Synology

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2022-27625 1Synology 1Diskstation Manager Jun 17, 2026 Oct 20, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the message processing functionality of Out-of-Band (OOB) Management. This allows remote attackers to execute...Show more A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the message processing functionality of Out-of-Band (OOB) Management. This allows remote attackers to execute arbitrary commands via unspecified vectors. The following models with Synology DiskStation Manager (DSM) versions before 7.1.1-42962-2 may be affected: DS3622xs+, FS3410, and HD6500.Show less
CVE-2022-27624 1Synology 1Diskstation Manager Jun 17, 2026 Oct 20, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the packet decryption functionality of Out-of-Band (OOB) Management. This allows remote attackers to execute a...Show more A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the packet decryption functionality of Out-of-Band (OOB) Management. This allows remote attackers to execute arbitrary commands via unspecified vectors. The following models with Synology DiskStation Manager (DSM) versions before 7.1.1-42962-2 may be affected: DS3622xs+, FS3410, and HD6500.Show less
CVE-2022-27621 1Synology 1Usb Copy Jun 17, 2026 Aug 3, 2022 N/A· v4 3.8 LOW· v3 N/A· v2 Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology USB Copy before 2.2.0-1086 allows remote authenticated users to read or write arbitrary files v...Show more Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology USB Copy before 2.2.0-1086 allows remote authenticated users to read or write arbitrary files via unspecified vectors.Show less
CVE-2022-27620 1Synology 1Sso Server Jun 17, 2026 Aug 3, 2022 N/A· v4 4.9 MEDIUM· v3 N/A· v2 Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology SSO Server before 2.2.3-0331 allows remote authenticated users to read arbitrary files via unsp...Show more Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology SSO Server before 2.2.3-0331 allows remote authenticated users to read arbitrary files via unspecified vectors.Show less
CVE-2022-27619 1Synology 1Note Station Jun 17, 2026 Aug 3, 2022 N/A· v4 5.9 MEDIUM· v3 N/A· v2 Cleartext transmission of sensitive information vulnerability in authentication management in Synology Note Station Client before 2.2.2-609 allows man-in-the-middle attackers to obtain sensitive information via unspecifi...Show more Cleartext transmission of sensitive information vulnerability in authentication management in Synology Note Station Client before 2.2.2-609 allows man-in-the-middle attackers to obtain sensitive information via unspecified vectors.Show less
CVE-2022-27618 1Synology 1Storage Analyzer Jun 17, 2026 Aug 3, 2022 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology Storage Analyzer before 2.1.0-0390 allows remote authenticated users to delete arbitrary files...Show more Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology Storage Analyzer before 2.1.0-0390 allows remote authenticated users to delete arbitrary files via unspecified vectors.Show less
CVE-2022-27617 1Synology 1Calendar Jun 17, 2026 Aug 3, 2022 N/A· v4 4.3 MEDIUM· v3 N/A· v2 Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology Calendar before 2.3.4-0631 allows remote authenticated users to download arbitrary files via un...Show more Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology Calendar before 2.3.4-0631 allows remote authenticated users to download arbitrary files via unspecified vectors.Show less
CVE-2022-27616 1Synology 1Diskstation Manager Jun 17, 2026 Aug 3, 2022 N/A· v4 7.2 HIGH· v3 N/A· v2 Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in webapi component in Synology DiskStation Manager (DSM) before 7.0.1-42218-3 allows remote authenticated users to...Show more Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in webapi component in Synology DiskStation Manager (DSM) before 7.0.1-42218-3 allows remote authenticated users to execute arbitrary commands via unspecified vectors.Show less
CVE-2022-27611 1Synology 1Audio Station Jun 17, 2026 Jul 28, 2022 N/A· v4 8.1 HIGH· v3 N/A· v2 Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology Audio Station before 6.5.4-3367 allows remote authenticated users to delete arbitrary files via...Show more Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology Audio Station before 6.5.4-3367 allows remote authenticated users to delete arbitrary files via unspecified vectors.Show less
CVE-2022-27614 1Synology 1Media Server Jun 17, 2026 Jul 28, 2022 N/A· v4 7.5 HIGH· v3 N/A· v2 Exposure of sensitive information to an unauthorized actor vulnerability in web server in Synology Media Server before 1.8.1-2876 allows remote attackers to obtain sensitive information via unspecified vectors.
CVE-2022-27613 1Synology 1Carddav Server Jun 17, 2026 Jul 28, 2022 N/A· v4 8.8 HIGH· v3 N/A· v2 Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in webapi component in Synology CardDAV Server before 6.0.10-0153 allows remote authenticated users to inject SQL command...Show more Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in webapi component in Synology CardDAV Server before 6.0.10-0153 allows remote authenticated users to inject SQL commands via unspecified vectors.Show less
CVE-2022-27612 1Synology 1Audio Station Jun 17, 2026 Jul 28, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in cgi component in Synology Audio Station before 6.5.4-3367 allows remote attackers to execute arbitrary commands via unspecified vect...Show more Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in cgi component in Synology Audio Station before 6.5.4-3367 allows remote attackers to execute arbitrary commands via unspecified vectors.Show less
CVE-2022-22685 1Synology 1Webdav Server Jun 17, 2026 Jul 28, 2022 N/A· v4 8.1 HIGH· v3 N/A· v2 Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology WebDAV Server before 2.4.0-0062 allows remote authenticated users to delete arbitrary files via...Show more Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology WebDAV Server before 2.4.0-0062 allows remote authenticated users to delete arbitrary files via unspecified vectors.Show less
CVE-2022-22684 1Synology 1Diskstation Manager Jun 17, 2026 Jul 28, 2022 N/A· v4 8.8 HIGH· v3 N/A· v2 Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in task management component in Synology DiskStation Manager (DSM) before 6.2.4-25553 allows remote authenticated u...Show more Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in task management component in Synology DiskStation Manager (DSM) before 6.2.4-25553 allows remote authenticated users to execute arbitrary commands via unspecified vectors.Show less
CVE-2022-22683 1Synology 1Media Server Jun 17, 2026 Jul 28, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in cgi component in Synology Media Server before 1.8.1-2876 allows remote attackers to execute arbitrary code via unspecified vectors.
CVE-2022-27615 1Synology 1Dns Server Jun 17, 2026 Jul 28, 2022 N/A· v4 8.1 HIGH· v3 N/A· v2 Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in cgi component in Synology DNS Server before 2.2.2-5027 allows remote authenticated users to delete arbitrary files via unspe...Show more Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in cgi component in Synology DNS Server before 2.2.2-5027 allows remote authenticated users to delete arbitrary files via unspecified vectors.Show less
CVE-2022-27610 1Synology 1Diskstation Manager Jun 17, 2026 Jul 27, 2022 N/A· v4 8.1 HIGH· v3 N/A· v2 Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology DiskStation Manager (DSM) before 6.2.3-25423 allows remote authenticated users to delete arbitr...Show more Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology DiskStation Manager (DSM) before 6.2.3-25423 allows remote authenticated users to delete arbitrary files via unspecified vectors.Show less
CVE-2022-22686 1Synology 1Calendar Jun 17, 2026 Jul 26, 2022 N/A· v4 8.0 HIGH· v3 N/A· v2 Cross-Site Request Forgery (CSRF) vulnerability in webapi component in Synology Calendar before 2.3.4-0631 allows remote authenticated users to hijack the authentication of administrators via unspecified vectors.
CVE-2022-22682 1Synology 1Calendar Jun 17, 2026 Jul 12, 2022 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Event Management in Synology Calendar before 2.4.5-10930 allows remote authenticated users to inject arbitrary web scr...Show more Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Event Management in Synology Calendar before 2.4.5-10930 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.Show less
CVE-2022-22681 1Synology 1Photo Station Jun 17, 2026 Jul 6, 2022 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Session fixation vulnerability in access control management in Synology Photo Station before 6.8.16-3506 allows remote attackers to bypass security constraint via unspecified vectors.

Previous 1...678...18 Next