CVE-2018-13280

CVE-2018-13280 affects Synology DiskStation Manager (DSM) prior to version 6.2-23739. The root cause is the use of insufficiently random values in SYNO.Encryption.GenRandomKey, which can allow remote attackers to perform a man-in-the-middle attack on non-HTTPS sessions. Practical impact stated is...

CVE-2018-13280

Use of insufficiently random values vulnerability in SYNO.Encryption.GenRandomKey in Synology DiskStation Manager DSM before 6.2-23739 allows man-in-the-middle attackers to compromise non-HTTPS sessions via unspecified vectors...

PT-2018-11723 · Synology · Synology Diskstation Manager

Name of the Vulnerable Software and Affected Versions: Synology DiskStation Manager DSM versions prior to 6.2-23739 Description: The issue is related to the use of insufficiently random values in the SYNO.Encryption.GenRandomKey function, allowing man-in-the-middle attackers to compromise non-HTT...

Synology DiskStation Manager 4.1 - Directory Traversal

Exploit Title: Synology DiskStation Manager 4.1 - Directory Traversal Google Dork: N/A Date: 2018-07-21 Exploit Author: Berk Dusunur Vendor Homepage: https://www.synology.com Software Link: https://www.synology.com Version: v4.1 Tested on: Parrot OS CVE : N/A PoC...

Synology DiskStation Manager 4.1 - Directory Traversal

Synology DiskStation Manager 4.1 - Directory Traversal Exploit Title: Synology DiskStation Manager 4.1 - Directory Traversal Google Dork: N/A Date: 2018-07-21 Exploit Author: Berk Dusunur Vendor Homepage: https://www.synology.com Software Link: https://www.synology.com Version: v4.1 Tested on:...

Synology DiskStation Manager Command Injection Vulnerability (CNVD-2018-11370)

Synology DiskStation Manager DSM is a set of operating systems for use on networked storage servers NAS from Synology Inc. The operating system can manage information such as data, files, photos, music, etc. EZ-Internet is one of the network configuration tools. A command injection vulnerability...

Synology DiskStation Manager Password Change Vulnerability

DiskStation Manager DSM is an operating system that runs on all Synology NAS and can be operated through an intuitive web interface. A password change vulnerability exists in Change Password in Synology DiskStation ManagerDSM versions prior to 6.2-23739. A remote attacker can use this vulnerabili...

CVE-2018-8916

Unverified password change vulnerability in Change Password in Synology DiskStation Manager DSM before 6.2-23739 allows remote authenticated users to reset password without verification...

CVE-2018-8916

Unverified password change vulnerability in Change Password in Synology DiskStation Manager DSM before 6.2-23739 allows remote authenticated users to reset password without verification...

Command injection

Command injection vulnerability in EZ-Internet in Synology DiskStation Manager DSM before 6.2-23739 allows remote authenticated users to execute arbitrary command via the username parameter...

CVE-2017-12075

Command injection vulnerability in EZ-Internet in Synology DiskStation Manager DSM before 6.2-23739 allows remote authenticated users to execute arbitrary command via the username parameter...

Default credentials

Unverified password change vulnerability in Change Password in Synology DiskStation Manager DSM before 6.2-23739 allows remote authenticated users to reset password without verification...

CVE-2017-12075

Command injection vulnerability in EZ-Internet in Synology DiskStation Manager DSM before 6.2-23739 allows remote authenticated users to execute arbitrary command via the username parameter...

CVE-2017-12075

The CVE-2017-12075 issue affects Synology DiskStation Manager (DSM) prior to 6.2-23739, specifically in EZ-Internet. The vulnerability permits a remote authenticated user to inject and execute arbitrary commands through the username parameter, due to improper handling of input. Affected component...

CVE-2017-12075

Command injection vulnerability in EZ-Internet in Synology DiskStation Manager DSM before 6.2-23739 allows remote authenticated users to execute arbitrary command via the username parameter...

CVE-2018-8916

The CVE-2018-8916 issue affects Synology DiskStation Manager (DSM) prior to 6.2-23739. The vulnerability lies in the Change Password function, where remote authenticated users can reset a password without completing verification, due to an unverified password change flow. Impact is described as a...

CVE-2018-8916

Unverified password change vulnerability in Change Password in Synology DiskStation Manager DSM before 6.2-23739 allows remote authenticated users to reset password without verification...

PT-2018-18714 · Synology · Synology Diskstation Manager

Name of the Vulnerable Software and Affected Versions: Synology DiskStation Manager DSM versions prior to 6.2-23739 Description: The issue concerns an unverified password change vulnerability in the Change Password feature. This allows remote authenticated users to reset passwords without proper...

PT-2018-5338 · Synology · Synology Diskstation Manager

Name of the Vulnerable Software and Affected Versions: Synology DiskStation Manager DSM versions prior to 6.2-23739 Description: A command injection issue exists, allowing remote authenticated users to execute arbitrary commands via the username parameter. Recommendations: For versions prior to...

Synology DiskStation Manager (DSM) < 6.1.3-15152 - forget_passwd.cgi User Enumeration

Exploit for cgi platform in category web applications Exploit Title: Synology DiskStation Manager DSM 6.1.3-15152 - 'forgetpasswd.cgi' User Enumeration Date: 01/05/2018 Exploit Author: Steve Kaun Vendor Homepage: https://www.synology.com Version: Before 6.1.3-15152 CVE : CVE-2017-9554 Previously...