Lucene search
K
Database
Vendors
Products
Timeline
Vulnerabilities
Perimeter Scanner
Scanning
Projects
Scanner
Agent Scanning
API Scanning
Manual Audit
Email
Webhook
Resources
Documents
Blog
Glossary
FAQ
Plugins
Pricing
Contacts
About Us
Partners
Branding Guideline
Settings
Sign in
SynologyDiskstation Manager*

29 matches found

CVE
CVE•added 2021/03/12 7:15 a.m.•175 views

CVE-2021-27647

Out-of-bounds Read vulnerability in iscsi_snapshot_comm_core in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via crafted web requests.

9.8CVSS9.7AI score0.01674EPSS
CVE
CVE•added 2017/12/04 7:29 p.m.•113 views

CVE-2017-15889

Command injection vulnerability in smart.cgi in Synology DiskStation Manager (DSM) before 5.2-5967-5 allows remote authenticated users to execute arbitrary commands via disk field.

8.8CVSS8.4AI score0.6238EPSS
Web
CVE
CVE•added 2021/03/12 7:15 a.m.•94 views

CVE-2021-26569

Race Condition within a Thread vulnerability in iscsi_snapshot_comm_core in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via crafted web requests.

9.8CVSS8.8AI score0.01754EPSS
CVE
CVE•added 2021/03/12 7:15 a.m.•93 views

CVE-2021-27646

Use After Free vulnerability in iscsi_snapshot_comm_core in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via crafted web requests.

9.8CVSS9.8AI score0.02203EPSS
CVE
CVE•added 2021/02/26 10:15 p.m.•92 views

CVE-2021-26562

Out-of-bounds write vulnerability in synoagentregisterd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-middle attackers to execute arbitrary code via syno_finder_site HTTP header.

9CVSS8.7AI score0.01388EPSS
CVE
CVE•added 2022/10/25 5:15 p.m.•92 views

CVE-2022-27622

Server-Side Request Forgery (SSRF) vulnerability in Package Center functionality in Synology DiskStation Manager (DSM) before 7.1-42661 allows remote authenticated users to access intranet resources via unspecified vectors.

4.3CVSS5.2AI score0.00201EPSS
CVE
CVE•added 2021/02/26 10:15 p.m.•88 views

CVE-2021-26566

Insertion of sensitive information into sent data vulnerability in synorelayd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-middle attackers to execute arbitrary commands via inbound QuickConnect traffic.

9CVSS9.2AI score0.0042EPSS
CVE
CVE•added 2021/02/26 10:15 p.m.•87 views

CVE-2021-26563

Incorrect authorization vulnerability in synoagentregisterd in Synology DiskStation Manager (DSM) before 6.2.4-25553 allows local users to execute arbitrary code via unspecified vectors.

8.2CVSS7AI score0.00117EPSS
CVE
CVE•added 2021/02/26 10:15 p.m.•82 views

CVE-2021-26561

Stack-based buffer overflow vulnerability in synoagentregisterd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-middle attackers to execute arbitrary code via syno_finder_site HTTP header.

9CVSS8.8AI score0.02341EPSS
CVE
CVE•added 2021/02/26 10:15 p.m.•81 views

CVE-2021-26567

Stack-based buffer overflow vulnerability in frontend/main.c in faad2 before 2.2.7.1 allow local attackers to execute arbitrary code via filename and pathname options.

7.8CVSS8.6AI score0.01128EPSS
CVE
CVE•added 2021/02/26 10:15 p.m.•80 views

CVE-2021-26564

Cleartext transmission of sensitive information vulnerability in synorelayd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-middle attackers to spoof servers via an HTTP session.

8.7CVSS8.6AI score0.00164EPSS
CVE
CVE•added 2022/10/20 6:15 a.m.•79 views

CVE-2022-27626

A vulnerability regarding concurrent execution using shared resource with improper synchronization ('Race Condition') is found in the session processing functionality of Out-of-Band (OOB) Management. This allows remote attackers to execute arbitrary commands via unspecified vectors. The following m...

10CVSS9.2AI score0.02379EPSS
CVE
CVE•added 2021/04/01 6:15 a.m.•78 views

CVE-2021-29083

Improper neutralization of special elements used in an OS command in SYNO.Core.Network.PPPoE in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote authenticated users to execute arbitrary code via realname parameter.

9CVSS8.5AI score0.02043EPSS
CVE
CVE•added 2018/06/08 1:29 p.m.•74 views

CVE-2018-8916

Unverified password change vulnerability in Change Password in Synology DiskStation Manager (DSM) before 6.2-23739 allows remote authenticated users to reset password without verification.

8.8CVSS8.4AI score0.00162EPSS
CVE
CVE•added 2021/02/26 10:15 p.m.•68 views

CVE-2021-26560

Cleartext transmission of sensitive information vulnerability in synoagentregisterd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-middle attackers to spoof servers via an HTTP session.

9CVSS7.7AI score0.00164EPSS
CVE
CVE•added 2021/02/26 10:15 p.m.•68 views

CVE-2021-26565

Cleartext transmission of sensitive information vulnerability in synorelayd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-middle attackers to obtain sensitive information via an HTTP session.

8.3CVSS6.9AI score0.00182EPSS
CVE
CVE•added 2022/10/20 6:15 a.m.•64 views

CVE-2022-27624

A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the packet decryption functionality of Out-of-Band (OOB) Management. This allows remote attackers to execute arbitrary commands via unspecified vectors. The following models with Synology D...

10CVSS9.7AI score0.01455EPSS
CVE
CVE•added 2022/07/28 7:15 a.m.•63 views

CVE-2022-22684

Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in task management component in Synology DiskStation Manager (DSM) before 6.2.4-25553 allows remote authenticated users to execute arbitrary commands via unspecified vectors.

8.8CVSS8.7AI score0.01811EPSS
CVE
CVE•added 2018/06/08 1:29 p.m.•60 views

CVE-2017-12075

Command injection vulnerability in EZ-Internet in Synology DiskStation Manager (DSM) before 6.2-23739 allows remote authenticated users to execute arbitrary command via the username parameter.

7.2CVSS7.6AI score0.05654EPSS
CVE
CVE•added 2022/10/25 5:15 p.m.•57 views

CVE-2022-27623

Missing authentication for critical function vulnerability in iSCSI management functionality in Synology DiskStation Manager (DSM) before 7.1-42661 allows remote attackers to read or write arbitrary files via unspecified vectors.

9.1CVSS9.2AI score0.00549EPSS
CVE
CVE•added 2022/10/20 6:15 a.m.•57 views

CVE-2022-3576

A vulnerability regarding out-of-bounds read is found in the session processing functionality of Out-of-Band (OOB) Management. This allows remote attackers to obtain sensitive information via unspecified vectors. The following models with Synology DiskStation Manager (DSM) versions before 7.1.1-429...

7.5CVSS8.2AI score0.00319EPSS
CVE
CVE•added 2021/06/01 2:15 p.m.•50 views

CVE-2021-29088

Improper limitation of a pathname to a restricted directory ('Path Traversal') in cgi component in Synology DiskStation Manager (DSM) before 6.2.4-25553 allows local users to execute arbitrary code via unspecified vectors.

7.8CVSS8AI score0.00087EPSS
CVE
CVE•added 2018/12/24 3:29 p.m.•47 views

CVE-2018-8917

Cross-site scripting (XSS) vulnerability in info.cgi in Synology DiskStation Manager (DSM) before 6.1.6-15266 allows remote attackers to inject arbitrary web script or HTML via the host parameter.

6.5CVSS5.4AI score0.00187EPSS
CVE
CVE•added 2018/12/24 3:29 p.m.•47 views

CVE-2018-8919

Information exposure vulnerability in SYNO.Core.Desktop.SessionData in Synology DiskStation Manager (DSM) before 6.1.6-15266 allows remote attackers to steal credentials via unspecified vectors.

9.8CVSS9.1AI score0.00262EPSS
CVE
CVE•added 2022/10/20 6:15 a.m.•46 views

CVE-2022-27625

A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the message processing functionality of Out-of-Band (OOB) Management. This allows remote attackers to execute arbitrary commands via unspecified vectors. The following models with Synology ...

10CVSS9.7AI score0.01455EPSS
CVE
CVE•added 2018/12/24 3:29 p.m.•45 views

CVE-2018-8920

Improper neutralization of escape vulnerability in Log Exporter in Synology DiskStation Manager (DSM) before 6.1.6-15266 allows remote attackers to inject arbitrary content to have an unspecified impact by exporting an archive in CSV format.

7.2CVSS7AI score0.004EPSS
CVE
CVE•added 2021/06/01 2:15 p.m.•44 views

CVE-2021-33182

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in PDF Viewer component in Synology DiskStation Manager (DSM) before 6.2.4-25553 allows remote authenticated users to read limited files via unspecified vectors.

5CVSS5AI score0.00116EPSS
CVE
CVE•added 2024/01/24 10:15 a.m.•39 views

CVE-2024-0854

URL redirection to untrusted site ('Open Redirect') vulnerability in file access component in Synology DiskStation Manager (DSM) before 6.2.4-25556-8, 7.0.1-42218-7, 7.1.1-42962-7 and 7.2.1-69057-2 allows remote authenticated users to conduct phishing attacks via unspecified vectors.

5.4CVSS5.1AI score0.00178EPSS
CVE
CVE•added 2018/07/30 2:29 p.m.•36 views

CVE-2018-13280

Use of insufficiently random values vulnerability in SYNO.Encryption.GenRandomKey in Synology DiskStation Manager (DSM) before 6.2-23739 allows man-in-the-middle attackers to compromise non-HTTPS sessions via unspecified vectors.

7.4CVSS5.6AI score0.00119EPSS