Synology
Page 2 of 4 — Synology CVEs from a corpus of 328, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-29228 | High | 7.7 | 2024-03-28 | Missing authorization vulnerability in GetStmUrlPath webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remote authenti… |
CVE-2024-29227 | Medium | 5.4 | 2024-03-28 | Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Layout.LayoutSave webapi component in Synology Surveillan… |
CVE-2024-0854 | Medium | 5.4 | 2024-01-24 | URL redirection to untrusted site ('Open Redirect') vulnerability in file access component in Synology DiskStation Manager (DSM) before 6.2.4-25556-8, 7.0.1-42… |
CVE-2023-5748 | Low | 3.3 | 2023-11-07 | Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in cgi component in Synology SSL VPN Client before 1.4.7-0687 allows local… |
CVE-2023-5746 | Critical | 9.8 | 2023-10-25 | A vulnerability regarding use of externally-controlled format string is found in the cgi component. This allows remote attackers to execute arbitrary code via… |
CVE-2023-41741 | Medium | 5.3 | 2023-08-31 | Exposure of sensitive information to an unauthorized actor vulnerability in cgi component in Synology Router Manager (SRM) before 1.3.1-9346-6 allows remote at… |
CVE-2023-41740 | Medium | 5.3 | 2023-08-31 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in cgi component in Synology Router Manager (SRM) before 1.3.1-934… |
CVE-2023-41739 | Medium | 4.9 | 2023-08-31 | Uncontrolled resource consumption vulnerability in File Functionality in Synology Router Manager (SRM) before 1.3.1-9346-6 allows remote authenticated users to… |
CVE-2023-41738 | High | 7.2 | 2023-08-31 | Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in Directory Domain Functionality in Synology Router M… |
CVE-2023-2729 | Medium | 5.9 | 2023-06-13 | Use of insufficiently random values vulnerability in User Management Functionality in Synology DiskStation Manager (DSM) before 7.2-64561 allows remote attacke… |
CVE-2023-0142 | Medium | 6.5 | 2023-06-13 | Uncontrolled search path element vulnerability in Backup Management functionality in Synology DiskStation Manager (DSM) before 6.2.4-25556-8, 7.0.1-42218-7 and… |
CVE-2023-32956 | Critical | 9.8 | 2023-05-16 | Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in CGI component in Synology Router Manager (SRM) befo… |
CVE-2023-32955 | High | 8.1 | 2023-05-16 | Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in DHCP Client Functionality in Synology Router Manage… |
CVE-2023-0077 | Medium | 6.5 | 2023-01-05 | Integer overflow or wraparound vulnerability in CGI component in Synology Router Manager (SRM) before 1.2.5-8227-6 and 1.3.1-9346-3 allows remote attackers to… |
CVE-2022-43932 | High | 7.5 | 2023-01-05 | Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in CGI component in Synology Router Manager (S… |
CVE-2022-43931 | Critical | 10.0 | 2023-01-03 | Out-of-bounds write vulnerability in Remote Desktop Functionality in Synology VPN Plus Server before 1.4.3-0534 and 1.4.4-0635 allows remote attackers to execu… |
CVE-2022-43749 | Medium | 4.3 | 2022-10-26 | Improper privilege management vulnerability in summary report management in Synology Presto File Server before 2.1.2-1601 allows remote authenticated users to… |
CVE-2022-43748 | Medium | 5.8 | 2022-10-26 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in file operation management in Synology Presto File Server before… |
CVE-2022-27623 | High | 7.4 | 2022-10-25 | Missing authentication for critical function vulnerability in iSCSI management functionality in Synology DiskStation Manager (DSM) before 7.1-42661 allows remo… |
CVE-2022-27622 | Medium | 4.1 | 2022-10-25 | Server-Side Request Forgery (SSRF) vulnerability in Package Center functionality in Synology DiskStation Manager (DSM) before 7.1-42661 allows remote authentic… |
CVE-2022-3576 | Medium | 5.3 | 2022-10-20 | A vulnerability regarding out-of-bounds read is found in the session processing functionality of Out-of-Band (OOB) Management. This allows remote attackers to… |
CVE-2022-27626 | Critical | 10.0 | 2022-10-20 | A vulnerability regarding concurrent execution using shared resource with improper synchronization ('Race Condition') is found in the session processing functi… |
CVE-2022-27625 | Critical | 10.0 | 2022-10-20 | A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the message processing functionality of Out-of-Ba… |
CVE-2022-27624 | Critical | 10.0 | 2022-10-20 | A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the packet decryption functionality of Out-of-Ban… |
CVE-2022-27621 | Medium | 5.5 | 2022-08-03 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology USB Copy before 2.2.0-1086 allows… |
CVE-2022-27620 | Medium | 6.8 | 2022-08-03 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology SSO Server before 2.2.3-0331 allow… |
CVE-2022-27619 | Medium | 6.8 | 2022-08-03 | Cleartext transmission of sensitive information vulnerability in authentication management in Synology Note Station Client before 2.2.2-609 allows man-in-the-m… |
CVE-2022-27618 | Medium | 6.8 | 2022-08-03 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology Storage Analyzer before 2.1.0-0390… |
CVE-2022-27617 | Medium | 5.0 | 2022-08-03 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology Calendar before 2.3.4-0631 allows… |
CVE-2022-27616 | High | 7.2 | 2022-08-03 | Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in webapi component in Synology DiskStation Manager (D… |
CVE-2022-27611 | Medium | 5.4 | 2022-07-28 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology Audio Station before 6.5.4-3367 al… |
CVE-2022-27614 | Medium | 5.3 | 2022-07-28 | Exposure of sensitive information to an unauthorized actor vulnerability in web server in Synology Media Server before 1.8.1-2876 allows remote attackers to ob… |
CVE-2022-27613 | High | 8.3 | 2022-07-28 | Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in webapi component in Synology CardDAV Server before 6.0.10… |
CVE-2022-27612 | High | 7.3 | 2022-07-28 | Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in cgi component in Synology Audio Station before 6.5.4-3367 allows remote… |
CVE-2022-22685 | High | 8.7 | 2022-07-28 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology WebDAV Server before 2.4.0-0062 al… |
CVE-2022-22684 | High | 7.2 | 2022-07-28 | Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in task management component in Synology DiskStation M… |
CVE-2022-22683 | Critical | 10.0 | 2022-07-28 | Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in cgi component in Synology Media Server before 1.8.1-2876 allows remote… |
CVE-2022-27615 | High | 7.7 | 2022-07-28 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in cgi component in Synology DNS Server before 2.2.2-5027 allows r… |
CVE-2022-27610 | Medium | 6.5 | 2022-07-27 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology DiskStation Manager (DSM) before 6… |
CVE-2022-22686 | Medium | 6.5 | 2022-07-26 | Cross-Site Request Forgery (CSRF) vulnerability in webapi component in Synology Calendar before 2.3.4-0631 allows remote authenticated users to hijack the auth… |
CVE-2022-22682 | Medium | 6.5 | 2022-07-12 | Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Event Management in Synology Calendar before 2.4.5-10930… |
CVE-2022-22681 | High | 8.1 | 2022-07-06 | Session fixation vulnerability in access control management in Synology Photo Station before 6.8.16-3506 allows remote attackers to bypass security constraint… |
CVE-2022-22688 | High | 8.8 | 2022-03-25 | Improper neutralization of special elements used in a command ('Command Injection') vulnerability in File service functionality in Synology DiskStation Manager… |
CVE-2022-22687 | Critical | 9.8 | 2022-03-25 | Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in Authentication functionality in Synology DiskStation Manager (DSM) befo… |
CVE-2021-44142 | High | 8.8 | 2022-02-21 | The Samba vfs_fruit module uses extended file attributes (EA, xattr) to provide "...enhanced compatibility with Apple SMB clients and interoperability with a N… |
CVE-2022-22679 | Medium | 6.5 | 2022-02-07 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in support service management in Synology DiskStation Manager (DSM… |
CVE-2021-43929 | Medium | 6.5 | 2022-02-07 | Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in work flow management in Synology DiskStatio… |
CVE-2021-43928 | Critical | 9.9 | 2022-02-07 | Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in mail sending and receiving component in Synology Ma… |
CVE-2021-43927 | Medium | 4.7 | 2022-02-07 | Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Security Management functionality in Synology DiskStation… |
CVE-2021-43926 | Medium | 4.7 | 2022-02-07 | Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Log Management functionality in Synology DiskStation Mana… |
CVE-2021-43925 | Medium | 4.7 | 2022-02-07 | Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Log Management functionality in Synology DiskStation Mana… |
CVE-2022-22680 | Medium | 5.3 | 2022-02-07 | Exposure of sensitive information to an unauthorized actor vulnerability in Web Server in Synology DiskStation Manager (DSM) before 7.0.1-42218-2 allows remote… |
CVE-2021-29087 | High | 7.5 | 2021-06-23 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology DiskStation Manager (DSM) before 6… |
CVE-2021-29086 | Medium | 5.3 | 2021-06-23 | Exposure of sensitive information to an unauthorized actor vulnerability in webapi component in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows… |
CVE-2021-29085 | High | 8.6 | 2021-06-23 | Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in file sharing management component in Synolo… |
CVE-2021-29084 | High | 7.5 | 2021-06-23 | Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in Security Advisor report management componen… |
CVE-2021-27649 | Critical | 9.8 | 2021-06-23 | Use after free vulnerability in file transfer protocol component in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to execute… |
CVE-2021-34812 | Medium | 5.8 | 2021-06-18 | Use of hard-coded credentials vulnerability in php component in Synology Calendar before 2.4.0-0761 allows remote attackers to obtain sensitive information via… |
CVE-2021-34811 | Medium | 5.0 | 2021-06-18 | Server-Side Request Forgery (SSRF) vulnerability in task management component in Synology Download Station before 3.8.16-3566 allows remote authenticated users… |
CVE-2021-34810 | Critical | 9.9 | 2021-06-18 | Improper privilege management vulnerability in cgi component in Synology Download Station before 3.8.16-3566 allows remote authenticated users to execute arbit… |
CVE-2021-34809 | Critical | 9.9 | 2021-06-18 | Improper neutralization of special elements used in a command ('Command Injection') vulnerability in task management component in Synology Download Station bef… |
CVE-2021-34808 | Medium | 5.8 | 2021-06-18 | Server-Side Request Forgery (SSRF) vulnerability in cgi component in Synology Media Server before 1.8.3-2881 allows remote attackers to access intranet resourc… |
CVE-2021-29089 | Critical | 9.8 | 2021-06-02 | Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in thumbnail component in Synology Photo Station before 6.8… |
CVE-2021-29091 | High | 7.7 | 2021-06-02 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in file management component in Synology Photo Station before 6.8… |
CVE-2021-29090 | High | 7.2 | 2021-06-02 | Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in PHP component in Synology Photo Station before 6.8.14-350… |
CVE-2021-33184 | High | 7.7 | 2021-06-01 | Server-Side request forgery (SSRF) vulnerability in task management component in Synology Download Station before 3.8.15-3563 allows remote authenticated users… |
CVE-2021-33183 | High | 7.9 | 2021-06-01 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability container volume management component in Synology Docker before 18… |
CVE-2021-33182 | Medium | 5.0 | 2021-06-01 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in PDF Viewer component in Synology DiskStation Manager (DSM) befo… |
CVE-2021-33181 | Medium | 6.6 | 2021-06-01 | Server-Side Request Forgery (SSRF) vulnerability in webapi component in Synology Video Station before 2.4.10-1632 allows remote authenticated users to send arb… |
CVE-2021-33180 | High | 7.3 | 2021-06-01 | Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in cgi component in Synology Media Server before 1.8.1-2876… |
CVE-2021-29092 | High | 8.8 | 2021-06-01 | Unrestricted upload of file with dangerous type vulnerability in file management component in Synology Photo Station before 6.8.14-3500 allows remote authentic… |
CVE-2021-29088 | High | 7.8 | 2021-06-01 | Improper limitation of a pathname to a restricted directory ('Path Traversal') in cgi component in Synology DiskStation Manager (DSM) before 6.2.4-25553 allows… |
CVE-2021-31439 | High | 8.8 | 2021-05-21 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Synology DiskStation Manager. Authentication is not… |
CVE-2021-27648 | Critical | 9.0 | 2021-04-28 | Externally controlled reference to a resource in another sphere in quarantine functionality in Synology Antivirus Essential before 1.4.8-2801 allows remote aut… |
CVE-2021-29083 | High | 7.2 | 2021-04-01 | Improper neutralization of special elements used in an OS command in SYNO.Core.Network.PPPoE in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows… |
CVE-2021-27647 | Critical | 9.8 | 2021-03-12 | Out-of-bounds Read vulnerability in iscsi_snapshot_comm_core in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to execute arbi… |
CVE-2021-27646 | Critical | 9.8 | 2021-03-12 | Use After Free vulnerability in iscsi_snapshot_comm_core in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to execute arbitrar… |
CVE-2021-26569 | Critical | 9.8 | 2021-03-12 | Race Condition within a Thread vulnerability in iscsi_snapshot_comm_core in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to… |
CVE-2021-26567 | High | 7.8 | 2021-02-26 | Stack-based buffer overflow vulnerability in frontend/main.c in faad2 before 2.2.7.1 allow local attackers to execute arbitrary code via filename and pathname… |
CVE-2021-26566 | High | 8.3 | 2021-02-26 | Insertion of sensitive information into sent data vulnerability in synorelayd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-midd… |
CVE-2021-26565 | High | 8.3 | 2021-02-26 | Cleartext transmission of sensitive information vulnerability in synorelayd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-middle… |
CVE-2021-26564 | High | 8.3 | 2021-02-26 | Cleartext transmission of sensitive information vulnerability in synorelayd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-middle… |
CVE-2021-26563 | High | 8.2 | 2021-02-26 | Incorrect authorization vulnerability in synoagentregisterd in Synology DiskStation Manager (DSM) before 6.2.4-25553 allows local users to execute arbitrary co… |
CVE-2021-26562 | Critical | 9.0 | 2021-02-26 | Out-of-bounds write vulnerability in synoagentregisterd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-middle attackers to execut… |
CVE-2021-26561 | Critical | 9.0 | 2021-02-26 | Stack-based buffer overflow vulnerability in synoagentregisterd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-middle attackers t… |
CVE-2021-26560 | Critical | 9.0 | 2021-02-26 | Cleartext transmission of sensitive information vulnerability in synoagentregisterd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-th… |
CVE-2021-3156 | High | 7.8 | 2021-01-26 | Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" a… |
CVE-2020-27660 | Critical | 9.6 | 2020-11-30 | SQL injection vulnerability in request.cgi in Synology SafeAccess before 1.2.3-0234 allows remote attackers to execute arbitrary SQL commands via the domain pa… |
CVE-2020-27659 | High | 8.4 | 2020-11-30 | Multiple cross-site scripting (XSS) vulnerabilities in Synology SafeAccess before 1.2.3-0234 allow remote attackers to inject arbitrary web script or HTML via… |
CVE-2020-27658 | High | 7.1 | 2020-10-29 | Synology Router Manager (SRM) before 1.2.4-8081 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for rem… |
CVE-2020-27657 | Medium | 6.5 | 2020-10-29 | Cleartext transmission of sensitive information vulnerability in DDNS in Synology Router Manager (SRM) before 1.2.4-8081 allows man-in-the-middle attackers to… |
CVE-2020-27656 | Medium | 6.5 | 2020-10-29 | Cleartext transmission of sensitive information vulnerability in DDNS in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-in-the-middle attac… |
CVE-2020-27655 | Medium | 6.5 | 2020-10-29 | Improper access control vulnerability in Synology Router Manager (SRM) before 1.2.4-8081 allows remote attackers to access restricted resources via inbound Qui… |
CVE-2020-27654 | Critical | 9.8 | 2020-10-29 | Improper access control vulnerability in lbd in Synology Router Manager (SRM) before 1.2.4-8081 allows remote attackers to execute arbitrary commands via port… |
CVE-2020-27653 | High | 8.3 | 2020-10-29 | Algorithm downgrade vulnerability in QuickConnect in Synology Router Manager (SRM) before 1.2.4-8081 allows man-in-the-middle attackers to spoof servers and ob… |
CVE-2020-27652 | High | 8.3 | 2020-10-29 | Algorithm downgrade vulnerability in QuickConnect in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-in-the-middle attackers to spoof server… |
CVE-2020-27651 | Medium | 5.8 | 2020-10-29 | Synology Router Manager (SRM) before 1.2.4-8081 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attac… |
CVE-2020-27650 | Medium | 5.8 | 2020-10-29 | Synology DiskStation Manager (DSM) before 6.2.3-25426-2 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remo… |
CVE-2020-27649 | High | 8.3 | 2020-10-29 | Improper certificate validation vulnerability in OpenVPN client in Synology Router Manager (SRM) before 1.2.4-8081 allows man-in-the-middle attackers to spoof… |
CVE-2020-27648 | High | 8.3 | 2020-10-29 | Improper certificate validation vulnerability in OpenVPN client in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-in-the-middle attackers t… |