Synology

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2023-41739 1Synology 1Router Manager Nov 21, 2024 Aug 31, 2023 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Uncontrolled resource consumption vulnerability in File Functionality in Synology Router Manager (SRM) before 1.3.1-9346-6 allows remote authenticated users to conduct denial-of-service attacks via unspecified vectors.
CVE-2023-41738 1Synology 1Router Manager Nov 21, 2024 Aug 31, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in Directory Domain Functionality in Synology Router Manager (SRM) before 1.3.1-9346-6 allows remote authenticated...Show more Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in Directory Domain Functionality in Synology Router Manager (SRM) before 1.3.1-9346-6 allows remote authenticated users to execute arbitrary commands via unspecified vectors.Show less
CVE-2023-2729 1Synology 3Diskstation Manager Diskstation Manager Unified ControllerRouter Manager Jan 14, 2025 Jun 13, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 Use of insufficiently random values vulnerability in User Management Functionality in Synology DiskStation Manager (DSM) before 7.2-64561 allows remote attackers to obtain user credential via unspecified vectors.
CVE-2023-0142 1Synology 3Diskstation Manager Diskstation Manager Unified ControllerRouter Manager Jan 14, 2025 Jun 13, 2023 N/A· v4 8.1 HIGH· v3 N/A· v2 Uncontrolled search path element vulnerability in Backup Management functionality in Synology DiskStation Manager (DSM) before 6.2.4-25556-8, 7.0.1-42218-7 and 7.1-42661 allows remote authenticated users with administrat...Show more Uncontrolled search path element vulnerability in Backup Management functionality in Synology DiskStation Manager (DSM) before 6.2.4-25556-8, 7.0.1-42218-7 and 7.1-42661 allows remote authenticated users with administrator privileges to read or write arbitrary files via unspecified vectors.Show less
CVE-2023-32956 1Synology 1Router Manager Nov 21, 2024 May 16, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in CGI component in Synology Router Manager (SRM) before 1.2.5-8227-6 and 1.3.1-9346-3 allows remote attackers to e...Show more Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in CGI component in Synology Router Manager (SRM) before 1.2.5-8227-6 and 1.3.1-9346-3 allows remote attackers to execute arbitrary code via unspecified vectors.Show less
CVE-2023-32955 1Synology 1Router Manager Nov 21, 2024 May 16, 2023 N/A· v4 8.1 HIGH· v3 N/A· v2 Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in DHCP Client Functionality in Synology Router Manager (SRM) before 1.2.5-8227-6 and 1.3.1-9346-3 allows man-in-th...Show more Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in DHCP Client Functionality in Synology Router Manager (SRM) before 1.2.5-8227-6 and 1.3.1-9346-3 allows man-in-the-middle attackers to execute arbitrary commands via unspecified vectors.Show less
CVE-2023-0077 1Synology 1Router Manager Nov 21, 2024 Jan 5, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Integer overflow or wraparound vulnerability in CGI component in Synology Router Manager (SRM) before 1.2.5-8227-6 and 1.3.1-9346-3 allows remote attackers to overflow buffers via unspecified vectors.
CVE-2022-43932 1Synology 1Router Manager Nov 21, 2024 Jan 5, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in CGI component in Synology Router Manager (SRM) before 1.2.5-8227-6 and 1.3.1-9346-3 allows remote attack...Show more Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in CGI component in Synology Router Manager (SRM) before 1.2.5-8227-6 and 1.3.1-9346-3 allows remote attackers to read arbitrary files via unspecified vectors.Show less
CVE-2022-43931 1Synology 1Vpn Plus Server Nov 21, 2024 Jan 3, 2023 N/A· v4 10.0 CRITICAL· v3 N/A· v2 Out-of-bounds write vulnerability in Remote Desktop Functionality in Synology VPN Plus Server before 1.4.3-0534 and 1.4.4-0635 allows remote attackers to execute arbitrary commands via unspecified vectors.
CVE-2022-43749 1Synology 1Presto File Server Nov 21, 2024 Oct 26, 2022 N/A· v4 8.8 HIGH· v3 N/A· v2 Improper privilege management vulnerability in summary report management in Synology Presto File Server before 2.1.2-1601 allows remote authenticated users to bypass security constraint via unspecified vectors.
CVE-2022-43748 1Synology 1Presto File Server Nov 21, 2024 Oct 26, 2022 N/A· v4 7.5 HIGH· v3 N/A· v2 Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in file operation management in Synology Presto File Server before 2.1.2-1601 allows remote attackers to write arbitrary files...Show more Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in file operation management in Synology Presto File Server before 2.1.2-1601 allows remote attackers to write arbitrary files via unspecified vectors.Show less
CVE-2022-27623 1Synology 1Diskstation Manager Jan 14, 2025 Oct 25, 2022 N/A· v4 9.1 CRITICAL· v3 N/A· v2 Missing authentication for critical function vulnerability in iSCSI management functionality in Synology DiskStation Manager (DSM) before 7.1-42661 allows remote attackers to read or write arbitrary files via unspecified...Show more Missing authentication for critical function vulnerability in iSCSI management functionality in Synology DiskStation Manager (DSM) before 7.1-42661 allows remote attackers to read or write arbitrary files via unspecified vectors.Show less
CVE-2022-27622 1Synology 1Diskstation Manager Jan 14, 2025 Oct 25, 2022 N/A· v4 4.3 MEDIUM· v3 N/A· v2 Server-Side Request Forgery (SSRF) vulnerability in Package Center functionality in Synology DiskStation Manager (DSM) before 7.1-42661 allows remote authenticated users to access intranet resources via unspecified vecto...Show more Server-Side Request Forgery (SSRF) vulnerability in Package Center functionality in Synology DiskStation Manager (DSM) before 7.1-42661 allows remote authenticated users to access intranet resources via unspecified vectors.Show less
CVE-2022-3576 1Synology 1Diskstation Manager Jan 14, 2025 Oct 20, 2022 N/A· v4 7.5 HIGH· v3 N/A· v2 A vulnerability regarding out-of-bounds read is found in the session processing functionality of Out-of-Band (OOB) Management. This allows remote attackers to obtain sensitive information via unspecified vectors. The fol...Show more A vulnerability regarding out-of-bounds read is found in the session processing functionality of Out-of-Band (OOB) Management. This allows remote attackers to obtain sensitive information via unspecified vectors. The following models with Synology DiskStation Manager (DSM) versions before 7.1.1-42962-2 may be affected: DS3622xs+, FS3410, and HD6500.Show less
CVE-2022-27626 1Synology 1Diskstation Manager Jan 14, 2025 Oct 20, 2022 N/A· v4 8.1 HIGH· v3 N/A· v2 A vulnerability regarding concurrent execution using shared resource with improper synchronization ('Race Condition') is found in the session processing functionality of Out-of-Band (OOB) Management. This allows remote a...Show more A vulnerability regarding concurrent execution using shared resource with improper synchronization ('Race Condition') is found in the session processing functionality of Out-of-Band (OOB) Management. This allows remote attackers to execute arbitrary commands via unspecified vectors. The following models with Synology DiskStation Manager (DSM) versions before 7.1.1-42962-2 may be affected: DS3622xs+, FS3410, and HD6500.Show less
CVE-2022-27625 1Synology 1Diskstation Manager Jan 14, 2025 Oct 20, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the message processing functionality of Out-of-Band (OOB) Management. This allows remote attackers to execute...Show more A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the message processing functionality of Out-of-Band (OOB) Management. This allows remote attackers to execute arbitrary commands via unspecified vectors. The following models with Synology DiskStation Manager (DSM) versions before 7.1.1-42962-2 may be affected: DS3622xs+, FS3410, and HD6500.Show less
CVE-2022-27624 1Synology 1Diskstation Manager Jan 14, 2025 Oct 20, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the packet decryption functionality of Out-of-Band (OOB) Management. This allows remote attackers to execute a...Show more A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the packet decryption functionality of Out-of-Band (OOB) Management. This allows remote attackers to execute arbitrary commands via unspecified vectors. The following models with Synology DiskStation Manager (DSM) versions before 7.1.1-42962-2 may be affected: DS3622xs+, FS3410, and HD6500.Show less
CVE-2022-27621 1Synology 1Usb Copy Jan 14, 2025 Aug 3, 2022 N/A· v4 3.8 LOW· v3 N/A· v2 Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology USB Copy before 2.2.0-1086 allows remote authenticated users to read or write arbitrary files v...Show more Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology USB Copy before 2.2.0-1086 allows remote authenticated users to read or write arbitrary files via unspecified vectors.Show less
CVE-2022-27620 1Synology 1Sso Server Jan 14, 2025 Aug 3, 2022 N/A· v4 4.9 MEDIUM· v3 N/A· v2 Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology SSO Server before 2.2.3-0331 allows remote authenticated users to read arbitrary files via unsp...Show more Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology SSO Server before 2.2.3-0331 allows remote authenticated users to read arbitrary files via unspecified vectors.Show less
CVE-2022-27619 1Synology 1Note Station Nov 21, 2024 Aug 3, 2022 N/A· v4 5.9 MEDIUM· v3 N/A· v2 Cleartext transmission of sensitive information vulnerability in authentication management in Synology Note Station Client before 2.2.2-609 allows man-in-the-middle attackers to obtain sensitive information via unspecifi...Show more Cleartext transmission of sensitive information vulnerability in authentication management in Synology Note Station Client before 2.2.2-609 allows man-in-the-middle attackers to obtain sensitive information via unspecified vectors.Show less

Previous 1...567...18 Next