Synology DiskStation Manager Missing Authentication for Critical Function (CVE-2022-27623)

Missing authentication for critical function vulnerability in iSCSI management functionality in Synology DiskStation Manager DSM before 7.1-42661 allows remote attackers to read or write arbitrary files via unspecified vectors. This plugin only works with Tenable.ot. Please visit...

Synology DiskStation Manager Exposure of Sensitive Information to an Unauthorized Actor (CVE-2017-9554)

An information exposure vulnerability in forgetpasswd.cgi in Synology DiskStation Manager DSM before 6.1.3-15152 allows remote attackers to enumerate valid usernames via unspecified vectors. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more...

Synology DiskStation Manager Cleartext Transmission of Sensitive Information (CVE-2020-27656)

Cleartext transmission of sensitive information vulnerability in DDNS in Synology DiskStation Manager DSM before 6.2.3-25426-2 allows man- in-the-middle attackers to eavesdrop authentication information of DNSExit via unspecified vectors. This plugin only works with Tenable.ot. Please visit...

Synology DiskStation Manager Out-of-bounds Read (CVE-2022-3576)

A vulnerability regarding out-of-bounds read is found in the session processing functionality of Out-of-Band OOB Management. This allows remote attackers to obtain sensitive information via unspecified vectors. The following models with Synology DiskStation Manager DSM versions before 7.1.1-42962...

Synology DiskStation Manager Path Traversal (CVE-2021-33182)

Improper limitation of a pathname to a restricted directory 'Path Traversal' vulnerability in PDF Viewer component in Synology DiskStation Manager DSM before 6.2.4-25553 allows remote authenticated users to read limited files via unspecified vectors. This plugin only works with Tenable.ot. Please...

Synology DiskStation Manager Exposure of Sensitive Information to an Unauthorized Actor (CVE-2015-2809)

The Multicast DNS mDNS responder in Synology DiskStation Manager DSM before 3.1 inadvertently responds to unicast queries with source addresses that are not link-local, which allows remote attackers to cause a denial of service traffic amplification or obtain potentially sensitive information via...

Synology DiskStation Manager Path Traversal (CVE-2013-6987)

Multiple directory traversal vulnerabilities in the FileBrowser components in Synology DiskStation Manager DSM before 4.3-3810 Update 3 allow remote attackers to read, write, and delete arbitrary files via a .. dot dot in the 1 path parameter to filedelete.cgi or 2 folderpath parameter to...

Synology DiskStation Manager Path Traversal (CVE-2021-29088)

Improper limitation of a pathname to a restricted directory 'Path Traversal' in cgi component in Synology DiskStation Manager DSM before 6.2.4-25553 allows local users to execute arbitrary code via unspecified vectors. This plugin only works with Tenable.ot. Please visit...

Synology DiskStation Manager Injection (CVE-2021-29085)

Improper neutralization of special elements in output used by a downstream component 'Injection' vulnerability in file sharing management component in Synology DiskStation Manager DSM before 6.2.3-25426-3 allows remote attackers to read arbitrary files via unspecified vectors. This plugin only...

Synology DiskStation Manager Weak Password Recovery Mechanism for Forgotten Password (CVE-2018-8916)

Unverified password change vulnerability in Change Password in Synology DiskStation Manager DSM before 6.2-23739 allows remote authenticated users to reset password without verification. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more...

Synology DiskStation Manager OS Command Injection (CVE-2021-29083)

Improper neutralization of special elements used in an OS command in SYNO.Core.Network.PPPoE in Synology DiskStation Manager DSM before 6.2.3-25426-3 allows remote authenticated users to execute arbitrary code via realname parameter. This plugin only works with Tenable.ot. Please visit...

Synology NAS / DiskStation Manager Detection (findhostd)

findhostd based detection of Synology NAS devices, DiskStation Manager DSM OS and application. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Synology NAS / DiskStation Manager Detection (SNMP)

SNMP based detection of Synology NAS / DiskStation Manager DSM. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

Synology NAS / DiskStation Manager Detection (SSH Login)

SSH login-based detection of Synology NAS / DiskStation Manager DSM. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2024-0854

URL redirection to untrusted site 'Open Redirect' vulnerability in file access component in Synology DiskStation Manager DSM before 6.2.4-25556-8, 7.0.1-42218-7, 7.1.1-42962-7 and 7.2.1-69057-2 allows remote authenticated users to conduct phishing attacks via unspecified vectors...

CVE-2024-0854

URL redirection to untrusted site 'Open Redirect' vulnerability in file access component in Synology DiskStation Manager DSM before 6.2.4-25556-8, 7.0.1-42218-7, 7.1.1-42962-7 and 7.2.1-69057-2 allows remote authenticated users to conduct phishing attacks via unspecified vectors...

Open redirect

URL redirection to untrusted site 'Open Redirect' vulnerability in file access component in Synology DiskStation Manager DSM before 7.2.1-69057-2 allows remote authenticated users to conduct phishing attacks via unspecified vectors...

CVE-2024-0854

URL redirection to untrusted site 'Open Redirect' vulnerability in file access component in Synology DiskStation Manager DSM before 6.2.4-25556-8, 7.0.1-42218-7, 7.1.1-42962-7 and 7.2.1-69057-2 allows remote authenticated users to conduct phishing attacks via unspecified vectors...

CVE-2024-0854

URL redirection to untrusted site 'Open Redirect' vulnerability in file access component in Synology DiskStation Manager DSM before 6.2.4-25556-8, 7.0.1-42218-7, 7.1.1-42962-7 and 7.2.1-69057-2 allows remote authenticated users to conduct phishing attacks via unspecified vectors...

Synology DiskStation Manager (DSM) Open Redirect Vulnerability (Synology-SA-24:02) - Unreliable Remote Version Check

Synology DiskStation Manager DSM is prone to an open redirect vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...