Synology DiskStation Manager smart.cgi Remote Command Execution

This module exploits a vulnerability found in Synology DiskStation Manager DSM versions use exploit/linux/http/synology/dsmsmartexecauth msf undefineddsmsmartexecauth show actions ...actions... msf undefineddsmsmartexecauth set ACTION msf undefineddsmsmartexecauth show options ...show and set...

Synology DiskStation Manager (DSM) Denial of Service Vulnerability

DiskStation Manager DSM is an intuitive web-based operating system for every Synology NAS designed to help you manage digital assets in your home and office. A security vulnerability in SYNO.Core.PortForwarding.Rules in Synology DiskStation Manager DSM allows remote authenticated attackers to...

Synology DiskStation Manager (DSM) Encryption Mechanism Bypass Vulnerability

Synology DiskStation Manager is an operating system for use on networked storage servers NAS. A security vulnerability in Synology DiskStation Manager SYNO.API.Encryption allows remote attackers to bypass the encryption protection mechanism by submitting a special 'version' parameter request...

Synology DiskStation Manager (DSM) Information Disclosure Vulnerability

Synology DiskStation Manager is an operating system for use on networked storage servers NAS. A security vulnerability in Synology DiskStation Manager forgetpasswd.cgi allows remote attackers to submit a special request to enumerate valid usernames...

CVE-2017-9554

An information exposure vulnerability in forgetpasswd.cgi in Synology DiskStation Manager DSM before 6.1.3-15152 allows remote attackers to enumerate valid usernames via unspecified vectors...

CVE-2017-9553

A design flaw in SYNO.API.Encryption in Synology DiskStation Manager DSM before 6.1.3-15152 allows remote attackers to bypass the encryption protection mechanism via the crafted version parameter...

Design/Logic Flaw

A design flaw in SYNO.API.Encryption in Synology DiskStation Manager DSM before 6.1.3-15152 allows remote attackers to bypass the encryption protection mechanism via the crafted version parameter...

CVE-2017-9553

A design flaw in SYNO.API.Encryption in Synology DiskStation Manager DSM before 6.1.3-15152 allows remote attackers to bypass the encryption protection mechanism via the crafted version parameter...

CVE-2017-9554

An information exposure vulnerability in forgetpasswd.cgi in Synology DiskStation Manager DSM before 6.1.3-15152 allows remote attackers to enumerate valid usernames via unspecified vectors...

CVE-2017-9553

A design flaw in SYNO.API.Encryption in Synology DiskStation Manager DSM before 6.1.3-15152 allows remote attackers to bypass the encryption protection mechanism via the crafted version parameter...

CVE-2017-9553

CVE-2017-9553 concerns a design flaw in Synology DiskStation Manager (DSM) SYNO.API.Encryption that, on DSM versions prior to 6.1.3-15152, allows remote attackers to bypass the encryption protection mechanism by sending a crafted version parameter. The issue affects DSM’s SYNO.API.Encryption comp...

CVE-2017-9554

An information exposure vulnerability in forgetpasswd.cgi in Synology DiskStation Manager DSM before 6.1.3-15152 allows remote attackers to enumerate valid usernames via unspecified vectors...

CVE-2017-9554: Exposure of Sensitive Information to an Unauthorized Actor

An information exposure vulnerability in forgetpasswd.cgi in Synology DiskStation Manager DSM before 6.1.3-15152 allows remote attackers to enumerate valid usernames via unspecified vectors...

PT-2017-19013 · Synology · Synology Diskstation Manager

Name of the Vulnerable Software and Affected Versions: Synology DiskStation Manager DSM versions prior to 6.1.3-15152 Description: A design flaw in SYNO.API.Encryption allows remote attackers to bypass the encryption protection mechanism via the crafted version parameter. Recommendations: For...

PT-2017-19014 · Synology · Synology Diskstation Manager

Name of the Vulnerable Software and Affected Versions: Synology DiskStation Manager DSM versions prior to 6.1.3-15152 Description: The issue allows remote attackers to enumerate valid usernames via unspecified vectors due to an information exposure vulnerability in forget passwd.cgi...

CVE-2017-9553: Undefined Security Weakness

A design flaw in SYNO.API.Encryption in Synology DiskStation Manager DSM before 6.1.3-15152 allows remote attackers to bypass the encryption protection mechanism via the crafted version parameter...

Synology DiskStation Manager (DSM) Web Administration Interface Default Credentials

The web administration interface for the Synology DiskStation Manager DSM application running on the remote host uses a default blank password for the administrator account. A remote attacker can exploit this to gain administrative access to the web interface. C Tenable Network Security, Inc...

Synology DiskStation Manager Cross-Site Scripting Vulnerability

Synology DiskStation Manager is a web-based intuitive operating system that helps users manage files, photos, music, videos, and other important content stored on Synology DiskStation and RackStation. A cross-site scripting vulnerability exists in Synology DiskStation Manager, which allows remote...

CVE-2015-4655

Cross-site scripting XSS vulnerability in Synology DiskStation Manager DSM before 5.2-5565 Update 1 allows remote attackers to inject arbitrary web script or HTML via the "compound" parameter to entry.cgi...

CVE-2015-4655

Cross-site scripting XSS vulnerability in Synology DiskStation Manager DSM before 5.2-5565 Update 1 allows remote attackers to inject arbitrary web script or HTML via the "compound" parameter to entry.cgi...