Synology DiskStation Manager XSS Vulnerability

Synology DiskStation Manager is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

Synology DiskStation Manager 'entry.cgi' Cross-Site Scripting Vulnerability

Synology DiskStation Manager is an operating system for use on networked storage servers NAS. A cross-site scripting vulnerability in Synology DiskStation Manager 'entry.cgi' allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to obtain...

Synology DiskStation Manager 5.2-5565 Cross Site Scripting

------------------------------------------------------------------------ Reflected Cross-Site Scripting in Synology DiskStation Manager ------------------------------------------------------------------------ Han Sahin, May 2015...

Synology DiskStation Manager Multicast DNS (mDNS) responder denial of service vulnerability

Synology DiskStation Manager is the first NAS operating system to provide a user interface for network multitasking. A security vulnerability exists in the Synology DiskStation Manager Multicast DNS mDNS responder, which can be exploited by remote attackers to gain access to sensitive information...

Design/Logic Flaw

The Multicast DNS mDNS responder in Synology DiskStation Manager DSM before 3.1 inadvertently responds to unicast queries with source addresses that are not link-local, which allows remote attackers to cause a denial of service traffic amplification or obtain potentially sensitive information via...

CVE-2015-2809

The Multicast DNS mDNS responder in Synology DiskStation Manager DSM before 3.1 inadvertently responds to unicast queries with source addresses that are not link-local, which allows remote attackers to cause a denial of service traffic amplification or obtain potentially sensitive information via...

CVE-2015-2809

Summary: Multiple connected advisories confirm a vulnerability related to the Avahi daemon (unrelated to DSM CVE-2015-2809) where Avahi through 0.6.x/0.7.x replies to IPv6 unicast queries with non on-link source addresses, enabling remote DoS (traffic amplification) and potentially information le...

PT-2015-5904

Name of the Vulnerable Software and Affected Versions Synology DiskStation Manager DSM versions prior to 3.1 Description The issue allows remote attackers to cause a denial of service or obtain potentially sensitive information via port-5353 UDP packets to the Avahi component. This is due to the...

CVE-2012-1556

Cross-site scripting XSS vulnerability in Synology Photo Station 5 for DiskStation Manager DSM 3.2-1955 allows remote attackers to inject arbitrary web script or HTML via the name parameter to photo/photoone.php...

CVE-2012-1556

CVE-2012-1556 is a reflected XSS vulnerability in Synology Photo Station 5 on DSM 3.2-1955, where input in the name parameter to photo/photo_one.php is not properly sanitized. The root cause is improper verification of the name input, enabling remote attackers to inject arbitrary scripts. Impacts...

CVE-2012-1556

Cross-site scripting XSS vulnerability in Synology Photo Station 5 for DiskStation Manager DSM 3.2-1955 allows remote attackers to inject arbitrary web script or HTML via the name parameter to photo/photoone.php...

Synology DiskStation Manager - SLICEUPLOAD Remote Command Execution

No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient...

Synology DiskStation Manager SLICEUPLOAD Code Execution (CVE-2013-6955)

An arbitrary file upload vulnerability exists in Synology DiskStation Manager. The vulnerability exists in webman/imageSelector.cgi. A remote unauthenticated attacker can append data to files by sending specially crafted HTTP requests to the server and execute arbitrary code through that...

Synology DiskStation Manager跨站脚本漏洞

Bugtraq ID:66504 Synology DiskStation Manager是第一个提供网络多任务处理用户接口的NAS操作系统。 远程攻击者可以利用漏洞构建恶意URI，诱使用户解析，可获得敏感Cookie，劫持会话或在客户端上进行恶意操作。 0 Synology DiskStation Manager 5.x Synology DiskStation Manager 5.0-4458 Update 1版本已修复该漏洞，建议用户下载使用： http://www.synology.com...

CVE-2013-6955 Synology DSM remote code execution

Products Affected By CVE-2013-6955 Diskstation Manager 4.0 4.2 4.3 4.3-3810 Vendor: Synology Status: Patched webman/imageSelector.cgi in Synology DiskStation Manager DSM 4.0 before 4.0-2259, 4.2 before 4.2-3243, and 4.3 before 4.3-3810 Update 1 allows remote attackers to append data to arbitrary...

Synology DiskStation Manager code execution

Code execution via web interface...

Synology DiskStation Manager <= 4.3-3827 'value' Parameter SQL Injection Vulnerability

Binary data 8160.prm...

PT-2014-4593 · Synology +1 · Synology Diskstation Manager +1

Name of the Vulnerable Software and Affected Versions: Synology DiskStation Manager DSM version 4.3-3810 update 1 Description: The issue concerns a hardcoded root password in the OpenVPN module, specifically set to synopass, which can be exploited by remote attackers to gain access via a VPN...

Synology DiskStation Manager VPN module hard-coded password vulnerability

Overview Synology DiskStation Manager VPN module contains a hard-coded password which cannot be changed. Description Synology DiskStation Manager 4.3-3810 update 1 and possibly earlier versions contain a VPN server module which contains a hard-coded password which cannot be changed. According to...

Synology DiskStation Manager uistrings.cgi lang Parameter Directory Traversal

The Synology DiskStation Manager installed on the remote host is affected by a directory traversal vulnerability. By sending a large, padded file path to the 'lang' parameter of the 'uistrings.cgi' script, an overflow will occur within the snprintf function used to prevent such attacks. A remote,...