Synology DiskStation Manager Improper Restriction of Operations within the Bounds of a Memory Buffer (CVE-2022-27624)

A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the packet decryption functionality of Out-of-Band OOB Management. This allows remote attackers to execute arbitrary commands via unspecified vectors. The following models with Synology...

Synology DiskStation Manager Injection (CVE-2017-16766)

An improper access control vulnerability in synodsmnotify in Synology DiskStation Manager DSM before 6.1.4-15217 and before 6.0.3-8754-6 allows local users to inject arbitrary web script or HTML via the -fn option. This plugin only works with Tenable.ot. Please visit...

Synology DiskStation Manager Use of Insufficiently Random Values (CVE-2018-13280)

Use of insufficiently random values vulnerability in SYNO.Encryption.GenRandomKey in Synology DiskStation Manager DSM before 6.2-23739 allows man-in-the-middle attackers to compromise non- HTTPS sessions via unspecified vectors. This plugin only works with Tenable.ot. Please visit...

Synology DiskStation Manager SQL Injection (CVE-2021-43927)

Improper neutralization of special elements used in an SQL command 'SQL Injection' vulnerability in Security Management functionality in Synology DiskStation Manager DSM before 7.0.1-42218-2 allows remote attackers to inject SQL commands via unspecified vectors. This plugin only works with...

Synology DiskStation Manager Improper Neutralization of Input During Web Page Generation (CVE-2018-13293)

Cross-site scripting XSS vulnerability in Control Panel SSO Settings in Synology DiskStation Manager DSM before 6.2.1-23824 allows remote authenticated users to inject arbitrary web script or HTML via the URL parameter. This plugin only works with Tenable.ot. Please visit...

Synology DiskStation Manager OS Command Injection (CVE-2018-13284)

Command injection vulnerability in ftpd in Synology Diskstation Manager DSM before 6.2-23739-1 allows remote authenticated users to execute arbitrary OS commands via the 1 MKD or 2 RMD command. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for mo...

Synology DiskStation Manager Use After Free (CVE-2021-27646)

Use After Free vulnerability in iscsisnapshotcommcore in Synology DiskStation Manager DSM before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via crafted web requests. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more...

Synology DiskStation Manager Out-of-bounds Read (CVE-2021-27647)

Out-of-bounds Read vulnerability in iscsisnapshotcommcore in Synology DiskStation Manager DSM before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via crafted web requests. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more...

Synology DiskStation Manager Cleartext Transmission of Sensitive Information (CVE-2021-26560)

Cleartext transmission of sensitive information vulnerability in synoagentregisterd in Synology DiskStation Manager DSM before 6.2.3-25426-3 allows man-in-the-middle attackers to spoof servers via an HTTP session. This plugin only works with Tenable.ot. Please visit...

Synology DiskStation Manager Incorrect Default Permissions (CVE-2018-13286)

Incorrect default permissions vulnerability in synouser.conf in Synology Diskstation Manager DSM before 6.2-23739-1 allows remote authenticated users to obtain sensitive information via the world readable configuration. This plugin only works with Tenable.ot. Please visit...

Synology DiskStation Manager SYNO.API.Encryption API Protection Mechanism Bypass (CVE-2017-9553)

A design flaw in SYNO.API.Encryption in Synology DiskStation Manager DSM before 6.1.3-15152 allows remote attackers to bypass the encryption protection mechanism via the crafted version parameter. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for...

Synology DiskStation Manager Incorrect Authorization (CVE-2021-26563)

Incorrect authorization vulnerability in synoagentregisterd in Synology DiskStation Manager DSM before 6.2.4-25553 allows local users to execute arbitrary code via unspecified vectors. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more...

Synology DiskStation Manager Cleartext Transmission of Sensitive Information (CVE-2021-26564)

Cleartext transmission of sensitive information vulnerability in synorelayd in Synology DiskStation Manager DSM before 6.2.3-25426-3 allows man-in-the-middle attackers to spoof servers via an HTTP session. This plugin only works with Tenable.ot. Please visit...

Synology DiskStation Manager Use of Insufficiently Random Values (CVE-2023-2729)

Use of insufficiently random values vulnerability in User Management Functionality in Synology DiskStation Manager DSM before 7.2-64561 allows remote attackers to obtain user credential via unspecified vectors. This plugin only works with Tenable.ot. Please visit...

Synology DiskStation Manager SQL Injection (CVE-2021-43926)

Improper neutralization of special elements used in an SQL command 'SQL Injection' vulnerability in Log Management functionality in Synology DiskStation Manager DSM before 7.0.1-42218-2 allows remote attackers to inject SQL commands via unspecified vectors. This plugin only works with Tenable.ot...

Synology DiskStation Manager Cross-site Scripting (CVE-2012-1556)

Cross-site scripting XSS vulnerability in Synology Photo Station 5 for DiskStation Manager DSM 3.2-1955 allows remote attackers to inject arbitrary web script or HTML via the name parameter to photo/photoone.php. This plugin only works with Tenable.ot. Please visit...

Synology DiskStation Manager Observable Discrepancy (CVE-2017-5753)

Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot f...

Synology DiskStation Manager Open Redirect (CVE-2024-0854)

URL redirection to untrusted site 'Open Redirect' vulnerability in file access component in Synology DiskStation Manager DSM before 7.2.1-69057-2 allows remote authenticated users to conduct phishing attacks via unspecified vectors. This plugin only works with Tenable.ot. Please visit...

Synology DiskStation Uncontrolled Resource Consumption (CVE-2017-12076)

Uncontrolled Resource Consumption vulnerability in SYNO.Core.PortForwarding.Rules in Synology DiskStation DSM before 6.1.1-15088 allows remote authenticated attacker to exhaust the memory resources of the machine, causing a denial of service attack. This plugin only works with Tenable.ot. Please...

Synology DiskStation Manager Permissions, Privileges, and Access Controls (CVE-2013-6955)

webman/imageSelector.cgi in Synology DiskStation Manager DSM 4.0 before 4.0-2259, 4.2 before 4.2-3243, and 4.3 before 4.3-3810 Update 1 allows remote attackers to append data to arbitrary files, and consequently execute arbitrary code, via a pathname in the SLICEUPLOAD X-TMP-FILE HTTP header. Thi...