Synology DiskStation Manager Cross-Site Scripting Vulnerability (CNVD-2019-08963)

Synology DiskStation Manager DSM is an operating system for use on Network Storage Servers NAS from Synology Inc. of Taiwan, China. This operating system manages information such as data, files, photos, music, and more. A cross-site scripting vulnerability exists in the Control Panel SSO setting ...

Synology DiskStation Manager Command Injection Vulnerability (CNVD-2019-08956)

Synology DiskStation Manager DSM is an operating system for use on Network Storage Servers NAS from Synology Inc. of Taiwan, China. This operating system manages information such as data, files, photos, music, and more. A command injection vulnerability exists in ftpd in Synology DSM versions pri...

Synology DiskStation Manager Information Disclosure Vulnerability (CNVD-2019-08960)

Synology DiskStation Manager DSM is an operating system for use on Network Storage Servers NAS from Synology Inc. of Taiwan, China. This operating system manages information such as data, files, photos, music, and more. An information disclosure vulnerability exists in the /usr/syno/etc/mount.con...

Synology DiskStation Manager Information Disclosure Vulnerability (CNVD-2019-41882)

Synology DiskStation Manager DSM is an operating system for use on Network Storage Servers NAS from Synology Inc. of Taiwan, China. This operating system manages information such as data, files, photos, music, and more. An information disclosure vulnerability exists in Synology DiskStation Manage...

CVE-2018-13291

Information exposure vulnerability in /usr/syno/etc/mount.conf in Synology DiskStation Manager DSM before 6.2.1-23824 allows remote authenticated users to obtain sensitive information via the world readable configuration...

CVE-2018-13293

Cross-site scripting XSS vulnerability in Control Panel SSO Settings in Synology DiskStation Manager DSM before 6.2.1-23824 allows remote authenticated users to inject arbitrary web script or HTML via the URL parameter...

Information disclosure

Information exposure vulnerability in /usr/syno/etc/mount.conf in Synology DiskStation Manager DSM before 6.2.1-23824 allows remote authenticated users to obtain sensitive information via the world readable configuration...

Cross site scripting

Cross-site scripting XSS vulnerability in Control Panel SSO Settings in Synology DiskStation Manager DSM before 6.2.1-23824 allows remote authenticated users to inject arbitrary web script or HTML via the URL parameter...

CVE-2018-13293

Cross-site scripting XSS vulnerability in Control Panel SSO Settings in Synology DiskStation Manager DSM before 6.2.1-23824 allows remote authenticated users to inject arbitrary web script or HTML via the URL parameter...

Default configuration

Incorrect default permissions vulnerability in synouser.conf in Synology Diskstation Manager DSM before 6.2-23739-1 allows remote authenticated users to obtain sensitive information via the world readable configuration...

CVE-2017-16774

Cross-site scripting XSS vulnerability in SYNO.Core.PersonalNotification.Event in Synology DiskStation Manager DSM before 6.1.4-15217-3 allows remote authenticated users to inject arbitrary web script or HTML via the package parameter...

CVE-2018-13286

Incorrect default permissions vulnerability in synouser.conf in Synology Diskstation Manager DSM before 6.2-23739-1 allows remote authenticated users to obtain sensitive information via the world readable configuration...

Cross site scripting

Cross-site scripting XSS vulnerability in SYNO.Core.PersonalNotification.Event in Synology DiskStation Manager DSM before 6.1.4-15217-3 allows remote authenticated users to inject arbitrary web script or HTML via the package parameter...

CVE-2018-13284

Command injection vulnerability in ftpd in Synology Diskstation Manager DSM before 6.2-23739-1 allows remote authenticated users to execute arbitrary OS commands via the 1 MKD or 2 RMD command...

CVE-2018-13293

Cross-site scripting XSS vulnerability in Control Panel SSO Settings in Synology DiskStation Manager DSM before 6.2.1-23824 allows remote authenticated users to inject arbitrary web script or HTML via the URL parameter...

CVE-2017-16774

Cross-site scripting XSS vulnerability in SYNO.Core.PersonalNotification.Event in Synology DiskStation Manager DSM before 6.1.4-15217-3 allows remote authenticated users to inject arbitrary web script or HTML via the package parameter...

CVE-2018-13286

Incorrect default permissions vulnerability in synouser.conf in Synology Diskstation Manager DSM before 6.2-23739-1 allows remote authenticated users to obtain sensitive information via the world readable configuration...

CVE-2018-13291

Information exposure vulnerability in /usr/syno/etc/mount.conf in Synology DiskStation Manager DSM before 6.2.1-23824 allows remote authenticated users to obtain sensitive information via the world readable configuration...

CVE-2018-13286

Incorrect default permissions vulnerability in synouser.conf in Synology Diskstation Manager DSM before 6.2-23739-1 allows remote authenticated users to obtain sensitive information via the world readable configuration...

CVE-2018-13291

CVE-2018-13291 affects Synology DiskStation Manager (DSM) prior to 6.2.1-23824. The vulnerability is an information exposure in the /usr/syno/etc/mount.conf configuration, which remote authenticated users can read due to a world-readable file. This leads to disclosure of sensitive information abo...