Synology

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2017-12071 1Synology 1Photo Station May 13, 2026 Sep 8, 2017 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 Server-side request forgery (SSRF) vulnerability in file_upload.php in Synology Photo Station before 6.7.4-3433 and 6.3-2968 allows remote authenticated users to download arbitrary local files via the url parameter.
CVE-2017-11162 1Synology 1Photo Station May 13, 2026 Sep 8, 2017 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 Directory traversal vulnerability in synphotoio in Synology Photo Station before 6.7.4-3433 and 6.3-2968 allows remote authenticated users to read arbitrary files via unspecified vectors.
CVE-2017-11161 1Synology 1Photo Station May 13, 2026 Sep 8, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Multiple SQL injection vulnerabilities in Synology Photo Station before 6.7.4-3433 and 6.3-2968 allow remote attackers to execute arbitrary SQL commands via the (1) article_id parameter to label.php; or (2) type paramete...Show more Multiple SQL injection vulnerabilities in Synology Photo Station before 6.7.4-3433 and 6.3-2968 allow remote attackers to execute arbitrary SQL commands via the (1) article_id parameter to label.php; or (2) type parameter to synotheme.php.Show less
CVE-2017-11158 1Synology 1Cloud Station Drive May 13, 2026 Aug 31, 2017 N/A· v4 7.8 HIGH· v3 4.6 MEDIUM· v2 Multiple untrusted search path vulnerabilities in the installer in Synology Cloud Station Drive before 4.2.5-4396 on Windows allow local attackers to execute arbitrary code and conduct DLL hijacking attacks via a Trojan...Show more Multiple untrusted search path vulnerabilities in the installer in Synology Cloud Station Drive before 4.2.5-4396 on Windows allow local attackers to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse (1) shfolder.dll, (2) ntmarta.dll, (3) secur32.dll or (4) dwmapi.dll file in the current working directory.Show less
CVE-2017-11157 1Synology 1Cloud Station Backup May 13, 2026 Aug 30, 2017 N/A· v4 7.8 HIGH· v3 4.6 MEDIUM· v2 Multiple untrusted search path vulnerabilities in the installer in Synology Cloud Station Backup before 4.2.5-4396 on Windows allow local attackers to execute arbitrary code and conduct DLL hijacking attacks via a Trojan...Show more Multiple untrusted search path vulnerabilities in the installer in Synology Cloud Station Backup before 4.2.5-4396 on Windows allow local attackers to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse (1) shfolder.dll, (2) ntmarta.dll, (3) secur32.dll or (4) dwmapi.dll file in the current working directory.Show less
CVE-2017-12077 1Synology 1Router Manager May 13, 2026 Aug 28, 2017 N/A· v4 4.9 MEDIUM· v3 4.0 MEDIUM· v2 Uncontrolled Resource Consumption vulnerability in SYNO.Core.PortForwarding.Rules in Synology Router Manager (SRM) before 1.1.4-6509 allows remote authenticated attacker to exhaust the memory resources of the machine, ca...Show more Uncontrolled Resource Consumption vulnerability in SYNO.Core.PortForwarding.Rules in Synology Router Manager (SRM) before 1.1.4-6509 allows remote authenticated attacker to exhaust the memory resources of the machine, causing a denial of service attack.Show less
CVE-2017-12076 1Synology 1Diskstation Manager May 13, 2026 Aug 28, 2017 N/A· v4 4.9 MEDIUM· v3 4.0 MEDIUM· v2 Uncontrolled Resource Consumption vulnerability in SYNO.Core.PortForwarding.Rules in Synology DiskStation (DSM) before 6.1.1-15088 allows remote authenticated attacker to exhaust the memory resources of the machine, caus...Show more Uncontrolled Resource Consumption vulnerability in SYNO.Core.PortForwarding.Rules in Synology DiskStation (DSM) before 6.1.1-15088 allows remote authenticated attacker to exhaust the memory resources of the machine, causing a denial of service attack.Show less
CVE-2017-9555 1Synology 1Photo Station May 13, 2026 Aug 24, 2017 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Cross-site scripting (XSS) vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.0-3414 allows remote attackers to inject arbitrary web script or HTML via the image parameter.
CVE-2017-12074 1Synology 1Dns Server May 13, 2026 Aug 24, 2017 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 Directory traversal vulnerability in the SYNO.DNSServer.Zone.MasterZoneConf in Synology DNS Server before 2.2.1-3042 allows remote authenticated attackers to write arbitrary files via the domain_name parameter.
CVE-2017-11159 1Synology 1Photo Station Uploader May 13, 2026 Aug 23, 2017 N/A· v4 7.8 HIGH· v3 4.6 MEDIUM· v2 Multiple untrusted search path vulnerabilities in installer in Synology Photo Station Uploader before 1.4.2-084 on Windows allows local attackers to execute arbitrary code and conduct DLL hijacking attack via a Trojan ho...Show more Multiple untrusted search path vulnerabilities in installer in Synology Photo Station Uploader before 1.4.2-084 on Windows allows local attackers to execute arbitrary code and conduct DLL hijacking attack via a Trojan horse (1) shfolder.dll, (2) ntmarta.dll, (3) secur32.dll or (4) dwmapi.dll file in the current working directory.Show less
CVE-2017-11160 1Synology 1Assistant May 13, 2026 Aug 18, 2017 N/A· v4 7.8 HIGH· v3 4.6 MEDIUM· v2 Multiple untrusted search path vulnerabilities in installer in Synology Assistant before 6.1-15163 on Windows allows local attackers to execute arbitrary code and conduct DLL hijacking attack via a Trojan horse (1) shfol...Show more Multiple untrusted search path vulnerabilities in installer in Synology Assistant before 6.1-15163 on Windows allows local attackers to execute arbitrary code and conduct DLL hijacking attack via a Trojan horse (1) shfolder.dll, (2) ntmarta.dll, (3) secur32.dll or (4) dwmapi.dll file in the current working directory.Show less
CVE-2017-11156 1Synology 1Download Station May 13, 2026 Aug 14, 2017 N/A· v4 7.8 HIGH· v3 6.5 MEDIUM· v2 Synology Download Station 3.8.x before 3.8.5-3475 and 3.x before 3.5-2984 uses weak permissions (0777) for ui/dlm/btsearch directory, which allows remote authenticated users to execute arbitrary code by uploading an exec...Show more Synology Download Station 3.8.x before 3.8.5-3475 and 3.x before 3.5-2984 uses weak permissions (0777) for ui/dlm/btsearch directory, which allows remote authenticated users to execute arbitrary code by uploading an executable via unspecified vectors.Show less
CVE-2017-11150 1Synology 1Office May 13, 2026 Aug 14, 2017 N/A· v4 7.8 HIGH· v3 6.5 MEDIUM· v2 Command injection vulnerability in Document.php in Synology Office 2.2.0-1502 and 2.2.1-1506 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the crafted file name of RTF docume...Show more Command injection vulnerability in Document.php in Synology Office 2.2.0-1502 and 2.2.1-1506 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the crafted file name of RTF documents.Show less
CVE-2017-11149 1Synology 1Download Station May 13, 2026 Aug 14, 2017 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 Server-side request forgery (SSRF) vulnerability in Downloader in Synology Download Station 3.8.x before 3.8.5-3475 and 3.x before 3.5-2984 allows remote authenticated users to download arbitrary local files via crafted...Show more Server-side request forgery (SSRF) vulnerability in Downloader in Synology Download Station 3.8.x before 3.8.5-3475 and 3.x before 3.5-2984 allows remote authenticated users to download arbitrary local files via crafted URI.Show less
CVE-2017-9556 1Synology 1Video Station May 13, 2026 Aug 11, 2017 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Cross-site scripting (XSS) vulnerability in Video Metadata Editor in Synology Video Station before 2.3.0-1435 allows remote authenticated attackers to inject arbitrary web script or HTML via the title parameter.
CVE-2017-11148 1Synology 1Chat May 13, 2026 Aug 11, 2017 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 Server-side request forgery (SSRF) vulnerability in link preview in Synology Chat before 1.1.0-0806 allows remote authenticated users to access intranet resources via unspecified vectors.
CVE-2017-11155 1Synology 1Photo Station May 13, 2026 Aug 8, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 An information exposure vulnerability in index.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to obtain sensitive system information via unspecified vectors.
CVE-2017-11154 1Synology 1Photo Station May 13, 2026 Aug 8, 2017 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 Unrestricted file upload vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to create arbitrary PHP scripts via the type parameter.
CVE-2017-11153 1Synology 1Photo Station May 13, 2026 Aug 8, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Deserialization vulnerability in synophoto_csPhotoMisc.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to gain administrator privileges via a crafted serialized payload.
CVE-2017-11152 1Synology 1Photo Station May 13, 2026 Aug 8, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Directory traversal vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to write arbitrary files via the path parameter.

Previous 1...14 151617 18 Next