PT-2015-5904

Name of the Vulnerable Software and Affected Versions Synology DiskStation Manager DSM versions prior to 3.1 Description The issue allows remote attackers to cause a denial of service or obtain potentially sensitive information via port-5353 UDP packets to the Avahi component. This is due to the...

CVE-2012-1556

Cross-site scripting XSS vulnerability in Synology Photo Station 5 for DiskStation Manager DSM 3.2-1955 allows remote attackers to inject arbitrary web script or HTML via the name parameter to photo/photoone.php...

CVE-2012-1556

Cross-site scripting XSS vulnerability in Synology Photo Station 5 for DiskStation Manager DSM 3.2-1955 allows remote attackers to inject arbitrary web script or HTML via the name parameter to photo/photoone.php...

CVE-2012-1556

CVE-2012-1556 is a reflected XSS vulnerability in Synology Photo Station 5 on DSM 3.2-1955, where input in the name parameter to photo/photo_one.php is not properly sanitized. The root cause is improper verification of the name input, enabling remote attackers to inject arbitrary scripts. Impacts...

Synology DiskStation Manager - SLICEUPLOAD Remote Command Execution

No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient...

Synology DiskStation Manager SLICEUPLOAD Code Execution (CVE-2013-6955)

An arbitrary file upload vulnerability exists in Synology DiskStation Manager. The vulnerability exists in webman/imageSelector.cgi. A remote unauthenticated attacker can append data to files by sending specially crafted HTTP requests to the server and execute arbitrary code through that...

Synology DiskStation Manager跨站脚本漏洞

Bugtraq ID:66504 Synology DiskStation Manager是第一个提供网络多任务处理用户接口的NAS操作系统。 远程攻击者可以利用漏洞构建恶意URI，诱使用户解析，可获得敏感Cookie，劫持会话或在客户端上进行恶意操作。 0 Synology DiskStation Manager 5.x Synology DiskStation Manager 5.0-4458 Update 1版本已修复该漏洞，建议用户下载使用： http://www.synology.com...

CVE-2013-6955 Synology DSM remote code execution

Products Affected By CVE-2013-6955 Diskstation Manager 4.0 4.2 4.3 4.3-3810 Vendor: Synology Status: Patched webman/imageSelector.cgi in Synology DiskStation Manager DSM 4.0 before 4.0-2259, 4.2 before 4.2-3243, and 4.3 before 4.3-3810 Update 1 allows remote attackers to append data to arbitrary...

Synology DiskStation Manager code execution

Code execution via web interface...

Synology DiskStation Manager <= 4.3-3827 'value' Parameter SQL Injection Vulnerability

Binary data 8160.prm...

PT-2014-4593 · Synology +1 · Synology Diskstation Manager +1

Name of the Vulnerable Software and Affected Versions: Synology DiskStation Manager DSM version 4.3-3810 update 1 Description: The issue concerns a hardcoded root password in the OpenVPN module, specifically set to synopass, which can be exploited by remote attackers to gain access via a VPN...

Synology DiskStation Manager VPN module hard-coded password vulnerability

Overview Synology DiskStation Manager VPN module contains a hard-coded password which cannot be changed. Description Synology DiskStation Manager 4.3-3810 update 1 and possibly earlier versions contain a VPN server module which contains a hard-coded password which cannot be changed. According to...

Synology DiskStation Manager uistrings.cgi lang Parameter Directory Traversal

The Synology DiskStation Manager installed on the remote host is affected by a directory traversal vulnerability. By sending a large, padded file path to the 'lang' parameter of the 'uistrings.cgi' script, an overflow will occur within the snprintf function used to prevent such attacks. A remote,...

Synology DiskStation Manager (DSM) Detection

Binary data synologydiskstationmanagerdetect.nbin...

Synology DiskStation Manager < 4.3-3810 Update 3 Multiple FileBrowser Component Directory Traversal Vulnerabilities

According to its version number, the Synology DiskStation Manager installed on the remote host is 4.3-x equal or prior to 4.3-3810. It is, therefore, affected by multiple directory traversal vulnerabilities in the FileBrowser component. The issue exists due to improper validation of values...

Synology DiskStation Manager < 4.3-3776 Update 3 info.cgi Multiple Parameters XSS

According to its version number, the Synology DiskStation Manager installed on the remote host is a version prior to 4.3-3776 Update 3. It is, therefore, potentially affected by a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input to the 'host', 'target'...

Synology DiskStation Manager 4.0-x < 4.0-2259 / 4.1-x / 4.2-x < 4.2-3243 SLICEUPLOAD Function Remote Code Execution

According to its version number, the Synology DiskStation Manager installed on the remote host is affected by a remote code execution vulnerability. The issue exists due to improper validation of values submitted in the 'X-TMP-FILE' header field along with the 'X-TYPE-NAME: SLICEUPLOAD' header...

Synology DiskStation Manager 4.3-x < 4.3-3810 Update 1 Multiple Vulnerabilities

According to its version number, the Synology DiskStation Manager installed on the remote host is 4.3-x equal or prior to 4.3-3810. It is, therefore, affected by the following vulnerabilities : - A remote code execution vulnerability exists in the File Station component due to improper validation...

Design/Logic Flaw

webman/imageSelector.cgi in Synology DiskStation Manager DSM 4.0 before 4.0-2259, 4.2 before 4.2-3243, and 4.3 before 4.3-3810 Update 1 allows remote attackers to append data to arbitrary files, and consequently execute arbitrary code, via a pathname in the SLICEUPLOAD X-TMP-FILE HTTP header...

CVE-2013-6955

Summary of CVE-2013-6955 – Synology DiskStation Manager Affected product: Synology DiskStation Manager (DSM) with webman/imageSelector.cgi as part of the File Station component. Vulnerability: Remote code execution via SLICEUPLOAD. An attacker can append data to an arbitrary file by sending a spe...