Synology
Page 3 of 4 — Synology CVEs from a corpus of 328, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-8623 | High | 7.5 | 2020-08-21 | In BIND 9.10.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.10.5-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker that c… |
CVE-2020-8622 | Medium | 6.5 | 2020-08-21 | In BIND 9.0.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker on the n… |
CVE-2020-8621 | High | 7.5 | 2020-08-21 | In BIND 9.14.0 -> 9.16.5, 9.17.0 -> 9.17.3, If a server is configured with both QNAME minimization and 'forward first' then an attacker who can send queries to… |
CVE-2020-1472 | Medium | 5.5 | 2020-08-17 | An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the N… |
CVE-2019-11823 | High | 8.6 | 2020-05-04 | CRLF injection vulnerability in Network Center in Synology Router Manager (SRM) before 1.2.3-8017-2 allows remote attackers to cause a denial of service (out-o… |
CVE-2019-9502 | High | 7.9 | 2020-02-03 | The Broadcom wl WiFi driver is vulnerable to a heap buffer overflow. If the vendor information element data length is larger than 164 bytes, a heap buffer over… |
CVE-2019-9501 | High | 7.9 | 2020-02-03 | The Broadcom wl WiFi driver is vulnerable to a heap buffer overflow. By supplying a vendor information element with a data length larger than 32 bytes, a heap… |
CVE-2019-19344 | Medium | 6.5 | 2020-01-21 | There is a use-after-free issue in all samba 4.9.x versions before 4.9.18, all samba 4.10.x versions before 4.10.12 and all samba 4.11.x versions before 4.11.5… |
CVE-2019-14907 | Medium | 6.5 | 2020-01-21 | All samba versions 4.9.x before 4.9.18, 4.10.x before 4.10.12 and 4.11.x before 4.11.5 have an issue where if it is set with "log level = 3" (or above) then th… |
CVE-2019-9518 | High | 7.5 | 2019-08-13 | Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service. The attacker sends a stream of frames with a… |
CVE-2019-9517 | High | 7.5 | 2019-08-13 | Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service. The attacker opens the HTTP/2 w… |
CVE-2019-9516 | Medium | 6.5 | 2019-08-13 | Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length… |
CVE-2019-9515 | High | 7.5 | 2019-08-13 | Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to t… |
CVE-2019-9514 | High | 7.5 | 2019-08-13 | Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an in… |
CVE-2019-9513 | High | 7.5 | 2019-08-13 | Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and con… |
CVE-2019-9511 | High | 7.5 | 2019-08-13 | Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The… |
CVE-2019-11829 | High | 7.3 | 2019-06-30 | OS command injection vulnerability in drivers_syno_import_user.php in Synology Calendar before 2.3.1-0617 allows remote attackers to execute arbitrary commands… |
CVE-2019-11828 | Medium | 5.5 | 2019-06-30 | Cross-site scripting (XSS) vulnerability in Chart in Synology Office before 3.1.4-2771 allows remote authenticated users to inject arbitrary web script or HTML… |
CVE-2019-11827 | Medium | 6.5 | 2019-06-30 | Cross-site scripting (XSS) vulnerability in SYNO.NoteStation.Shard in Synology Note Station before 2.5.3-0863 allows remote attackers to inject arbitrary web s… |
CVE-2019-11826 | High | 8.0 | 2019-06-30 | Relative path traversal vulnerability in SYNO.PhotoTeam.Upload.Item in Synology Moments before 1.3.0-0691 allows remote authenticated users to upload arbitrary… |
CVE-2019-11825 | Medium | 6.5 | 2019-06-30 | Cross-site scripting (XSS) vulnerability in Event Editor in Synology Calendar before 2.3.0-0615 allows remote attackers to inject arbitrary web script or HTML… |
CVE-2019-11822 | Medium | 4.3 | 2019-06-30 | Relative path traversal vulnerability in SYNO.PhotoStation.File in Synology Photo Station before 6.8.11-3489 and before 6.3-2977 allows remote attackers to upl… |
CVE-2019-11821 | High | 7.3 | 2019-06-30 | SQL injection vulnerability in synophoto_csPhotoDB.php in Synology Photo Station before 6.8.11-3489 and before 6.3-2977 allows remote attackers to execute arbi… |
CVE-2019-11820 | Medium | 5.5 | 2019-05-09 | Information exposure through process environment vulnerability in Synology Calendar before 2.3.3-0620 allows local users to obtain credentials via cmdline. |
CVE-2019-9499 | High | 8.1 | 2019-04-17 | The implementations of EAP-PWD in wpa_supplicant EAP Peer, when built against a crypto library missing explicit validation on imported elements, do not validat… |
CVE-2019-9498 | High | 8.1 | 2019-04-17 | The implementations of EAP-PWD in hostapd EAP Server, when built against a crypto library missing explicit validation on imported elements, do not validate the… |
CVE-2019-9495 | Low | 3.7 | 2019-04-17 | The implementations of EAP-PWD in hostapd and wpa_supplicant are vulnerable to side-channel attacks as a result of cache access patterns. All versions of hosta… |
CVE-2019-9494 | Medium | 5.9 | 2019-04-17 | The implementations of SAE in hostapd and wpa_supplicant are vulnerable to side channel attacks as a result of observable timing differences and cache access p… |
CVE-2019-3870 | Medium | 6.1 | 2019-04-09 | A vulnerability was found in Samba from version (including) 4.9 to versions before 4.9.6 and 4.10.2. During the creation of a new Samba AD DC, files are create… |
CVE-2018-8913 | High | 7.1 | 2019-04-01 | Missing custom error page vulnerability in Synology Web Station before 2.1.3-0139 allows remote attackers to conduct phishing attacks via a crafted URL. |
CVE-2018-13299 | Medium | 4.3 | 2019-04-01 | Relative path traversal vulnerability in Attachment Uploader in Synology Calendar before 2.2.2-0532 allows remote authenticated users to upload arbitrary files… |
CVE-2018-13298 | Medium | 4.2 | 2019-04-01 | Channel accessible by non-endpoint vulnerability in privacy page in Synology Android Moments before 1.2.3-199 allows man-in-the-middle attackers to execute arb… |
CVE-2018-13297 | Medium | 5.3 | 2019-04-01 | Information exposure vulnerability in SYNO.SynologyDrive.Files in Synology Drive before 1.1.2-10562 allows remote attackers to obtain sensitive system informat… |
CVE-2018-13296 | High | 7.5 | 2019-04-01 | Uncontrolled resource consumption vulnerability in TLS configuration in Synology MailPlus Server before 2.0.5-0606 allows remote attackers to conduct denial-of… |
CVE-2018-13295 | Medium | 4.3 | 2019-04-01 | Information exposure vulnerability in SYNO.Personal.Application.Info in Synology Application Service before 1.5.4-0320 allows remote authenticated users to obt… |
CVE-2018-13294 | Medium | 4.3 | 2019-04-01 | Information exposure vulnerability in SYNO.Personal.Profile in Synology Application Service before 1.5.4-0320 allows remote authenticated users to obtain sensi… |
CVE-2018-13293 | Medium | 5.9 | 2019-04-01 | Cross-site scripting (XSS) vulnerability in Control Panel SSO Settings in Synology DiskStation Manager (DSM) before 6.2.1-23824 allows remote authenticated use… |
CVE-2018-13292 | Medium | 4.3 | 2019-04-01 | Information exposure vulnerability in /usr/syno/etc/mount.conf in Synology Router Manager (SRM) before 1.1.7-6941-2 allows remote authenticated users to obtain… |
CVE-2018-13291 | Medium | 4.3 | 2019-04-01 | Information exposure vulnerability in /usr/syno/etc/mount.conf in Synology DiskStation Manager (DSM) before 6.2.1-23824 allows remote authenticated users to ob… |
CVE-2018-13290 | Medium | 4.3 | 2019-04-01 | Information exposure vulnerability in SYNO.Core.ACL in Synology Router Manager (SRM) before 1.1.7-6941-2 allows remote authenticated users to determine the exi… |
CVE-2018-13289 | Medium | 5.3 | 2019-04-01 | Information exposure vulnerability in SYNO.FolderSharing.List in Synology Router Manager (SRM) before 1.1.7-6941-2 allows remote attackers to obtain sensitive… |
CVE-2018-13288 | Medium | 5.3 | 2019-04-01 | Information exposure vulnerability in SYNO.FolderSharing.List in Synology File Station before 1.2.3-0252 and before 1.1.5-0125 allows remote attackers to obtai… |
CVE-2018-13287 | Medium | 6.5 | 2019-04-01 | Incorrect default permissions vulnerability in synouser.conf in Synology Router Manager (SRM) before 1.1.7-6941-1 allows remote authenticated users to obtain s… |
CVE-2018-13286 | Medium | 6.5 | 2019-04-01 | Incorrect default permissions vulnerability in synouser.conf in Synology Diskstation Manager (DSM) before 6.2-23739-1 allows remote authenticated users to obta… |
CVE-2018-13285 | High | 7.5 | 2019-04-01 | Command injection vulnerability in ftpd in Synology Router Manager (SRM) before 1.1.7-6941-1 allows remote authenticated users to execute arbitrary OS commands… |
CVE-2018-13284 | High | 7.5 | 2019-04-01 | Command injection vulnerability in ftpd in Synology Diskstation Manager (DSM) before 6.2-23739-1 allows remote authenticated users to execute arbitrary OS comm… |
CVE-2018-13283 | High | 8.8 | 2019-04-01 | Lack of administrator control over security vulnerability in client.cgi in Synology SSL VPN Client before 1.2.5-0226 allows remote attackers to conduct man-in-… |
CVE-2017-16775 | High | 7.1 | 2019-04-01 | Improper restriction of rendered UI layers or frames vulnerability in SSOOauth.cgi in Synology SSO Server before 2.1.3-0129 allows remote attackers to conduct… |
CVE-2017-16774 | Medium | 6.5 | 2019-04-01 | Cross-site scripting (XSS) vulnerability in SYNO.Core.PersonalNotification.Event in Synology DiskStation Manager (DSM) before 6.1.4-15217-3 allows remote authe… |
CVE-2018-8920 | High | 7.2 | 2018-12-24 | Improper neutralization of escape vulnerability in Log Exporter in Synology DiskStation Manager (DSM) before 6.1.6-15266 allows remote attackers to inject arbi… |
CVE-2018-8919 | High | 8.3 | 2018-12-24 | Information exposure vulnerability in SYNO.Core.Desktop.SessionData in Synology DiskStation Manager (DSM) before 6.1.6-15266 allows remote attackers to steal c… |
CVE-2018-8917 | Medium | 6.5 | 2018-12-24 | Cross-site scripting (XSS) vulnerability in info.cgi in Synology DiskStation Manager (DSM) before 6.1.6-15266 allows remote attackers to inject arbitrary web s… |
CVE-2018-8918 | Medium | 6.5 | 2018-12-24 | Cross-site scripting (XSS) vulnerability in info.cgi in Synology Router Manager (SRM) before 1.1.7-6941 allows remote attackers to inject arbitrary web script… |
CVE-2018-1160 | Critical | 9.8 | 2018-12-20 | Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsi_opensess.c. This is due to lack of bounds checking on attacker controlled data. A remote… |
CVE-2018-13282 | Medium | 5.6 | 2018-10-31 | Session fixation vulnerability in SYNO.PhotoStation.Auth in Synology Photo Station before 6.8.7-3481 allows remote attackers to hijack web sessions via the PHP… |
CVE-2018-13281 | Medium | 4.3 | 2018-10-31 | Information exposure vulnerability in SYNO.Core.ACL in Synology DiskStation Manager (DSM) before 6.2-23739-2 allows remote authenticated users to determine the… |
CVE-2018-13280 | High | 7.4 | 2018-07-30 | Use of insufficiently random values vulnerability in SYNO.Encryption.GenRandomKey in Synology DiskStation Manager (DSM) before 6.2-23739 allows man-in-the-midd… |
CVE-2016-6554 | Critical | 9.8 | 2018-07-13 | Synology NAS servers DS107, firmware version 3.1-1639 and prior, and DS116, DS213, firmware versions prior to 5.2-5644-1, use non-random default credentials of… |
CVE-2018-8929 | High | 7.3 | 2018-07-06 | Improper restriction of communication channel to intended endpoints vulnerability in HTTP daemon in Synology SSL VPN Client before 1.2.4-0224 allows remote att… |
CVE-2018-8928 | Medium | 6.5 | 2018-07-05 | Cross-site scripting (XSS) vulnerability in Address Book Editor in Synology CardDAV Server before 6.0.8-0086 allows remote authenticated users to inject arbitr… |
CVE-2017-16773 | Medium | 6.5 | 2018-07-05 | Improper authorization vulnerability in Highlight Preview in Synology Universal Search before 1.0.5-0135 allows remote authenticated users to bypass permission… |
CVE-2018-8927 | Medium | 5.4 | 2018-06-14 | Improper authorization vulnerability in SYNO.Cal.Event in Calendar before 2.1.2-0511 allows remote authenticated users to create arbitrary events via the (1) c… |
CVE-2018-8926 | High | 8.8 | 2018-06-08 | Permissive regular expression vulnerability in synophoto_dsm_user in Synology Photo Station before 6.8.5-3471 and before 6.3-2975 allows remote authenticated u… |
CVE-2018-8925 | High | 8.8 | 2018-06-08 | Cross-site request forgery (CSRF) vulnerability in admin/user.php in Synology Photo Station before 6.8.5-3471 and before 6.3-2975 allows remote attackers to hi… |
CVE-2018-8916 | Medium | 6.3 | 2018-06-08 | Unverified password change vulnerability in Change Password in Synology DiskStation Manager (DSM) before 6.2-23739 allows remote authenticated users to reset p… |
CVE-2017-12078 | High | 7.2 | 2018-06-08 | Command injection vulnerability in EZ-Internet in Synology Router Manager (SRM) before 1.1.6-6931 allows remote authenticated users to execute arbitrary comman… |
CVE-2017-12075 | High | 7.2 | 2018-06-08 | Command injection vulnerability in EZ-Internet in Synology DiskStation Manager (DSM) before 6.2-23739 allows remote authenticated users to execute arbitrary co… |
CVE-2018-8924 | Medium | 6.5 | 2018-06-05 | Cross-site scripting (XSS) vulnerability in Title Tootip in Synology Office before 3.0.3-2143 allows remote authenticated users to inject arbitrary web script… |
CVE-2018-8923 | Medium | 6.5 | 2018-06-05 | Cross-site scripting (XSS) vulnerability in Attachment Preview in Synology File Station before 1.1.4-0122 allows remote authenticated users to inject arbitrary… |
CVE-2018-8922 | Medium | 6.5 | 2018-06-01 | Improper access control vulnerability in Synology Drive before 1.0.2-10275 allows remote authenticated users to access non-shared files or folders via unspecif… |
CVE-2018-8921 | Medium | 6.5 | 2018-06-01 | Cross-site scripting (XSS) vulnerability in File Sharing Notify Toast in Synology Drive before 1.0.2-10275 allows remote authenticated users to inject arbitrar… |
CVE-2018-8915 | Medium | 6.5 | 2018-05-10 | Cross-site scripting (XSS) vulnerability in Notification Center in Synology Calendar before 2.1.1-0502 allows remote authenticated users to inject arbitrary we… |
CVE-2018-8914 | High | 7.3 | 2018-05-10 | SQL injection vulnerability in UPnP DMA in Synology Media Server before 1.7.6-2842 and before 1.4-2654 allows remote attackers to execute arbitrary SQL command… |
CVE-2018-8910 | Medium | 6.5 | 2018-05-10 | Cross-site scripting (XSS) vulnerability in Attachment Preview in Synology Drive before 1.0.1-10253 allows remote authenticated users to inject arbitrary web s… |
CVE-2018-8912 | Medium | 6.5 | 2018-05-09 | Cross-site scripting (XSS) vulnerability in SYNO.NoteStation.Note in Synology Note Station before 2.5.1-0844 allows remote authenticated users to inject arbitr… |
CVE-2018-8911 | Medium | 6.5 | 2018-05-09 | Cross-site scripting (XSS) vulnerability in Attachment Preview in Synology Note Station before 2.5.1-0844 allows remote authenticated users to inject arbitrary… |
CVE-2018-8897 | High | 7.8 | 2018-05-08 | A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the development of some… |
CVE-2017-16772 | High | 8.8 | 2018-03-22 | Improper input validation vulnerability in SYNOPHOTO_Flickr_MultiUpload in Synology Photo Station before 6.8.3-3463 and before 6.3-2971 allows remote authentic… |
CVE-2017-16771 | Medium | 6.1 | 2018-03-22 | Cross-site scripting (XSS) vulnerability in Log Viewer in Synology Photo Station before 6.8.3-3463 and before 6.3-2971 allows remote attackers to inject arbitr… |
CVE-2018-7185 | High | 7.5 | 2018-03-06 | The protocol engine in ntp 4.2.6 before 4.2.8p11 allows a remote attackers to cause a denial of service (disruption) by continually sending a packet with a zer… |
CVE-2018-7184 | High | 7.5 | 2018-03-06 | ntpd in ntp 4.2.8p4 before 4.2.8p11 drops bad packets before updating the "received" timestamp, which allows remote attackers to cause a denial of service (dis… |
CVE-2018-7170 | Medium | 5.3 | 2018-03-06 | ntpd in ntp 4.2.x before 4.2.8p7 and 4.3.x before 4.3.92 allows authenticated users that know the private symmetric key to create arbitrarily-many ephemeral as… |
CVE-2017-16770 | Medium | 6.5 | 2018-02-27 | File and directory information exposure vulnerability in SYNO.SurveillanceStation.PersonalSettings.Photo in Synology Surveillance Station before 8.1.2-5469 all… |
CVE-2017-16767 | Medium | 5.4 | 2018-02-27 | Cross-site scripting (XSS) vulnerability in User Profile in Synology Surveillance Station before 8.1.2-5469 allows remote authenticated users to inject arbitra… |
CVE-2017-16769 | Medium | 5.3 | 2018-02-23 | Exposure of private information vulnerability in Photo Viewer in Synology Photo Station 6.8.1-3458 allows remote attackers to obtain metadata from password-pro… |
CVE-2017-5753 | Medium | 5.6 | 2018-01-04 | Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local u… |
CVE-2017-15892 | Medium | 5.4 | 2017-12-28 | Multiple cross-site scripting (XSS) vulnerabilities in Slash Command Creator in Synology Chat before 2.0.0-1124 allow remote authenticated users to inject arbi… |
CVE-2017-15886 | Medium | 6.5 | 2017-12-28 | Server-side request forgery (SSRF) vulnerability in Link Preview in Synology Chat before 2.0.0-1124 allows remote authenticated users to download arbitrary loc… |
CVE-2017-16768 | Medium | 4.8 | 2017-12-27 | Cross-site scripting (XSS) vulnerability in User Policy editor in Synology MailPlus Server before 1.4.0-0415 allows remote authenticated users to inject arbitr… |
CVE-2017-16766 | Medium | 6.5 | 2017-12-22 | An improper access control vulnerability in synodsmnotify in Synology DiskStation Manager (DSM) before 6.1.4-15217 and before 6.0.3-8754-6 allows local users t… |
CVE-2017-12072 | Medium | 5.4 | 2017-12-20 | Cross-site scripting (XSS) vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.8.0-3456 allows remote authenticated users to inject arbi… |
CVE-2017-15890 | Medium | 4.8 | 2017-12-15 | Cross-site scripting (XSS) vulnerability in Disclaimer in Synology MailPlus Server before 1.4.0-0415 allows remote authenticated users to inject arbitrary web… |
CVE-2017-15895 | Medium | 6.5 | 2017-12-08 | Directory traversal vulnerability in the SYNO.FileStation.Extract in Synology Router Manager (SRM) before 1.1.5-6542-4 allows remote authenticated users to wri… |
CVE-2017-15894 | Medium | 6.5 | 2017-12-08 | Directory traversal vulnerability in the SYNO.FileStation.Extract in Synology DiskStation Manager (DSM) 6.0.x before 6.0.3-8754-3 and before 5.2-5967-6 allows… |
CVE-2017-15893 | Medium | 6.5 | 2017-12-08 | Directory traversal vulnerability in the SYNO.FileStation.Extract in Synology File Station before 1.1.1-0099 allows remote authenticated users to write arbitra… |
CVE-2017-15891 | Medium | 6.5 | 2017-12-08 | Improper access control vulnerability in SYNO.Cal.EventBase in Synology Calendar before 2.0.1-0242 allows remote authenticated users to modify calendar event v… |
CVE-2017-15889 | High | 8.8 | 2017-12-04 | Command injection vulnerability in smart.cgi in Synology DiskStation Manager (DSM) before 5.2-5967-5 allows remote authenticated users to execute arbitrary com… |
CVE-2017-12080 | Medium | 5.3 | 2017-12-04 | An information exposure vulnerability in default HTTP configuration file in Synology Photo Station before 6.8.1-3458 and before 6.3-2970 allows remote attacker… |
CVE-2017-12079 | High | 7.5 | 2017-12-04 | Files or directories accessible to external parties vulnerability in picasa.php in Synology Photo Station before 6.8.1-3458 and before 6.3-2970 allows remote a… |
CVE-2017-15887 | Critical | 9.8 | 2017-11-07 | An improper restriction of excessive authentication attempts vulnerability in /principals in Synology CardDAV Server before 6.0.7-0085 allows remote attackers… |