerability in Synology DiskStation Manager (DSM) due to cleartext transmission in the synorelayd component prior to version 6.2.3-25426-3. The flaw allows man-in-the-middle attackers to spoof servers via an HTTP session, exposing sensitive information. Connected sources ali...

CVE-2021-26561

Synology DSM 6.2.x contains a stack-based out-of-bounds write flaw in the synoagentregisterd/server finder path (syno_finder_site handling) that can be triggered via a malicious HTTP response from a MITM attacker. TALOS-2020-1159 describes an out-of-bounds write in synoagentregisterd’s finder fun...

CVE-2021-26562

This CVE affects Synology DiskStation Manager (DSM) prior to version 6.2.3-25426-3, specifically the synoagentregisterd/server finder component. The root cause is an out-of-bounds write triggered by a crafted syno_finder_site HTTP header, exploited via MITM to potentially execute arbitrary code. ...

CVE-2021-26560

Cleartext transmission of sensitive information vulnerability in synoagentregisterd in Synology DiskStation Manager DSM before 6.2.3-25426-3 allows man-in-the-middle attackers to spoof servers via an HTTP session...

CVE-2021-26560

CVE-2021-26560 affects Synology DiskStation Manager (DSM) prior to 6.2.3-25426-3 via the synoagentregisterd service. The issue involves cleartext HTTP transmission during server discovery (the /finder/server response and subsequent domain parsing), enabling MITM disclosure and server spoofing. TA...

CVE-2020-27652

Algorithm downgrade vulnerability in QuickConnect in Synology DiskStation Manager DSM before 6.2.3-25426-2 allows man-in-the-middle attackers to spoof servers and obtain sensitive information via unspecified vectors...

CVE-2020-27656

Cleartext transmission of sensitive information vulnerability in DDNS in Synology DiskStation Manager DSM before 6.2.3-25426-2 allows man-in-the-middle attackers to eavesdrop authentication information of DNSExit via unspecified vectors...

CVE-2020-27650

Synology DiskStation Manager DSM before 6.2.3-25426-2 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session...

Design/Logic Flaw

Cleartext transmission of sensitive information vulnerability in DDNS in Synology DiskStation Manager DSM before 6.2.3-25426-2 allows man-in-the-middle attackers to eavesdrop authentication information of DNSExit via unspecified vectors...

CVE-2020-27652

Summary: CVE-2020-27652 affects Synology DiskStation Manager (DSM) via QuickConnect: an algorithm downgrade vulnerability enables MITM attackers to spoof servers and obtain sensitive information through unspecified vectors. The issue is documented across multiple sources (NVD, Synology SA-20:18, ...

CVE-2020-27656

The CVE-2020-27656 issue affects Synology DiskStation Manager (DSM) prior to 6.2.3-25426-2, where cleartext transmission of sensitive information over DDNS can let a man-in-the-middle eavesdrop authentication data for DNSExit. Technical details across sources confirm the affected product (DSM), t...