Lucene search
K
Database
Vendors
Products
Timeline
Vulnerabilities
Perimeter Scanner
Scanning
Projects
Scanner
Agent Scanning
API Scanning
Manual Audit
Email
Webhook
Resources
Documents
Blog
Glossary
FAQ
Plugins
Pricing
Contacts
About Us
Partners
Branding Guideline
Settings
Sign in
SynologyDiskstation Manager*

18 matches found

CVE
CVE•added 2022/02/21 3:15 p.m.•957 views

CVE-2021-44142

The Samba vfs_fruit module uses extended file attributes (EA, xattr) to provide "...enhanced compatibility with Apple SMB clients and interoperability with a Netatalk 3 AFP fileserver." Samba versions prior to 4.13.17, 4.14.12 and 4.15.5 with vfs_fruit configured allow out-of-bounds heap read and w...

9CVSS8.9AI score0.28831EPSS
CVE
CVE•added 2022/02/07 2:15 a.m.•110 views

CVE-2022-22680

Exposure of sensitive information to an unauthorized actor vulnerability in Web Server in Synology DiskStation Manager (DSM) before 7.0.1-42218-2 allows remote attackers to obtain sensitive information via unspecified vectors.

7.5CVSS7.2AI score0.0028EPSS
CVE
CVE•added 2022/10/25 5:15 p.m.•91 views

CVE-2022-27622

Server-Side Request Forgery (SSRF) vulnerability in Package Center functionality in Synology DiskStation Manager (DSM) before 7.1-42661 allows remote authenticated users to access intranet resources via unspecified vectors.

4.3CVSS5.2AI score0.00234EPSS
CVE
CVE•added 2022/03/25 7:15 a.m.•85 views

CVE-2022-22687

Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in Authentication functionality in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via unspecified vectors.

9.8CVSS9.7AI score0.07586EPSS
CVE
CVE•added 2022/07/27 8:15 a.m.•85 views

CVE-2022-27610

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology DiskStation Manager (DSM) before 6.2.3-25423 allows remote authenticated users to delete arbitrary files via unspecified vectors.

8.1CVSS7.5AI score0.00615EPSS
CVE
CVE•added 2022/10/20 6:15 a.m.•76 views

CVE-2022-27626

A vulnerability regarding concurrent execution using shared resource with improper synchronization ('Race Condition') is found in the session processing functionality of Out-of-Band (OOB) Management. This allows remote attackers to execute arbitrary commands via unspecified vectors. The following m...

10CVSS9.2AI score0.0247EPSS
CVE
CVE•added 2022/03/25 7:15 a.m.•72 views

CVE-2022-22688

Improper neutralization of special elements used in a command ('Command Injection') vulnerability in File service functionality in Synology DiskStation Manager (DSM) before 6.2.4-25556-2 allows remote authenticated users to execute arbitrary commands via unspecified vectors.

8.8CVSS8.7AI score0.02397EPSS
CVE
CVE•added 2022/10/20 6:15 a.m.•63 views

CVE-2022-27624

A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the packet decryption functionality of Out-of-Band (OOB) Management. This allows remote attackers to execute arbitrary commands via unspecified vectors. The following models with Synology D...

10CVSS9.7AI score0.01511EPSS
CVE
CVE•added 2022/07/28 7:15 a.m.•62 views

CVE-2022-22684

Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in task management component in Synology DiskStation Manager (DSM) before 6.2.4-25553 allows remote authenticated users to execute arbitrary commands via unspecified vectors.

8.8CVSS8.7AI score0.00518EPSS
CVE
CVE•added 2022/02/07 3:15 a.m.•58 views

CVE-2022-22679

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in support service management in Synology DiskStation Manager (DSM) before 7.0.1-42218-2 allows remote authenticated users to write arbitrary files via unspecified vectors.

6.5CVSS4.9AI score0.00338EPSS
CVE
CVE•added 2022/10/25 5:15 p.m.•56 views

CVE-2022-27623

Missing authentication for critical function vulnerability in iSCSI management functionality in Synology DiskStation Manager (DSM) before 7.1-42661 allows remote attackers to read or write arbitrary files via unspecified vectors.

9.1CVSS9.2AI score0.0064EPSS
CVE
CVE•added 2022/10/20 6:15 a.m.•56 views

CVE-2022-3576

A vulnerability regarding out-of-bounds read is found in the session processing functionality of Out-of-Band (OOB) Management. This allows remote attackers to obtain sensitive information via unspecified vectors. The following models with Synology DiskStation Manager (DSM) versions before 7.1.1-429...

7.5CVSS8.2AI score0.00443EPSS
CVE
CVE•added 2022/02/07 3:15 a.m.•55 views

CVE-2021-43925

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Log Management functionality in Synology DiskStation Manager (DSM) before 7.0.1-42218-2 allows remote attackers to inject SQL commands via unspecified vectors.

9.8CVSS9.6AI score0.00594EPSS
CVE
CVE•added 2022/08/03 2:15 a.m.•55 views

CVE-2022-27616

Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in webapi component in Synology DiskStation Manager (DSM) before 7.0.1-42218-3 allows remote authenticated users to execute arbitrary commands via unspecified vectors.

7.2CVSS7.2AI score0.00673EPSS
CVE
CVE•added 2022/02/07 3:15 a.m.•48 views

CVE-2021-43926

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Log Management functionality in Synology DiskStation Manager (DSM) before 7.0.1-42218-2 allows remote attackers to inject SQL commands via unspecified vectors.

9.8CVSS9.6AI score0.00594EPSS
CVE
CVE•added 2022/02/07 3:15 a.m.•46 views

CVE-2021-43927

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Security Management functionality in Synology DiskStation Manager (DSM) before 7.0.1-42218-2 allows remote attackers to inject SQL commands via unspecified vectors.

9.8CVSS9.6AI score0.00594EPSS
CVE
CVE•added 2022/10/20 6:15 a.m.•45 views

CVE-2022-27625

A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the message processing functionality of Out-of-Band (OOB) Management. This allows remote attackers to execute arbitrary commands via unspecified vectors. The following models with Synology ...

10CVSS9.7AI score0.01511EPSS
CVE
CVE•added 2022/02/07 3:15 a.m.•37 views

CVE-2021-43929

Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in work flow management in Synology DiskStation Manager (DSM) before 7.0.1-42218-2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

6.5CVSS4.5AI score0.00196EPSS