Synology DiskStation Manager Multicast DNS (mDNS) responder denial of service vulnerability

Synology DiskStation Manager is the first NAS operating system to provide a user interface for network multitasking. A security vulnerability exists in the Synology DiskStation Manager Multicast DNS mDNS responder, which can be exploited by remote attackers to gain access to sensitive information...

Design/Logic Flaw

The Multicast DNS mDNS responder in Synology DiskStation Manager DSM before 3.1 inadvertently responds to unicast queries with source addresses that are not link-local, which allows remote attackers to cause a denial of service traffic amplification or obtain potentially sensitive information via...

CVE-2015-2809

The Multicast DNS mDNS responder in Synology DiskStation Manager DSM before 3.1 inadvertently responds to unicast queries with source addresses that are not link-local, which allows remote attackers to cause a denial of service traffic amplification or obtain potentially sensitive information via...

CVE-2015-2809

Summary: Multiple connected advisories confirm a vulnerability related to the Avahi daemon (unrelated to DSM CVE-2015-2809) where Avahi through 0.6.x/0.7.x replies to IPv6 unicast queries with non on-link source addresses, enabling remote DoS (traffic amplification) and potentially information le...

PT-2015-5904

Name of the Vulnerable Software and Affected Versions Synology DiskStation Manager DSM versions prior to 3.1 Description The issue allows remote attackers to cause a denial of service or obtain potentially sensitive information via port-5353 UDP packets to the Avahi component. This is due to the...

CVE-2012-1556

Cross-site scripting XSS vulnerability in Synology Photo Station 5 for DiskStation Manager DSM 3.2-1955 allows remote attackers to inject arbitrary web script or HTML via the name parameter to photo/photoone.php...

CVE-2012-1556

Cross-site scripting XSS vulnerability in Synology Photo Station 5 for DiskStation Manager DSM 3.2-1955 allows remote attackers to inject arbitrary web script or HTML via the name parameter to photo/photoone.php...

CVE-2012-1556

CVE-2012-1556 is a reflected XSS vulnerability in Synology Photo Station 5 on DSM 3.2-1955, where input in the name parameter to photo/photo_one.php is not properly sanitized. The root cause is improper verification of the name input, enabling remote attackers to inject arbitrary scripts. Impacts...

Synology DiskStation Manager - SLICEUPLOAD Remote Command Execution

No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient...

Synology DiskStation Manager SLICEUPLOAD Code Execution (CVE-2013-6955)

An arbitrary file upload vulnerability exists in Synology DiskStation Manager. The vulnerability exists in webman/imageSelector.cgi. A remote unauthenticated attacker can append data to files by sending specially crafted HTTP requests to the server and execute arbitrary code through that...

Synology DiskStation Manager跨站脚本漏洞

Bugtraq ID:66504 Synology DiskStation Manager是第一个提供网络多任务处理用户接口的NAS操作系统。 远程攻击者可以利用漏洞构建恶意URI，诱使用户解析，可获得敏感Cookie，劫持会话或在客户端上进行恶意操作。 0 Synology DiskStation Manager 5.x Synology DiskStation Manager 5.0-4458 Update 1版本已修复该漏洞，建议用户下载使用： http://www.synology.com...

CVE-2013-6955 Synology DSM remote code execution

Products Affected By CVE-2013-6955 Diskstation Manager 4.0 4.2 4.3 4.3-3810 Vendor: Synology Status: Patched webman/imageSelector.cgi in Synology DiskStation Manager DSM 4.0 before 4.0-2259, 4.2 before 4.2-3243, and 4.3 before 4.3-3810 Update 1 allows remote attackers to append data to arbitrary...

Synology DiskStation Manager code execution

Code execution via web interface...

Synology DiskStation Manager <= 4.3-3827 'value' Parameter SQL Injection Vulnerability

Binary data 8160.prm...

PT-2014-4593 · Synology +1 · Synology Diskstation Manager +1

Name of the Vulnerable Software and Affected Versions: Synology DiskStation Manager DSM version 4.3-3810 update 1 Description: The issue concerns a hardcoded root password in the OpenVPN module, specifically set to synopass, which can be exploited by remote attackers to gain access via a VPN...

Synology DiskStation Manager VPN module hard-coded password vulnerability

Overview Synology DiskStation Manager VPN module contains a hard-coded password which cannot be changed. Description Synology DiskStation Manager 4.3-3810 update 1 and possibly earlier versions contain a VPN server module which contains a hard-coded password which cannot be changed. According to...

Synology DiskStation Manager uistrings.cgi lang Parameter Directory Traversal

The Synology DiskStation Manager installed on the remote host is affected by a directory traversal vulnerability. By sending a large, padded file path to the 'lang' parameter of the 'uistrings.cgi' script, an overflow will occur within the snprintf function used to prevent such attacks. A remote,...

Synology DiskStation Manager (DSM) Detection

Binary data synologydiskstationmanagerdetect.nbin...

Synology DiskStation Manager < 4.3-3810 Update 3 Multiple FileBrowser Component Directory Traversal Vulnerabilities

According to its version number, the Synology DiskStation Manager installed on the remote host is 4.3-x equal or prior to 4.3-3810. It is, therefore, affected by multiple directory traversal vulnerabilities in the FileBrowser component. The issue exists due to improper validation of values...

Synology DiskStation Manager 4.3-x < 4.3-3810 Update 1 Multiple Vulnerabilities

According to its version number, the Synology DiskStation Manager installed on the remote host is 4.3-x equal or prior to 4.3-3810. It is, therefore, affected by the following vulnerabilities : - A remote code execution vulnerability exists in the File Station component due to improper validation...