Use after free

UltraVNC is a free and open source remote pc access software. A vulnerability has been found in versions prior to 1.3.8.0 in which the DSM plugin module, which allows a local authenticated user to achieve local privilege escalation LPE on a vulnerable system. The vulnerability has been fixed to...

CVE-2022-24750 Low privilege user is able to exploit the service and gain SYSTEM privileges in UltraVNC server

UltraVNC is a free and open source remote pc access software. A vulnerability has been found in versions prior to 1.3.8.0 in which the DSM plugin module, which allows a local authenticated user to achieve local privilege escalation LPE on a vulnerable system. The vulnerability has been fixed to...

UltraVNC 安全漏洞

UltraVNC is an open source remote terminal control software for the Windows platform. versions of UltraVNC prior to 1.3.8.0 have a security vulnerability in the DSM plug-in that can be exploited by a locally authenticated attacker to achieve Local Elevation of Privilege LPE on vulnerable systems...

CVE-2021-43927

Improper neutralization of special elements used in an SQL command 'SQL Injection' vulnerability in Security Management functionality in Synology DiskStation Manager DSM before 7.0.1-42218-2 allows remote attackers to inject SQL commands via unspecified vectors...

CVE-2022-22679

Improper limitation of a pathname to a restricted directory 'Path Traversal' vulnerability in support service management in Synology DiskStation Manager DSM before 7.0.1-42218-2 allows remote authenticated users to write arbitrary files via unspecified vectors...

Sql injection

Improper neutralization of special elements used in an SQL command 'SQL Injection' vulnerability in Log Management functionality in Synology DiskStation Manager DSM before 7.0.1-42218-2 allows remote attackers to inject SQL commands via unspecified vectors...

Design/Logic Flaw

Improper neutralization of special elements in output used by a downstream component 'Injection' vulnerability in work flow management in Synology DiskStation Manager DSM before 7.0.1-42218-2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2022-22679

Synopsis: CVE-2022-22679 affects Synology DiskStation Manager (DSM). Vulnerability: Path traversal due to improper limitation of a pathname to a restricted directory, enabling remote authenticated users to write arbitrary files via unspecified vectors. Affected versions: DSM before 7.0.1-42218-2....

CVE-2021-43929

Synology DiskStation Manager (DSM) is affected by CVE-2021-43929 due to an "Injection" flaw: improper neutralization of special elements in output used by a downstream component, allowing remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. Affected versions ...

CVE-2021-43927

Summary: CVE-2021-43927 is a SQL Injection vulnerability in the Security Management feature of Synology DiskStation Manager (DSM) prior to 7.0.1-42218-2. The issue arises from improper neutralization of special characters in SQL statements, enabling remote, network-based attackers to inject comma...

CVE-2021-43925

Event: CVE-2021-43925 affects Synology DiskStation Manager (DSM) Log Management. Root cause: improper neutralization of special elements used in an SQL command, enabling SQL injection. Affected: DSM versions before 7.0.1-42218-2. Impact: remote attackers can inject SQL commands via unspecified ve...

Mageia: Security Advisory (MGASA-2013-0168)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2021-29084

Improper neutralization of special elements in output used by a downstream component 'Injection' vulnerability in Security Advisor report management component in Synology DiskStation Manager DSM before 6.2.3-25426-3 allows remote attackers to read arbitrary files via unspecified vectors...

CVE-2021-27649

Use after free vulnerability in file transfer protocol component in Synology DiskStation Manager DSM before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via unspecified vectors...

CVE-2021-29084

Synology DSM is affected by CVE-2021-29084: an Injection vulnerability in the Security Advisor report management component allows remote attackers to read arbitrary files on affected systems. This affects DSM versions prior to 6.2.3-25426-3. The common description across sources states improper n...

CVE-2021-29087

CVE-2021-29087 affects Synology DiskStation Manager (DSM) webapi component. A path traversal flaw in DSM versions before 6.2.3-25426-3 could allow remote attackers to write arbitrary files via unspecified vectors. Impact statements in linked sources indicate arbitrary file writes, with CVSS metri...

CVE-2021-27649

CVE-2021-27649 affects Synology DiskStation Manager (DSM) via a use-after-free in the DSM File Transfer Protocol component. The vulnerability allows remote code execution on DSM versions prior to 6.2.3-25426-3. Evidence from multiple sources (NVD, CNVD, Tenable OT/OSS plugin references, OpenVAS e...

CVE-2021-29086

The issue is CVE-2021-29086 affecting Synology DiskStation Manager (DSM) webapi prior to version 6.2.3-25426-3. An information disclosure vulnerability exists in the webapi component that allows remote attackers to obtain sensitive information via unspecified vectors. Affected product: DSM (Synol...

CVE-2021-33182

Improper limitation of a pathname to a restricted directory 'Path Traversal' vulnerability in PDF Viewer component in Synology DiskStation Manager DSM before 6.2.4-25553 allows remote authenticated users to read limited files via unspecified vectors...

CVE-2021-29088

Improper limitation of a pathname to a restricted directory 'Path Traversal' in cgi component in Synology DiskStation Manager DSM before 6.2.4-25553 allows local users to execute arbitrary code via unspecified vectors...