3579 matches found
CVE-2013-6987
CVE-2013-6987 Multiple directory traversal vulnerabilities in the FileBrowser components in Synology DiskStation Manager DSM before 4.3-3810 Update 3 allow remote attackers to read, write, and delete arbitrary files via a .. dot dot Usage: python example: list filesystem python filelist.py...
CVE-2024-50629_50631
CVE-2024-5062950631 Pre-auth RCE N-day exploitation of Synology BeeStation. Detail: https://kiddo-pwn.github.io/blog/2025-11-30/writing-sync-popping-cron https://github.com/user-attachments/assets/8e2ef59c-4f60-4308-8cd4-6d7ce0ba72e1 $ python3 poc.py 192.168.88.248 192.168.88.254 LISTENER listeni...
Synology-DiskStation-User-Enumeration-CVE-2017-9554-
Synology DiskStation User Enumeration CVE-2017-9554 Basic script to enumerate valid users on Synology DiskStation v6.1.3-15152...
CVE-2017-9554-Exploit-Tool
CVE-2017-9554-Exploit-Tool CVE-2017-9554 Exploit Tool Synology DiskStation Manager DSM 6.1.3-15152 - 'forgetpasswd.cgi' User Enumeration EXPLOIT Tool Exploit Author : Steve Kaun Exploit Tool Author : Ez0-yf Vendor Homepage : https://www.synology.com Version : Before 6.1.3-15152 CVE : CVE-2017-955...
synodecrypt
SynoDecrypt A tool to decrypt all Synology encrypted archives SPK, PAT, .... The reverse engineering work is explained in our blog post. Installation pip install -r requirements.txt Usage You first have to extract the encryption keys and put them into a JSON file e.g. into keys.json. This JSON fi...
CVE-2025-4679-SecureOAuth-Demo---Enfoque-educativo
š OAuth Security Laboratory: CVE-2025-4679 Educational Simulator A safe, isolated environment to learn about OAuth vulnerabilities without risking real systems š Quick Start | š Learning Path | š”ļø Safe Environment | š„ Contributors š Overview This educational laboratory simulates the CVE-2025-4679...
Synology DiskStation Manager Improper Check for Unusual or Exceptional Conditions (CVE-2025-13392)
Improper check for unusual or exceptional conditions vulnerability in SSO in Synology DiskStation Manager DSM before 7.2.2-72806-5 and 7.3.1-86003-1 7.2.1-69057 is not affected allows remote attackers to bypass authentication with prior knowledge of the distinguished name DN. This plugin only wor...
CVE-2026-100572
OpenClaw versions = 2026.3.25 and 2026.8.1 apply invalid-token rate limiting for Synology Chat webhooks before authentication and key the limit on the raw proxy socket address. In deployments where OpenClaw sits behind a trusted reverse proxy or tunnel and multiple external clients share a single...
CVE-2026-100555
OpenClaw is an npm-distributed gateway application. In versions = 2026.7.1 and 2026.8.1, Synology Chat attachment delivery could lose DNS pinning: the Gateway validated a single DNS result for a supplied file URL but then passed the original hostname to the Synology NAS, where it could resolve to...
CVE-2026-100572
OpenClaw versions = 2026.3.25 and 2026.8.1 apply invalid-token rate limiting for Synology Chat webhooks before authentication and key the limit on the raw proxy socket address. In deployments where OpenClaw sits behind a trusted reverse proxy or tunnel and multiple external clients share a single...
CVE-2026-100572 OpenClaw before 2026.8.1 Denial of Service via Rate Limit
OpenClaw versions = 2026.3.25 and 2026.8.1 apply invalid-token rate limiting for Synology Chat webhooks before authentication and key the limit on the raw proxy socket address. In deployments where OpenClaw sits behind a trusted reverse proxy or tunnel and multiple external clients share a single...
CVE-2026-100572 OpenClaw before 2026.8.1 Denial of Service via Rate Limit
OpenClaw versions = 2026.3.25 and 2026.8.1 apply invalid-token rate limiting for Synology Chat webhooks before authentication and key the limit on the raw proxy socket address. In deployments where OpenClaw sits behind a trusted reverse proxy or tunnel and multiple external clients share a single...
CVE-2026-100572 OpenClaw before 2026.8.1 Denial of Service via Rate Limit
OpenClaw versions = 2026.3.25 and 2026.8.1 apply invalid-token rate limiting for Synology Chat webhooks before authentication and key the limit on the raw proxy socket address. In deployments where OpenClaw sits behind a trusted reverse proxy or tunnel and multiple external clients share a single...
CVE-2026-100572
OpenClaw versions >= 2026.3.25 and
EUVD-2026-87479
OpenClaw versions = 2026.3.25 and 2026.8.1 apply invalid-token rate limiting for Synology Chat webhooks before authentication and key the limit on the raw proxy socket address. In deployments where OpenClaw sits behind a trusted reverse proxy or tunnel and multiple external clients share a single...
CVE-2026-100555
The OpenClaw npm-distributed gateway application (versions >= 2026.7.1 and
EUVD-2026-87495
OpenClaw is an npm-distributed gateway application. In versions = 2026.7.1 and 2026.8.1, Synology Chat attachment delivery could lose DNS pinning: the Gateway validated a single DNS result for a supplied file URL but then passed the original hostname to the Synology NAS, where it could resolve to...
CVE-2026-100555 OpenClaw before 2026.8.1 DNS Rebinding via attachment delivery
OpenClaw is an npm-distributed gateway application. In versions = 2026.7.1 and 2026.8.1, Synology Chat attachment delivery could lose DNS pinning: the Gateway validated a single DNS result for a supplied file URL but then passed the original hostname to the Synology NAS, where it could resolve to...
CVE-2026-100555 OpenClaw before 2026.8.1 DNS Rebinding via attachment delivery
OpenClaw is an npm-distributed gateway application. In versions = 2026.7.1 and 2026.8.1, Synology Chat attachment delivery could lose DNS pinning: the Gateway validated a single DNS result for a supplied file URL but then passed the original hostname to the Synology NAS, where it could resolve to...
CVE-2026-100555 OpenClaw before 2026.8.1 DNS Rebinding via attachment delivery
OpenClaw is an npm-distributed gateway application. In versions = 2026.7.1 and 2026.8.1, Synology Chat attachment delivery could lose DNS pinning: the Gateway validated a single DNS result for a supplied file URL but then passed the original hostname to the Synology NAS, where it could resolve to...