834 matches found
PT-2025-11654
Name of the Vulnerable Software and Affected Versions Synology BeeStation Manager BSM versions 1.1-65374 and earlier Synology DiskStation Manager DSM versions prior to 6.2.4-25556-8 Synology DiskStation Manager DSM versions prior to 7.1.1-42962-7 Synology DiskStation Manager DSM versions prior to...
PT-2025-11652
Name of the Vulnerable Software and Affected Versions Synology BeeStation Manager BSM versions prior to 1.1-65374 Synology DiskStation Manager DSM versions prior to 6.2.4-25556-8, 7.1.1-42962-7, 7.2-64570-4, 7.2.1-69057-6, and 7.2.2-72806-1 Synology Unified Controller DSMUC versions prior to...
PT-2025-11653
Name of the Vulnerable Software and Affected Versions Synology DiskStation Manager DSM versions prior to 7.1.1-42962-8 Synology DiskStation Manager DSM versions prior to 7.2.1-69057-7 Synology DiskStation Manager DSM versions prior to 7.2.2-72806-3 Description The issue is related to improper...
Synology DiskStation Manager Injection (CVE-2017-16766)
An improper access control vulnerability in synodsmnotify in Synology DiskStation Manager DSM before 6.1.4-15217 and before 6.0.3-8754-6 allows local users to inject arbitrary web script or HTML via the -fn option. This plugin only works with Tenable.ot. Please visit...
Synology DiskStation Manager SYNO.API.Encryption API Protection Mechanism Bypass (CVE-2017-9553)
A design flaw in SYNO.API.Encryption in Synology DiskStation Manager DSM before 6.1.3-15152 allows remote attackers to bypass the encryption protection mechanism via the crafted version parameter. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for...
Synology DiskStation Manager Incorrect Default Permissions (CVE-2018-13286)
Incorrect default permissions vulnerability in synouser.conf in Synology Diskstation Manager DSM before 6.2-23739-1 allows remote authenticated users to obtain sensitive information via the world readable configuration. This plugin only works with Tenable.ot. Please visit...
Synology DiskStation Manager Open Redirect (CVE-2024-0854)
URL redirection to untrusted site 'Open Redirect' vulnerability in file access component in Synology DiskStation Manager DSM before 7.2.1-69057-2 allows remote authenticated users to conduct phishing attacks via unspecified vectors. This plugin only works with Tenable.ot. Please visit...
Synology DiskStation Manager Use After Free (CVE-2021-27649)
Use after free vulnerability in file transfer protocol component in Synology DiskStation Manager DSM before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via unspecified vectors. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for...
Synology DiskStation Manager Injection (CVE-2021-29084)
Improper neutralization of special elements in output used by a downstream component 'Injection' vulnerability in Security Advisor report management component in Synology DiskStation Manager DSM before 6.2.3-25426-3 allows remote attackers to read arbitrary files via unspecified vectors. This...
Synology DiskStation Manager Exposure of Sensitive Information to an Unauthorized Actor (CVE-2021-29086)
Exposure of sensitive information to an unauthorized actor vulnerability in webapi component in Synology DiskStation Manager DSM before 6.2.3-25426-3 allows remote attackers to obtain sensitive information via unspecified vectors. This plugin only works with Tenable.ot. Please visit...
Synology DiskStation Manager Path Traversal (CVE-2021-29087)
Improper limitation of a pathname to a restricted directory 'Path Traversal' vulnerability in webapi component in Synology DiskStation Manager DSM before 6.2.3-25426-3 allows remote attackers to write arbitrary files via unspecified vectors. This plugin only works with Tenable.ot. Please visit...
Synology DiskStation FAAD2 Decoder Out-of-bounds Write (CVE-2021-26567)
Stack-based buffer overflow vulnerability in frontend/main.c in faad2 before 2.2.7.1 allow local attackers to execute arbitrary code via filename and pathname options. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information...
Synology DiskStation Manager Cleartext Transmission of Sensitive Information (CVE-2021-26560)
Cleartext transmission of sensitive information vulnerability in synoagentregisterd in Synology DiskStation Manager DSM before 6.2.3-25426-3 allows man-in-the-middle attackers to spoof servers via an HTTP session. This plugin only works with Tenable.ot. Please visit...
Synology DiskStation Manager Out-of-bounds Write (CVE-2021-26562)
Out-of-bounds write vulnerability in synoagentregisterd in Synology DiskStation Manager DSM before 6.2.3-25426-3 allows man-in-the- middle attackers to execute arbitrary code via synofindersite HTTP header. This plugin only works with Tenable.ot. Please visit...
Synology DiskStation Manager Incorrect Authorization (CVE-2021-26563)
Incorrect authorization vulnerability in synoagentregisterd in Synology DiskStation Manager DSM before 6.2.4-25553 allows local users to execute arbitrary code via unspecified vectors. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more...
Synology DiskStation Manager Cleartext Transmission of Sensitive Information (CVE-2021-26564)
Cleartext transmission of sensitive information vulnerability in synorelayd in Synology DiskStation Manager DSM before 6.2.3-25426-3 allows man-in-the-middle attackers to spoof servers via an HTTP session. This plugin only works with Tenable.ot. Please visit...
Synology DiskStation Manager Out-of-bounds Read (CVE-2021-27647)
Out-of-bounds Read vulnerability in iscsisnapshotcommcore in Synology DiskStation Manager DSM before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via crafted web requests. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more...
Synology DiskStation Manager Use After Free (CVE-2021-27646)
Use After Free vulnerability in iscsisnapshotcommcore in Synology DiskStation Manager DSM before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via crafted web requests. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more...
Synology DiskStation Manager Cross-site Scripting (CVE-2012-1556)
Cross-site scripting XSS vulnerability in Synology Photo Station 5 for DiskStation Manager DSM 3.2-1955 allows remote attackers to inject arbitrary web script or HTML via the name parameter to photo/photoone.php. This plugin only works with Tenable.ot. Please visit...
Synology DiskStation Manager OS Command Injection (CVE-2018-13284)
Command injection vulnerability in ftpd in Synology Diskstation Manager DSM before 6.2-23739-1 allows remote authenticated users to execute arbitrary OS commands via the 1 MKD or 2 RMD command. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for mo...