404 matches found
CVE-2020-27650
CVE-2020-27650 affects Synology DiskStation Manager (DSM) versions before 6.2.3-25426-2. The issue is that the session cookie used in HTTPS sessions is not marked with the Secure flag, which can allow an attacker to capture the cookie by intercepting its transmission in an HTTP session. Impact is...
CVE-2020-27648
CVE-2020-27648 affects Synology DiskStation Manager (DSM) via the OpenVPN client before 6.2.3-25426-2. The issue is improper certificate validation in the OpenVPN client, enabling MITM attackers to spoof servers and obtain sensitive information with a crafted certificate. Public disclosures in th...
PT-2020-16746 · Openvpn +1 · Openvpn +1
Name of the Vulnerable Software and Affected Versions: Synology DiskStation Manager DSM versions prior to 6.2.3-25426-2 Description: The issue is related to improper certificate validation in the OpenVPN client, allowing man-in-the-middle attackers to spoof servers and obtain sensitive informatio...
dsmconsultants.co.uk Cross Site Scripting vulnerability OBB-1382083
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
dsmonline.in Cross Site Scripting vulnerability OBB-1337261
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
CVE-2020-13793
Unsafe storage of AD credentials in Ivanti DSM netinst 5.1 due to a static, hard-coded encryption key...
CVE-2020-13793
Unsafe storage of AD credentials in Ivanti DSM netinst 5.1 due to a static, hard-coded encryption key...
Hardcoded credentials
Unsafe storage of AD credentials in Ivanti DSM netinst 5.1 due to a static, hard-coded encryption key...
CVE-2020-13793
Unsafe storage of AD credentials in Ivanti DSM netinst 5.1 due to a static, hard-coded encryption key...
CVE-2020-13793
CVE-2020-13793 affects Ivanti DSM netinst 5.1, where AD credentials are stored insecurely due to a static, hard-coded encryption key. According to the connected records, the CVSS-3.1 base score is 9.8 (CRITICAL) with network attack vector, no privileges required, and high impact on confidentialit...
Synology DSM AppArmor synosearchagent misconfiguration vulnerability
Summary A misconfiguration exists in AppArmor’s synosearchagent profile of Synology DSM 6.2.3 25426 DS120j. A specially crafted kernel module can be loaded, leading to a bypass of AppArmor’s restrictions. An attacker can use insmod to trigger this vulnerability. Tested Versions Synology DSM 6.2.3...
CVE-2017-18688
An issue was discovered on Samsung mobile devices with L5.1, M6.0, and N7.0 software. There is an information disclosure of memory locations outside a buffer via /dev/dsmctrldev. The Samsung ID is SVE-2016-7340 January 2017...
Synology DSM findhostd unencrypted credentials disclosure vulnerability
Summary An information disclosure vulnerability exists in the findhostd authentication functionality of Synology DSM 6.2.3 25426 DS120j. Using an application e.g. Synology Assistant can lead to information disclosure of administrator credentials. An attacker can sniff network traffic to trigger...
Security update for libopenmpt (moderate)
openSUSE Security Update: Security update for libopenmpt Announcement ID: openSUSE-SU-2019:2213-1 Rating: moderate References: 1143578 1143581 1143582 1143584 Cross-References: CVE-2018-20860 CVE-2018-20861 CVE-2019-14382 CVE-2019-14383 Affected Products: openSUSE Leap 15.1 An update that fixes...
Security update for libopenmpt (moderate)
openSUSE Security Update: Security update for libopenmpt Announcement ID: openSUSE-SU-2019:2212-1 Rating: moderate References: 1143578 1143581 1143582 1143584 Cross-References: CVE-2018-20860 CVE-2018-20861 CVE-2019-14382 CVE-2019-14383 Affected Products: openSUSE Leap 15.0 An update that fixes...
CVE-2019-14382
DSM in libopenmpt before 0.4.2 allows an assertion failure during file parsing with debug STLs...
CVE-2019-14382
DSM in libopenmpt before 0.4.2 allows an assertion failure during file parsing with debug STLs...
CVE-2018-13284
Command injection vulnerability in ftpd in Synology Diskstation Manager DSM before 6.2-23739-1 allows remote authenticated users to execute arbitrary OS commands via the 1 MKD or 2 RMD command...