CVE-2018-8920: Improper Encoding or Escaping of Output

Improper neutralization of escape vulnerability in Log Exporter in Synology DiskStation Manager DSM before 6.1.6-15266 allows remote attackers to inject arbitrary content to have an unspecified impact by exporting an archive in CSV format...

CVE-2018-8919: Exposure of Sensitive Information to an Unauthorized Actor

Information exposure vulnerability in SYNO.Core.Desktop.SessionData in Synology DiskStation Manager DSM before 6.1.6-15266 allows remote attackers to steal credentials via unspecified vectors...

CVE-2018-13281

The CVE-2018-13281 entry affects Synology DiskStation Manager (DSM) prior to 6.2-23739-2, specifically the SYNO.Core.ACL component. The vulnerability allows remote authenticated users to determine the existence of files and obtain their metadata via the file_path parameter, constituting an inform...

CVE-2018-13281: Exposure of Sensitive Information to an Unauthorized Actor

Information exposure vulnerability in SYNO.Core.ACL in Synology DiskStation Manager DSM before 6.2-23739-2 allows remote authenticated users to determine the existence and obtain the metadata of arbitrary files via the filepath parameter...

Design/Logic Flaw

A remote unauthorized access vulnerability was identified in HPE UIoT versions 1.5, 1.4.0, 1.4.1, 1.4.2, 1.2.4.2. Specifically, there is a malfunction identified in some section of the DSM portal and some DSM APIs. The impact of the malfunction is that the info can be changed by other users...

CVE-2018-7111

A remote unauthorized access vulnerability was identified in HPE UIoT versions 1.5, 1.4.0, 1.4.1, 1.4.2, 1.2.4.2. Specifically, there is a malfunction identified in some section of the DSM portal and some DSM APIs. The impact of the malfunction is that the info can be changed by other users...

CVE-2018-7111

A remote unauthorized access vulnerability was identified in HPE UIoT versions 1.5, 1.4.0, 1.4.1, 1.4.2, 1.2.4.2. Specifically, there is a malfunction identified in some section of the DSM portal and some DSM APIs. The impact of the malfunction is that the info can be changed by other users...

CVE-2018-7111

Technical details about CVE-2018-7111 are not publicly provided in the connected documents. Monitor for updates from vendors and security advisories; available sources reiterate a remote unauthorized access issue in HPE UIoT DSM portals/APIs.

PT-2018-17913

Name of the Vulnerable Software and Affected Versions HPE UIoT versions 1.2.4.2, 1.4.0, 1.4.1, 1.4.2, 1.5 Description A remote unauthorized access issue was identified, allowing information to be changed by other users due to a malfunction in a section of the DSM portal and some DSM APIs...

CVE-2018-7111: Undefined Security Weakness

A remote unauthorized access vulnerability was identified in HPE UIoT versions 1.5, 1.4.0, 1.4.1, 1.4.2, 1.2.4.2. Specifically, there is a malfunction identified in some section of the DSM portal and some DSM APIs. The impact of the malfunction is that the info can be changed by other users...

CVE-2018-13280

Use of insufficiently random values vulnerability in SYNO.Encryption.GenRandomKey in Synology DiskStation Manager DSM before 6.2-23739 allows man-in-the-middle attackers to compromise non-HTTPS sessions via unspecified vectors...

CVE-2018-13280

CVE-2018-13280 affects Synology DiskStation Manager (DSM) prior to version 6.2-23739. The root cause is the use of insufficiently random values in SYNO.Encryption.GenRandomKey, which can allow remote attackers to perform a man-in-the-middle attack on non-HTTPS sessions. Practical impact stated is...

CVE-2018-13280: Use of Insufficiently Random Values

Use of insufficiently random values vulnerability in SYNO.Encryption.GenRandomKey in Synology DiskStation Manager DSM before 6.2-23739 allows man-in-the-middle attackers to compromise non-HTTPS sessions via unspecified vectors...

Security update for libopenmpt (moderate)

This update for libopenmpt to version 0.3.9 fixes the following issues: These security issues were fixed: - CVE-2018-11710: Prevent write near address 0 in out-of-memory situations when reading AMS files bsc1095644 - CVE-2018-10017: Preven out-of-bounds memory read with IT/ITP/MO3 files containin...

openSUSE Security Update : libopenmpt (openSUSE-2018-742)

This update for libopenmpt to version 0.3.9 fixes the following issues : These security issues were fixed : - CVE-2018-11710: Prevent write near address 0 in out-of-memory situations when reading AMS files bsc1095644 - CVE-2018-10017: Preven out-of-bounds memory read with IT/ITP/MO3 files...

CVE-2018-8916

Unverified password change vulnerability in Change Password in Synology DiskStation Manager DSM before 6.2-23739 allows remote authenticated users to reset password without verification...

CVE-2018-8916

The CVE-2018-8916 issue affects Synology DiskStation Manager (DSM) prior to 6.2-23739. The vulnerability lies in the Change Password function, where remote authenticated users can reset a password without completing verification, due to an unverified password change flow. Impact is described as a...

CVE-2017-12075

The CVE-2017-12075 issue affects Synology DiskStation Manager (DSM) prior to 6.2-23739, specifically in EZ-Internet. The vulnerability permits a remote authenticated user to inject and execute arbitrary commands through the username parameter, due to improper handling of input. Affected component...

CVE-2017-12075: Improper Neutralization of Special Elements used in a Command

Command injection vulnerability in EZ-Internet in Synology DiskStation Manager DSM before 6.2-23739 allows remote authenticated users to execute arbitrary command via the username parameter...

CVE-2018-8916: Unverified Password Change

Unverified password change vulnerability in Change Password in Synology DiskStation Manager DSM before 6.2-23739 allows remote authenticated users to reset password without verification...