Synology DiskStation Manager (DSM) Information Disclosure Vulnerability

Synology DiskStation Manager is an operating system for use on networked storage servers NAS. A security vulnerability in Synology DiskStation Manager forgetpasswd.cgi allows remote attackers to submit a special request to enumerate valid usernames...

CVE-2017-9554

An information exposure vulnerability in forgetpasswd.cgi in Synology DiskStation Manager DSM before 6.1.3-15152 allows remote attackers to enumerate valid usernames via unspecified vectors...

CVE-2017-9554

An information exposure vulnerability in forgetpasswd.cgi in Synology DiskStation Manager DSM before 6.1.3-15152 allows remote attackers to enumerate valid usernames via unspecified vectors...

CVE-2017-9553

A design flaw in SYNO.API.Encryption in Synology DiskStation Manager DSM before 6.1.3-15152 allows remote attackers to bypass the encryption protection mechanism via the crafted version parameter...

CVE-2017-9553

A design flaw in SYNO.API.Encryption in Synology DiskStation Manager DSM before 6.1.3-15152 allows remote attackers to bypass the encryption protection mechanism via the crafted version parameter...

Design/Logic Flaw

A design flaw in SYNO.API.Encryption in Synology DiskStation Manager DSM before 6.1.3-15152 allows remote attackers to bypass the encryption protection mechanism via the crafted version parameter...

CVE-2017-9553

CVE-2017-9553 concerns a design flaw in Synology DiskStation Manager (DSM) SYNO.API.Encryption that, on DSM versions prior to 6.1.3-15152, allows remote attackers to bypass the encryption protection mechanism by sending a crafted version parameter. The issue affects DSM’s SYNO.API.Encryption comp...

CVE-2017-9554

An information exposure vulnerability in forgetpasswd.cgi in Synology DiskStation Manager DSM before 6.1.3-15152 allows remote attackers to enumerate valid usernames via unspecified vectors...

CVE-2017-9553

A design flaw in SYNO.API.Encryption in Synology DiskStation Manager DSM before 6.1.3-15152 allows remote attackers to bypass the encryption protection mechanism via the crafted version parameter...

PT-2017-19014 · Synology · Synology Diskstation Manager

Name of the Vulnerable Software and Affected Versions: Synology DiskStation Manager DSM versions prior to 6.1.3-15152 Description: The issue allows remote attackers to enumerate valid usernames via unspecified vectors due to an information exposure vulnerability in forget passwd.cgi...

PT-2017-19013 · Synology · Synology Diskstation Manager

Name of the Vulnerable Software and Affected Versions: Synology DiskStation Manager DSM versions prior to 6.1.3-15152 Description: A design flaw in SYNO.API.Encryption allows remote attackers to bypass the encryption protection mechanism via the crafted version parameter. Recommendations: For...

Synology DiskStation Manager (DSM) Web Administration Interface Default Credentials

The web administration interface for the Synology DiskStation Manager DSM application running on the remote host uses a default blank password for the administrator account. A remote attacker can exploit this to gain administrative access to the web interface. C Tenable Network Security, Inc...

Synology DiskStation Manager Cross-Site Scripting Vulnerability

Synology DiskStation Manager is a web-based intuitive operating system that helps users manage files, photos, music, videos, and other important content stored on Synology DiskStation and RackStation. A cross-site scripting vulnerability exists in Synology DiskStation Manager, which allows remote...

CVE-2015-4655

Cross-site scripting XSS vulnerability in Synology DiskStation Manager DSM before 5.2-5565 Update 1 allows remote attackers to inject arbitrary web script or HTML via the "compound" parameter to entry.cgi...

CVE-2015-4655

Cross-site scripting XSS vulnerability in Synology DiskStation Manager DSM before 5.2-5565 Update 1 allows remote attackers to inject arbitrary web script or HTML via the "compound" parameter to entry.cgi...

CVE-2015-4655

Affected product and component: Synology DiskStation Manager (DSM) prior to 5.2-5565 Update 1, specifically the entry.cgi endpoint. Vulnerability and root cause: Cross-site scripting (XSS) vulnerability where an attacker can inject arbitrary web script or HTML via the cookie-like parameter named ...

PT-2015-6655 · Synology · Synology Diskstation Manager

Name of the Vulnerable Software and Affected Versions: Synology DiskStation Manager DSM versions prior to 5.2-5565 Update 1 Description: The issue is related to a cross-site scripting XSS vulnerability that allows remote attackers to inject arbitrary web script or HTML. This is achieved via the...

Reflected Cross-Site Scripting in Synology DiskStation Manager

------------------------------------------------------------------------ Reflected Cross-Site Scripting in Synology DiskStation Manager ------------------------------------------------------------------------ Han Sahin, May 2015...

Synology DiskStation Manager XSS Vulnerability

Synology DiskStation Manager is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

Synology DiskStation Manager 'entry.cgi' Cross-Site Scripting Vulnerability

Synology DiskStation Manager is an operating system for use on networked storage servers NAS. A cross-site scripting vulnerability in Synology DiskStation Manager 'entry.cgi' allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to obtain...