CVE-2018-8921

CVE-2018-8921 describes a cross-site scripting (XSS) vulnerability in Synology Drive’s File Sharing Notify Toast. Affected component: File Sharing Notify Toast within Synology Drive. The root cause is improper handling/sanitization of the file name, allowing remote authenticated users to inject a...

CVE-2024-50630

Synology Drive Server’s webapi component has a missing authentication issue that allows remote attackers to obtain administrator credentials. Affected versions are before 3.0.4-12699, 3.2.1-23280, 3.5.0-26085 and 3.5.1-26102. The vulnerability is defined as a missing-authentication for a critical...

CVE-2018-13297

The vulnerability CVE-2018-13297 affects Synology Drive’s SYNO.SynologyDrive.Files component. Versions prior to 1.1.2-10562 allow remote attackers to obtain sensitive system information via the dsm_path parameter, enabling an information-disclosure impact (partial confidentiality) without requiri...

CVE-2024-50631

CVE-2024-50631 affects Synology Drive Server; the system syncing daemon is vulnerable to SQL injection due to improper neutralization of special elements in SQL commands. Versions affected include before 3.0.4-12699, 3.2.1-23280, 3.5.0-26085 and 3.5.1-26102. The vulnerability can allow remote att...

CVE-2018-8922

CVE-2018-8922 affects Synology Drive prior to 1.0.2-10275. It is an improper access control vulnerability that lets remote authenticated users access non-shared files or folders via unspecified vectors. Multiple sources (NVD, CNVD, CVE list) corroborate this for Synology Drive versions before 1.0...

CVE-2018-8910

CVE-2018-8910 is a cross-site scripting (XSS) vulnerability in Synology Drive’s Attachment Preview prior to 1.0.1-10253. An authenticated remote user can inject arbitrary web script or HTML via a malicious attachment. The publicly documented details indicate network access with low attack complex...