CVE-2018-13297

Information exposure vulnerability in SYNO.SynologyDrive.Files in Synology Drive before 1.1.2-10562 allows remote attackers to obtain sensitive system information via the dsmpath parameter...

CVE-2018-13291

Information exposure vulnerability in /usr/syno/etc/mount.conf in Synology DiskStation Manager DSM before 6.2.1-23824 allows remote authenticated users to obtain sensitive information via the world readable configuration...

Cross site scripting

Cross-site scripting XSS vulnerability in Control Panel SSO Settings in Synology DiskStation Manager DSM before 6.2.1-23824 allows remote authenticated users to inject arbitrary web script or HTML via the URL parameter...

Command injection

Command injection vulnerability in ftpd in Synology Diskstation Manager DSM before 6.2-23739-1 allows remote authenticated users to execute arbitrary OS commands via the 1 MKD or 2 RMD command...

CVE-2018-13291

CVE-2018-13291 affects Synology DiskStation Manager (DSM) prior to 6.2.1-23824. The vulnerability is an information exposure in the /usr/syno/etc/mount.conf configuration, which remote authenticated users can read due to a world-readable file. This leads to disclosure of sensitive information abo...

CVE-2018-13293

CVE-2018-13293 affects Synology DiskStation Manager (DSM) Control Panel SSO Settings prior to 6.2.1-23824. The vulnerability is a cross-site scripting (XSS) flaw that allows remote authenticated users to inject arbitrary web script or HTML via a URL parameter. Evidence across multiple sources con...

CVE-2018-13284

CVE-2018-13284 is a command-injection flaw in the FTP daemon (ftpd) of Synology DiskStation Manager (DSM) before version 6.2-23739-1. The issue allows remote authenticated users to run arbitrary OS commands via the MKD or RMD commands, indicating an input handling flaw in command construction. Im...

CVE-2018-13286

CVE-2018-13286 affects Synology DiskStation Manager (DSM) prior to 6.2-23739-1. The vulnerability lies in synouser.conf where incorrect default permissions create a world-readable configuration, allowing remote authenticated users to obtain sensitive information. Severity/impact in sources indica...

CVE-2018-13284

Command injection vulnerability in ftpd in Synology Diskstation Manager DSM before 6.2-23739-1 allows remote authenticated users to execute arbitrary OS commands via the 1 MKD or 2 RMD command...

CVE-2017-16774

Synology DSM is affected by CVE-2017-16774 in the SYNO.Core.PersonalNotification.Event module. The vulnerability arises from insufficient validation of the package parameter, enabling remote authenticated users to inject arbitrary web script or HTML. Affected versions are DSM prior to 6.1.4-15217...

openSUSE Security Update : libopenmpt (openSUSE-2019-524)

This update for libopenmpt to version 0.3.9 fixes the following issues : These security issues were fixed : - CVE-2018-11710: Prevent write near address 0 in out-of-memory situations when reading AMS files bsc1095644 - CVE-2018-10017: Preven out-of-bounds memory read with IT/ITP/MO3 files...

Cross site scripting

Cross-site scripting XSS vulnerability in info.cgi in Synology DiskStation Manager DSM before 6.1.6-15266 allows remote attackers to inject arbitrary web script or HTML via the host parameter...

Input validation

Improper neutralization of escape vulnerability in Log Exporter in Synology DiskStation Manager DSM before 6.1.6-15266 allows remote attackers to inject arbitrary content to have an unspecified impact by exporting an archive in CSV format...

CVE-2018-8917

Cross-site scripting XSS vulnerability in info.cgi in Synology DiskStation Manager DSM before 6.1.6-15266 allows remote attackers to inject arbitrary web script or HTML via the host parameter...

CVE-2018-8917

Cross-site scripting XSS vulnerability in info.cgi in Synology DiskStation Manager DSM before 6.1.6-15266 allows remote attackers to inject arbitrary web script or HTML via the host parameter...

CVE-2018-8919

The CVE-2018-8919 issue affects Synology DiskStation Manager (DSM) prior to 6.1.6-15266, specifically SYNO.Core.Desktop.SessionData, and enables information disclosure by remote attackers to steal credentials via unspecified vectors. Technical details in the sources consistently identify the affe...

CVE-2018-8920

CVE-2018-8920 affects Synology DiskStation Manager (DSM) prior to 6.1.6-15266, via the Log Exporter. The root cause is improper neutralization of escape characters when exporting an archive in CSV format, enabling remote attackers to inject arbitrary content with an unspecified impact. The vulner...

CVE-2018-8917

The CVE-2018-8917 issue affects Synology DiskStation Manager (DSM) through the info.cgi component, with the host parameter allowing cross-site scripting. Affected versions are DSM before 6.1.6-15266. Root cause is input handling in info.cgi that enables arbitrary web script or HTML injection by r...

CVE-2018-13281

The CVE-2018-13281 entry affects Synology DiskStation Manager (DSM) prior to 6.2-23739-2, specifically the SYNO.Core.ACL component. The vulnerability allows remote authenticated users to determine the existence of files and obtain their metadata via the file_path parameter, constituting an inform...

CVE-2018-7111

A remote unauthorized access vulnerability was identified in HPE UIoT versions 1.5, 1.4.0, 1.4.1, 1.4.2, 1.2.4.2. Specifically, there is a malfunction identified in some section of the DSM portal and some DSM APIs. The impact of the malfunction is that the info can be changed by other users...