Design/Logic Flaw

A remote unauthorized access vulnerability was identified in HPE UIoT versions 1.5, 1.4.0, 1.4.1, 1.4.2, 1.2.4.2. Specifically, there is a malfunction identified in some section of the DSM portal and some DSM APIs. The impact of the malfunction is that the info can be changed by other users...

CVE-2018-7111

A remote unauthorized access vulnerability was identified in HPE UIoT versions 1.5, 1.4.0, 1.4.1, 1.4.2, 1.2.4.2. Specifically, there is a malfunction identified in some section of the DSM portal and some DSM APIs. The impact of the malfunction is that the info can be changed by other users...

CVE-2018-7111

Technical details about CVE-2018-7111 are not publicly provided in the connected documents. Monitor for updates from vendors and security advisories; available sources reiterate a remote unauthorized access issue in HPE UIoT DSM portals/APIs.

CVE-2018-13280

Use of insufficiently random values vulnerability in SYNO.Encryption.GenRandomKey in Synology DiskStation Manager DSM before 6.2-23739 allows man-in-the-middle attackers to compromise non-HTTPS sessions via unspecified vectors...

CVE-2018-13280

CVE-2018-13280 affects Synology DiskStation Manager (DSM) prior to version 6.2-23739. The root cause is the use of insufficiently random values in SYNO.Encryption.GenRandomKey, which can allow remote attackers to perform a man-in-the-middle attack on non-HTTPS sessions. Practical impact stated is...

Security update for libopenmpt (moderate)

This update for libopenmpt to version 0.3.9 fixes the following issues: These security issues were fixed: - CVE-2018-11710: Prevent write near address 0 in out-of-memory situations when reading AMS files bsc1095644 - CVE-2018-10017: Preven out-of-bounds memory read with IT/ITP/MO3 files containin...

openSUSE Security Update : libopenmpt (openSUSE-2018-742)

This update for libopenmpt to version 0.3.9 fixes the following issues : These security issues were fixed : - CVE-2018-11710: Prevent write near address 0 in out-of-memory situations when reading AMS files bsc1095644 - CVE-2018-10017: Preven out-of-bounds memory read with IT/ITP/MO3 files...

CVE-2018-8916

Unverified password change vulnerability in Change Password in Synology DiskStation Manager DSM before 6.2-23739 allows remote authenticated users to reset password without verification...

CVE-2017-12075

The CVE-2017-12075 issue affects Synology DiskStation Manager (DSM) prior to 6.2-23739, specifically in EZ-Internet. The vulnerability permits a remote authenticated user to inject and execute arbitrary commands through the username parameter, due to improper handling of input. Affected component...

CVE-2018-8916

The CVE-2018-8916 issue affects Synology DiskStation Manager (DSM) prior to 6.2-23739. The vulnerability lies in the Change Password function, where remote authenticated users can reset a password without completing verification, due to an unverified password change flow. Impact is described as a...

Synology DiskStation Manager (DSM) < 6.1.3-15152 - forget_passwd.cgi User Enumeration

Exploit for cgi platform in category web applications Exploit Title: Synology DiskStation Manager DSM 6.1.3-15152 - 'forgetpasswd.cgi' User Enumeration Date: 01/05/2018 Exploit Author: Steve Kaun Vendor Homepage: https://www.synology.com Version: Before 6.1.3-15152 CVE : CVE-2017-9554 Previously...

CVE-2017-16766

CVE-2017-16766 concerns an improper access control vulnerability in the Synology DSM component synodsmnotify . The issue affects DSM versions prior to 6.1.4-15217 and prior to 6.0.3-8754-6, where local users can inject arbitrary web script or HTML via the -fn option. The root cause is inadequate ...

Synology DiskStation Manager Directory Traversal Vulnerability

Synology DiskStation Manager DSM is an operating system for use on Network Storage Servers NAS from Synology. The operating system manages information such as data, files, photos, music and more. A directory traversal vulnerability exists in SYNO.FileStation.Extract in Synology DSM versions 6.0.x...

CVE-2017-14374

Dell Storage Manager before 16.3.20 (2016 R3.20) stores a hard-coded password for the SMI-S service. A remote attacker who knows the credential could disable the SMI-S service via HTTP requests, impacting storage management and monitoring through the SMI-S interface. Affected platform is Windows ...

CVE-2017-15889

Command injection vulnerability in smart.cgi in Synology DiskStation Manager DSM before 5.2-5967-5 allows remote authenticated users to execute arbitrary commands via disk field...

CVE-2017-15889

Command injection vulnerability in smart.cgi in Synology DiskStation Manager DSM before 5.2-5967-5 allows remote authenticated users to execute arbitrary commands via disk field...

CVE-2017-15889

CVE-2017-15889 is a command injection vulnerability in Synology DiskStation Manager (DSM) smart.cgi that affects DSM versions prior to 5.2-5967-5. An authenticated remote attacker can inject commands via the disk field, potentially executing arbitrary commands with root privileges. Public details...

Synology StorageManager smart.cgi Remote Command Execution

Vulnerability Summary The following advisory describes a remote command execution vulnerability found in Synology StorageManager. Storage Manager is “a management application that helps you organize and monitor the storage capacity on your Synology NAS. Depending on the model and number of...

Synology StorageManager 5.2 - Root Remote Command Execution

Synology StorageManager 5.2 - Root Remote Command Execution ''' SSD Advisory – Synology StorageManager smart.cgi Remote Command Execution Full report: https://blogs.securiteam.com/index.php/archives/3540 Twitter: @SecuriTeamSSD Weibo: SecuriTeamSSD Vulnerability Summary The following advisory...

Synology DiskStation Manager smart.cgi Remote Command Execution

This module exploits a vulnerability found in Synology DiskStation Manager DSM versions use exploit/linux/http/synology/dsmsmartexecauth msf undefineddsmsmartexecauth show actions ...actions... msf undefineddsmsmartexecauth set ACTION msf undefineddsmsmartexecauth show options ...show and set...