CVE-2017-12075

The CVE-2017-12075 issue affects Synology DiskStation Manager (DSM) prior to 6.2-23739, specifically in EZ-Internet. The vulnerability permits a remote authenticated user to inject and execute arbitrary commands through the username parameter, due to improper handling of input. Affected component...

Synology DiskStation Manager (DSM) < 6.1.3-15152 - forget_passwd.cgi User Enumeration

Exploit for cgi platform in category web applications Exploit Title: Synology DiskStation Manager DSM 6.1.3-15152 - 'forgetpasswd.cgi' User Enumeration Date: 01/05/2018 Exploit Author: Steve Kaun Vendor Homepage: https://www.synology.com Version: Before 6.1.3-15152 CVE : CVE-2017-9554 Previously...

CVE-2017-16766

CVE-2017-16766 concerns an improper access control vulnerability in the Synology DSM component synodsmnotify . The issue affects DSM versions prior to 6.1.4-15217 and prior to 6.0.3-8754-6, where local users can inject arbitrary web script or HTML via the -fn option. The root cause is inadequate ...

Synology DiskStation Manager Directory Traversal Vulnerability

Synology DiskStation Manager DSM is an operating system for use on Network Storage Servers NAS from Synology. The operating system manages information such as data, files, photos, music and more. A directory traversal vulnerability exists in SYNO.FileStation.Extract in Synology DSM versions 6.0.x...

CVE-2017-14374

Dell Storage Manager before 16.3.20 (2016 R3.20) stores a hard-coded password for the SMI-S service. A remote attacker who knows the credential could disable the SMI-S service via HTTP requests, impacting storage management and monitoring through the SMI-S interface. Affected platform is Windows ...

CVE-2017-15889

Command injection vulnerability in smart.cgi in Synology DiskStation Manager DSM before 5.2-5967-5 allows remote authenticated users to execute arbitrary commands via disk field...

CVE-2017-15889

Command injection vulnerability in smart.cgi in Synology DiskStation Manager DSM before 5.2-5967-5 allows remote authenticated users to execute arbitrary commands via disk field...

CVE-2017-15889

CVE-2017-15889 is a command injection vulnerability in Synology DiskStation Manager (DSM) smart.cgi that affects DSM versions prior to 5.2-5967-5. An authenticated remote attacker can inject commands via the disk field, potentially executing arbitrary commands with root privileges. Public details...

Synology StorageManager smart.cgi Remote Command Execution

Vulnerability Summary The following advisory describes a remote command execution vulnerability found in Synology StorageManager. Storage Manager is “a management application that helps you organize and monitor the storage capacity on your Synology NAS. Depending on the model and number of...

Synology StorageManager 5.2 - Root Remote Command Execution

Synology StorageManager 5.2 - Root Remote Command Execution ''' SSD Advisory – Synology StorageManager smart.cgi Remote Command Execution Full report: https://blogs.securiteam.com/index.php/archives/3540 Twitter: @SecuriTeamSSD Weibo: SecuriTeamSSD Vulnerability Summary The following advisory...

CVE-2017-12076

CVE-2017-12076 affects Synology DiskStation Manager (DSM) prior to 6.1.1-15088, specifically SYNO.Core.PortForwarding.Rules. The vulnerability allows a remote authenticated attacker to cause uncontrolled resource consumption by exhausting memory, resulting in a denial of service. Affects DSM depl...

Information disclosure

An information exposure vulnerability in forgetpasswd.cgi in Synology DiskStation Manager DSM before 6.1.3-15152 allows remote attackers to enumerate valid usernames via unspecified vectors...

CVE-2017-9554

Synology DiskStation Manager (DSM) is affected by CVE-2017-9554 via the forget_passwd.cgi endpoint. The vulnerability is an information exposure that allows remote attackers to enumerate valid usernames. Affected firmware versions are DSM prior to 6.1.3-15152. The root cause is information leakag...

CVE-2017-9554

An information exposure vulnerability in forgetpasswd.cgi in Synology DiskStation Manager DSM before 6.1.3-15152 allows remote attackers to enumerate valid usernames via unspecified vectors. Recent assessments: h00die at May 21, 2020 2:01pm UTC reported: Vulnerability is trivial to exploit. Send ...

CVE-2016-10330

Directory traversal vulnerability in synophotodsmuser, a SUID program, as used in Synology Photo Station before 6.5.3-3226 allows local users to write to arbitrary files via unspecified vectors...

CVE-2016-2406

The permission control module in Huawei Document Security Management aka DSM before V100R002C05SPC670 allows remote authenticated users to obtain sensitive information from encrypted documents by leveraging incorrect control of permissions on the PrintScreen button...

CVE-2016-2406

The permission control module in Huawei Document Security Management aka DSM before V100R002C05SPC670 allows remote authenticated users to obtain sensitive information from encrypted documents by leveraging incorrect control of permissions on the PrintScreen button...

CVE-2016-2406

The CVE-2016-2406 issue affects Huawei Document Security Management (DSM) prior to V100R002C05SPC670. The vulnerability is in the permission control module, where incorrect control of permissions on the PrintScreen button allows remote authenticated users to obtain sensitive information from encr...

Synology DiskStation Manager (DSM) Web Administration Interface Default Credentials

The web administration interface for the Synology DiskStation Manager DSM application running on the remote host uses a default blank password for the administrator account. A remote attacker can exploit this to gain administrative access to the web interface. C Tenable Network Security, Inc...

Synology NAS DSM 5.2 远程代码执行漏洞

Getting started I recently bought a Synology DS416 NAS and noticed during the set-up process you are first required to download the device firmware, which is then flashed to the device via the setup web interface. Interested in my new devices security, I decided to take a look at the firmware whi...