18939 matches found
CVE-2018-13290
Information exposure vulnerability in SYNO.Core.ACL in Synology Router Manager SRM before 1.1.7-6941-2 allows remote authenticated users to determine the existence of files or obtain sensitive information of files via the filepath parameter...
Cross site scripting
Cross-site scripting XSS vulnerability in SYNO.Core.PersonalNotification.Event in Synology DiskStation Manager DSM before 6.1.4-15217-3 allows remote authenticated users to inject arbitrary web script or HTML via the package parameter...
CVE-2018-13292
Information exposure vulnerability in /usr/syno/etc/mount.conf in Synology Router Manager SRM before 1.1.7-6941-2 allows remote authenticated users to obtain sensitive information via the world readable configuration...
CVE-2018-13287
Incorrect default permissions vulnerability in synouser.conf in Synology Router Manager SRM before 1.1.7-6941-1 allows remote authenticated users to obtain sensitive information via the world readable configuration...
CVE-2018-13291
Information exposure vulnerability in /usr/syno/etc/mount.conf in Synology DiskStation Manager DSM before 6.2.1-23824 allows remote authenticated users to obtain sensitive information via the world readable configuration...
CVE-2017-16774
Cross-site scripting XSS vulnerability in SYNO.Core.PersonalNotification.Event in Synology DiskStation Manager DSM before 6.1.4-15217-3 allows remote authenticated users to inject arbitrary web script or HTML via the package parameter...
CVE-2018-13293
Cross-site scripting XSS vulnerability in Control Panel SSO Settings in Synology DiskStation Manager DSM before 6.2.1-23824 allows remote authenticated users to inject arbitrary web script or HTML via the URL parameter...
Information disclosure
Information exposure vulnerability in SYNO.Personal.Application.Info in Synology Application Service before 1.5.4-0320 allows remote authenticated users to obtain sensitive system information via the version parameter...
CVE-2018-13299
Relative path traversal vulnerability in Attachment Uploader in Synology Calendar before 2.2.2-0532 allows remote authenticated users to upload arbitrary files via the filename parameter...
CVE-2018-13294
The CVE-2018-13294 vulnerability affects Synology Application Service’s SYNO.Personal.Profile component, prior to version 1.5.4-0320. It allows remote authenticated users to disclose sensitive system information via the uid parameter, indicating an information disclosure flaw likely tied to impro...
CVE-2018-13295
Information exposure vulnerability in SYNO.Personal.Application.Info in Synology Application Service before 1.5.4-0320 allows remote authenticated users to obtain sensitive system information via the version parameter...
CVE-2018-13293
Cross-site scripting XSS vulnerability in Control Panel SSO Settings in Synology DiskStation Manager DSM before 6.2.1-23824 allows remote authenticated users to inject arbitrary web script or HTML via the URL parameter...
CVE-2018-13285
Command injection vulnerability in ftpd in Synology Router Manager SRM before 1.1.7-6941-1 allows remote authenticated users to execute arbitrary OS commands via the 1 MKD or 2 RMD command...
CVE-2018-13287
Incorrect default permissions vulnerability in synouser.conf in Synology Router Manager SRM before 1.1.7-6941-1 allows remote authenticated users to obtain sensitive information via the world readable configuration...
CVE-2017-16774
Cross-site scripting XSS vulnerability in SYNO.Core.PersonalNotification.Event in Synology DiskStation Manager DSM before 6.1.4-15217-3 allows remote authenticated users to inject arbitrary web script or HTML via the package parameter...
PT-2019-8951 · Synology · Synology Diskstation Manager
Name of the Vulnerable Software and Affected Versions: Synology Diskstation Manager DSM versions prior to 6.2-23739-1 Description: The issue is related to incorrect default permissions in the synouser.conf file, allowing remote authenticated users to obtain sensitive information due to the...
PT-2019-8949 · Synology · Synology Diskstation Manager
Name of the Vulnerable Software and Affected Versions: Synology Diskstation Manager DSM versions prior to 6.2-23739-1 Description: A command injection issue exists, allowing remote authenticated users to execute arbitrary OS commands. This can be achieved via the MKD or RMD command...
Code injection
Grandstream GXV3611IRHD before 1.0.3.23 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the /goform/systemlog?cmd=set logserver field...
Code injection
Grandstream UCM6204 before 1.0.19.20 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the backupUCMConfig file-backup parameter to the /cgi? URI...
CVE-2019-10659
Grandstream GXV3370 before 1.0.1.41 and WP820 before 1.0.3.6 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in a /manager?action=getlogcat priority field...