Synology DiskStation Manager跨站脚本漏洞

Bugtraq ID:66504 Synology DiskStation Manager是第一个提供网络多任务处理用户接口的NAS操作系统。 远程攻击者可以利用漏洞构建恶意URI，诱使用户解析，可获得敏感Cookie，劫持会话或在客户端上进行恶意操作。 0 Synology DiskStation Manager 5.x Synology DiskStation Manager 5.0-4458 Update 1版本已修复该漏洞，建议用户下载使用： http://www.synology.com...

Synology DiskStation Manager code execution

Code execution via web interface...

CVE-2013-6955 Synology DSM remote code execution

Products Affected By CVE-2013-6955 Diskstation Manager 4.0 4.2 4.3 4.3-3810 Vendor: Synology Status: Patched webman/imageSelector.cgi in Synology DiskStation Manager DSM 4.0 before 4.0-2259, 4.2 before 4.2-3243, and 4.3 before 4.3-3810 Update 1 allows remote attackers to append data to arbitrary...

Synology DiskStation Manager <= 4.3-3827 'value' Parameter SQL Injection Vulnerability

Binary data 8160.prm...

PT-2014-4593 · Synology +1 · Synology Diskstation Manager +1

Name of the Vulnerable Software and Affected Versions: Synology DiskStation Manager DSM version 4.3-3810 update 1 Description: The issue concerns a hardcoded root password in the OpenVPN module, specifically set to synopass, which can be exploited by remote attackers to gain access via a VPN...

CVE-2014-2264: Exposure of Sensitive Information to an Unauthorized Actor

The OpenVPN module in Synology DiskStation Manager DSM 4.3-3810 update 1 has a hardcoded root password of synopass, which makes it easier for remote attackers to obtain access via a VPN session...

Synology DiskStation Manager VPN module hard-coded password vulnerability

Overview Synology DiskStation Manager VPN module contains a hard-coded password which cannot be changed. Description Synology DiskStation Manager 4.3-3810 update 1 and possibly earlier versions contain a VPN server module which contains a hard-coded password which cannot be changed. According to...

Synology DiskStation Manager (DSM) Detection

Binary data synologydiskstationmanagerdetect.nbin...

Synology DiskStation Manager 4.0-x < 4.0-2259 / 4.1-x / 4.2-x < 4.2-3243 SLICEUPLOAD Function Remote Code Execution

According to its version number, the Synology DiskStation Manager installed on the remote host is affected by a remote code execution vulnerability. The issue exists due to improper validation of values submitted in the 'X-TMP-FILE' header field along with the 'X-TYPE-NAME: SLICEUPLOAD' header...

Synology DiskStation Manager < 4.3-3810 Update 3 Multiple FileBrowser Component Directory Traversal Vulnerabilities

According to its version number, the Synology DiskStation Manager installed on the remote host is 4.3-x equal or prior to 4.3-3810. It is, therefore, affected by multiple directory traversal vulnerabilities in the FileBrowser component. The issue exists due to improper validation of values...

Synology DiskStation Manager < 4.3-3776 Update 3 info.cgi Multiple Parameters XSS

According to its version number, the Synology DiskStation Manager installed on the remote host is a version prior to 4.3-3776 Update 3. It is, therefore, potentially affected by a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input to the 'host', 'target'...

Synology DiskStation Manager 4.3-x < 4.3-3810 Update 1 Multiple Vulnerabilities

According to its version number, the Synology DiskStation Manager installed on the remote host is 4.3-x equal or prior to 4.3-3810. It is, therefore, affected by the following vulnerabilities : - A remote code execution vulnerability exists in the File Station component due to improper validation...

Synology DiskStation Manager uistrings.cgi lang Parameter Directory Traversal

The Synology DiskStation Manager installed on the remote host is affected by a directory traversal vulnerability. By sending a large, padded file path to the 'lang' parameter of the 'uistrings.cgi' script, an overflow will occur within the snprintf function used to prevent such attacks. A remote,...

Design/Logic Flaw

webman/imageSelector.cgi in Synology DiskStation Manager DSM 4.0 before 4.0-2259, 4.2 before 4.2-3243, and 4.3 before 4.3-3810 Update 1 allows remote attackers to append data to arbitrary files, and consequently execute arbitrary code, via a pathname in the SLICEUPLOAD X-TMP-FILE HTTP header...

CVE-2013-6955

webman/imageSelector.cgi in Synology DiskStation Manager DSM 4.0 before 4.0-2259, 4.2 before 4.2-3243, and 4.3 before 4.3-3810 Update 1 allows remote attackers to append data to arbitrary files, and consequently execute arbitrary code, via a pathname in the SLICEUPLOAD X-TMP-FILE HTTP header...

CVE-2013-6955

Summary of CVE-2013-6955 – Synology DiskStation Manager Affected product: Synology DiskStation Manager (DSM) with webman/imageSelector.cgi as part of the File Station component. Vulnerability: Remote code execution via SLICEUPLOAD. An attacker can append data to an arbitrary file by sending a spe...

PT-2014-3236 · Synology · Synology Diskstation Manager

Name of the Vulnerable Software and Affected Versions: Synology DiskStation Manager DSM versions 4.0 through 4.0-2258 Synology DiskStation Manager DSM versions 4.2 through 4.2-3242 Synology DiskStation Manager DSM versions 4.3 through 4.3-3809 Description: The issue allows remote attackers to...

CVE-2013-6955: Undefined Security Weakness

webman/imageSelector.cgi in Synology DiskStation Manager DSM 4.0 before 4.0-2259, 4.2 before 4.2-3243, and 4.3 before 4.3-3810 Update 1 allows remote attackers to append data to arbitrary files, and consequently execute arbitrary code, via a pathname in the SLICEUPLOAD X-TMP-FILE HTTP header...

Synology DiskStation Manager (DSM) 'imageSelector.cgi' RCE Vulnerability - Active Check

Synology DiskStation Manager DSM is prone to a remote command execution RCE vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE ...

Synology DiskStation Manager arbitrary file modification

Overview Synology DiskStation Manager versions 4.3-3776-3 and below contain a vulnerability that allows a remote unauthenticated user to append arbitrary data to an arbitrary file under root privileges. Description CWE-284: Improper Access Control - CVE-2013-6955Synology DiskStation Manager...