Heap overflow

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Synology DiskStation Manager. Authentication is not required to exploit this vulnerablity. The specific flaw exists within the processing of DSI structures in Netatalk. The issue results fr...

CVE-2021-31439

CVE-2021-31439 affects Netatalk components used by Synology DiskStation Manager. The flaw arises in the processing of DSI structures where the length of user-supplied data is not properly validated before copying to a heap-based buffer, enabling network-adjacent attackers to execute arbitrary cod...

CVE-2021-31439

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Synology DiskStation Manager. Authentication is not required to exploit this vulnerablity. The specific flaw exists within the processing of DSI structures in Netatalk. The issue results fr...

CVE-2021-29088

Improper limitation of a pathname to a restricted directory 'Path Traversal' in cgi component in Synology DiskStation Manager DSM before 6.2.4-25553 allows local users to execute arbitrary code via unspecified vectors...

Synology DiskStation Manager Netatalk dsi_doff Heap-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Synology DiskStation DS418play. Authentication is not required to exploit this vulnerablity. The specific flaw exists within the processing of DSI structures in Netatalk. The issue results...

PT-2021-19319 · Synology +4 · Synology Diskstation Manager +4

Name of the Vulnerable Software and Affected Versions: Synology DiskStation Manager affected versions not specified Description: This issue allows network-adjacent attackers to execute arbitrary code on affected installations. Authentication is not required to exploit this issue. The flaw exists...

Vulnerability Spotlight: Multiple vulnerabilities in Synology DiskStation Manager

Claudio Bozzato of Cisco Talos discovered these vulnerabilities. Blog by Jon Munshaw. Cisco Talos recently discovered multiple vulnerabilities in Synology DiskStation Manager. DSM is the Linux-based operating system for every Synology network-attached storage device NAS. The... This is only the...

Synology DiskStation Manager OS Command Injection Vulnerability

Synology DiskStation Manager DSM is an operating system for use on Network Storage Servers NAS from Synology Inc. of Taiwan, China. This operating system manages information such as data, files, photos, music, and more. A security vulnerability exists in Synology DiskStation Manager, which allows...

CVE-2021-29083

Improper neutralization of special elements used in an OS command in SYNO.Core.Network.PPPoE in Synology DiskStation Manager DSM before 6.2.3-25426-3 allows remote authenticated users to execute arbitrary code via realname parameter...

CVE-2021-29083

Improper neutralization of special elements used in an OS command in SYNO.Core.Network.PPPoE in Synology DiskStation Manager DSM before 6.2.3-25426-3 allows remote authenticated users to execute arbitrary code via realname parameter...

Input validation

Improper neutralization of special elements used in an OS command in SYNO.Core.Network.PPPoE in Synology DiskStation Manager DSM before 6.2.3-25426-3 allows remote authenticated users to execute arbitrary code via realname parameter...

CVE-2021-29083

Synology DSM vulnerability CVE-2021-29083 affects DSM versions prior to 6.2.3-25426-3, in the SYNO.Core.Network.PPPoE component. The root cause is improper neutralization of special elements in an OS command, allowing remote authenticated users to execute arbitrary code via the realname parameter...

CVE-2021-29083

Improper neutralization of special elements used in an OS command in SYNO.Core.Network.PPPoE in Synology DiskStation Manager DSM before 6.2.3-25426-3 allows remote authenticated users to execute arbitrary code via realname parameter...

Synology DiskStation Manager 操作系统命令注入漏洞

Synology DiskStation Manager DSM is an operating system for use on Network Storage Servers NAS from Synology Inc. of Taiwan, China. This operating system manages information such as data, files, photos, music, and more. A security vulnerability exists in Synology DiskStation Manager, which allows...

PT-2021-18072 · Synology · Synology Diskstation Manager

Name of the Vulnerable Software and Affected Versions: Synology DiskStation Manager DSM versions prior to 6.2.3-25426-3 Description: The issue is related to the improper neutralization of special elements used in an OS command in SYNO.Core.Network.PPPoE, allowing remote authenticated users to...

(Pwn2Own) Synology DiskStation Manager iscsi_snapshot_comm_core Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows local attackers to execute arbitrary code on affected installations of Synology DS418play. Authentication is not required to exploit this vulnerability. The specific flaw exists within the iscsisnapshotcommcore service. The issue results from the lack of proper locking...

(Pwn2Own) Synology DiskStation Manager iscsi_snapshot_comm_core Race Condition Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows local attackers to execute arbitrary code on affected installations of Synology DS418play. Authentication is not required to exploit this vulnerability. The specific flaw exists within the iscsisnapshotcommcore service. The issue results from the lack of proper locking...

Synology DiskStation Manager Reuse After Release Vulnerability

DiskStation Manager DSM is an operating system that runs on all Synology NAS and can be operated through an intuitive web interface. A post-release reuse vulnerability exists in iscsisnapshotcommcore in Synology DiskStation Manager versions prior to 6.2.3-25426-3. A remote attacker can exploit th...

Synology DiskStation Manager In-Thread Competitive Condition Vulnerability

DiskStation Manager DSM is an operating system that runs on all Synology NAS and can be operated through an intuitive web interface. An in-thread race condition vulnerability exists in iscsisnapshotcommcore in Synology DiskStation Manager versions prior to 6.2.3-25426-3. A remote attacker can...

Synology DiskStation Manager Out-of-Bounds Read Vulnerability

Synology DiskStation Manager DSM is an operating system for use on Network Storage Servers NAS from Synology Inc. of Taiwan, China. This operating system manages information such as data, files, photos, music, and more. An out-of-bounds read vulnerability exists in the iscsisnapshotcommcore modul...