Synology
Page 3 of 4 — Synology CVEs from a corpus of 375, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-26567 | High | 7.8 | 2021-02-26 | Stack-based buffer overflow vulnerability in frontend/main.c in faad2 before 2.2.7.1 allow local attackers to execute arbitrary code via filename and pathname… |
CVE-2021-26566 | High | 8.3 | 2021-02-26 | Insertion of sensitive information into sent data vulnerability in synorelayd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-midd… |
CVE-2021-26565 | High | 8.3 | 2021-02-26 | Cleartext transmission of sensitive information vulnerability in synorelayd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-middle… |
CVE-2021-26564 | High | 8.3 | 2021-02-26 | Cleartext transmission of sensitive information vulnerability in synorelayd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-middle… |
CVE-2021-26563 | High | 8.2 | 2021-02-26 | Incorrect authorization vulnerability in synoagentregisterd in Synology DiskStation Manager (DSM) before 6.2.4-25553 allows local users to execute arbitrary co… |
CVE-2021-26562 | Critical | 9.0 | 2021-02-26 | Out-of-bounds write vulnerability in synoagentregisterd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-middle attackers to execut… |
CVE-2021-26561 | Critical | 9.0 | 2021-02-26 | Stack-based buffer overflow vulnerability in synoagentregisterd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-middle attackers t… |
CVE-2021-26560 | Critical | 9.0 | 2021-02-26 | Cleartext transmission of sensitive information vulnerability in synoagentregisterd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-th… |
CVE-2021-3156 | High | 7.8 | 2021-01-26 | Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" a… |
CVE-2020-27660 | Critical | 9.6 | 2020-11-30 | SQL injection vulnerability in request.cgi in Synology SafeAccess before 1.2.3-0234 allows remote attackers to execute arbitrary SQL commands via the domain pa… |
CVE-2020-27659 | High | 8.4 | 2020-11-30 | Multiple cross-site scripting (XSS) vulnerabilities in Synology SafeAccess before 1.2.3-0234 allow remote attackers to inject arbitrary web script or HTML via… |
CVE-2020-27658 | High | 7.1 | 2020-10-29 | Synology Router Manager (SRM) before 1.2.4-8081 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for rem… |
CVE-2020-27657 | Medium | 6.5 | 2020-10-29 | Cleartext transmission of sensitive information vulnerability in DDNS in Synology Router Manager (SRM) before 1.2.4-8081 allows man-in-the-middle attackers to… |
CVE-2020-27656 | Medium | 6.5 | 2020-10-29 | Cleartext transmission of sensitive information vulnerability in DDNS in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-in-the-middle attac… |
CVE-2020-27655 | Medium | 6.5 | 2020-10-29 | Improper access control vulnerability in Synology Router Manager (SRM) before 1.2.4-8081 allows remote attackers to access restricted resources via inbound Qui… |
CVE-2020-27654 | Critical | 9.8 | 2020-10-29 | Improper access control vulnerability in lbd in Synology Router Manager (SRM) before 1.2.4-8081 allows remote attackers to execute arbitrary commands via port… |
CVE-2020-27653 | High | 8.3 | 2020-10-29 | Algorithm downgrade vulnerability in QuickConnect in Synology Router Manager (SRM) before 1.2.4-8081 allows man-in-the-middle attackers to spoof servers and ob… |
CVE-2020-27652 | High | 8.3 | 2020-10-29 | Algorithm downgrade vulnerability in QuickConnect in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-in-the-middle attackers to spoof server… |
CVE-2020-27651 | Medium | 5.8 | 2020-10-29 | Synology Router Manager (SRM) before 1.2.4-8081 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attac… |
CVE-2020-27650 | Medium | 5.8 | 2020-10-29 | Synology DiskStation Manager (DSM) before 6.2.3-25426-2 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remo… |
CVE-2020-27649 | High | 8.3 | 2020-10-29 | Improper certificate validation vulnerability in OpenVPN client in Synology Router Manager (SRM) before 1.2.4-8081 allows man-in-the-middle attackers to spoof… |
CVE-2020-27648 | High | 8.3 | 2020-10-29 | Improper certificate validation vulnerability in OpenVPN client in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-in-the-middle attackers t… |
CVE-2020-8623 | High | 7.5 | 2020-08-21 | In BIND 9.10.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.10.5-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker that c… |
CVE-2020-8622 | Medium | 6.5 | 2020-08-21 | In BIND 9.0.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker on the n… |
CVE-2020-8621 | High | 7.5 | 2020-08-21 | In BIND 9.14.0 -> 9.16.5, 9.17.0 -> 9.17.3, If a server is configured with both QNAME minimization and 'forward first' then an attacker who can send queries to… |
CVE-2020-1472 | Medium | 5.5 | 2020-08-17 | An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the N… |
CVE-2019-11823 | High | 8.6 | 2020-05-04 | CRLF injection vulnerability in Network Center in Synology Router Manager (SRM) before 1.2.3-8017-2 allows remote attackers to cause a denial of service (out-o… |
CVE-2019-9502 | High | 7.9 | 2020-02-03 | The Broadcom wl WiFi driver is vulnerable to a heap buffer overflow. If the vendor information element data length is larger than 164 bytes, a heap buffer over… |
CVE-2019-9501 | High | 7.9 | 2020-02-03 | The Broadcom wl WiFi driver is vulnerable to a heap buffer overflow. By supplying a vendor information element with a data length larger than 32 bytes, a heap… |
CVE-2019-19344 | Medium | 6.5 | 2020-01-21 | There is a use-after-free issue in all samba 4.9.x versions before 4.9.18, all samba 4.10.x versions before 4.10.12 and all samba 4.11.x versions before 4.11.5… |
CVE-2019-14907 | Medium | 6.5 | 2020-01-21 | All samba versions 4.9.x before 4.9.18, 4.10.x before 4.10.12 and 4.11.x before 4.11.5 have an issue where if it is set with "log level = 3" (or above) then th… |
CVE-2019-9518 | High | 7.5 | 2019-08-13 | Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service. The attacker sends a stream of frames with a… |
CVE-2019-9517 | High | 7.5 | 2019-08-13 | Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service. The attacker opens the HTTP/2 w… |
CVE-2019-9516 | Medium | 6.5 | 2019-08-13 | Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length… |
CVE-2019-9515 | High | 7.5 | 2019-08-13 | Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to t… |
CVE-2019-9514 | High | 7.5 | 2019-08-13 | Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an in… |
CVE-2019-9513 | High | 7.5 | 2019-08-13 | Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and con… |
CVE-2019-9511 | High | 7.5 | 2019-08-13 | Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The… |
CVE-2019-11829 | High | 7.3 | 2019-06-30 | OS command injection vulnerability in drivers_syno_import_user.php in Synology Calendar before 2.3.1-0617 allows remote attackers to execute arbitrary commands… |
CVE-2019-11828 | Medium | 5.5 | 2019-06-30 | Cross-site scripting (XSS) vulnerability in Chart in Synology Office before 3.1.4-2771 allows remote authenticated users to inject arbitrary web script or HTML… |
CVE-2019-11827 | Medium | 6.5 | 2019-06-30 | Cross-site scripting (XSS) vulnerability in SYNO.NoteStation.Shard in Synology Note Station before 2.5.3-0863 allows remote attackers to inject arbitrary web s… |
CVE-2019-11826 | High | 8.0 | 2019-06-30 | Relative path traversal vulnerability in SYNO.PhotoTeam.Upload.Item in Synology Moments before 1.3.0-0691 allows remote authenticated users to upload arbitrary… |
CVE-2019-11825 | Medium | 6.5 | 2019-06-30 | Cross-site scripting (XSS) vulnerability in Event Editor in Synology Calendar before 2.3.0-0615 allows remote attackers to inject arbitrary web script or HTML… |
CVE-2019-11822 | Medium | 4.3 | 2019-06-30 | Relative path traversal vulnerability in SYNO.PhotoStation.File in Synology Photo Station before 6.8.11-3489 and before 6.3-2977 allows remote attackers to upl… |
CVE-2019-11821 | High | 7.3 | 2019-06-30 | SQL injection vulnerability in synophoto_csPhotoDB.php in Synology Photo Station before 6.8.11-3489 and before 6.3-2977 allows remote attackers to execute arbi… |
CVE-2019-11820 | Medium | 5.5 | 2019-05-09 | Information exposure through process environment vulnerability in Synology Calendar before 2.3.3-0620 allows local users to obtain credentials via cmdline. |
CVE-2019-9499 | High | 8.1 | 2019-04-17 | The implementations of EAP-PWD in wpa_supplicant EAP Peer, when built against a crypto library missing explicit validation on imported elements, do not validat… |
CVE-2019-9498 | High | 8.1 | 2019-04-17 | The implementations of EAP-PWD in hostapd EAP Server, when built against a crypto library missing explicit validation on imported elements, do not validate the… |
CVE-2019-9495 | Low | 3.7 | 2019-04-17 | The implementations of EAP-PWD in hostapd and wpa_supplicant are vulnerable to side-channel attacks as a result of cache access patterns. All versions of hosta… |
CVE-2019-9494 | Medium | 5.9 | 2019-04-17 | The implementations of SAE in hostapd and wpa_supplicant are vulnerable to side channel attacks as a result of observable timing differences and cache access p… |
CVE-2019-3870 | Medium | 6.1 | 2019-04-09 | A vulnerability was found in Samba from version (including) 4.9 to versions before 4.9.6 and 4.10.2. During the creation of a new Samba AD DC, files are create… |
CVE-2018-8913 | High | 7.1 | 2019-04-01 | Missing custom error page vulnerability in Synology Web Station before 2.1.3-0139 allows remote attackers to conduct phishing attacks via a crafted URL. |
CVE-2018-13299 | Medium | 4.3 | 2019-04-01 | Relative path traversal vulnerability in Attachment Uploader in Synology Calendar before 2.2.2-0532 allows remote authenticated users to upload arbitrary files… |
CVE-2018-13298 | Medium | 4.2 | 2019-04-01 | Channel accessible by non-endpoint vulnerability in privacy page in Synology Android Moments before 1.2.3-199 allows man-in-the-middle attackers to execute arb… |
CVE-2018-13297 | Medium | 5.3 | 2019-04-01 | Information exposure vulnerability in SYNO.SynologyDrive.Files in Synology Drive before 1.1.2-10562 allows remote attackers to obtain sensitive system informat… |
CVE-2018-13296 | High | 7.5 | 2019-04-01 | Uncontrolled resource consumption vulnerability in TLS configuration in Synology MailPlus Server before 2.0.5-0606 allows remote attackers to conduct denial-of… |
CVE-2018-13295 | Medium | 4.3 | 2019-04-01 | Information exposure vulnerability in SYNO.Personal.Application.Info in Synology Application Service before 1.5.4-0320 allows remote authenticated users to obt… |
CVE-2018-13294 | Medium | 4.3 | 2019-04-01 | Information exposure vulnerability in SYNO.Personal.Profile in Synology Application Service before 1.5.4-0320 allows remote authenticated users to obtain sensi… |
CVE-2018-13293 | Medium | 5.9 | 2019-04-01 | Cross-site scripting (XSS) vulnerability in Control Panel SSO Settings in Synology DiskStation Manager (DSM) before 6.2.1-23824 allows remote authenticated use… |
CVE-2018-13292 | Medium | 4.3 | 2019-04-01 | Information exposure vulnerability in /usr/syno/etc/mount.conf in Synology Router Manager (SRM) before 1.1.7-6941-2 allows remote authenticated users to obtain… |
CVE-2018-13291 | Medium | 4.3 | 2019-04-01 | Information exposure vulnerability in /usr/syno/etc/mount.conf in Synology DiskStation Manager (DSM) before 6.2.1-23824 allows remote authenticated users to ob… |
CVE-2018-13290 | Medium | 4.3 | 2019-04-01 | Information exposure vulnerability in SYNO.Core.ACL in Synology Router Manager (SRM) before 1.1.7-6941-2 allows remote authenticated users to determine the exi… |
CVE-2018-13289 | Medium | 5.3 | 2019-04-01 | Information exposure vulnerability in SYNO.FolderSharing.List in Synology Router Manager (SRM) before 1.1.7-6941-2 allows remote attackers to obtain sensitive… |
CVE-2018-13288 | Medium | 5.3 | 2019-04-01 | Information exposure vulnerability in SYNO.FolderSharing.List in Synology File Station before 1.2.3-0252 and before 1.1.5-0125 allows remote attackers to obtai… |
CVE-2018-13287 | Medium | 6.5 | 2019-04-01 | Incorrect default permissions vulnerability in synouser.conf in Synology Router Manager (SRM) before 1.1.7-6941-1 allows remote authenticated users to obtain s… |
CVE-2018-13286 | Medium | 6.5 | 2019-04-01 | Incorrect default permissions vulnerability in synouser.conf in Synology Diskstation Manager (DSM) before 6.2-23739-1 allows remote authenticated users to obta… |
CVE-2018-13285 | High | 7.5 | 2019-04-01 | Command injection vulnerability in ftpd in Synology Router Manager (SRM) before 1.1.7-6941-1 allows remote authenticated users to execute arbitrary OS commands… |
CVE-2018-13284 | High | 7.5 | 2019-04-01 | Command injection vulnerability in ftpd in Synology Diskstation Manager (DSM) before 6.2-23739-1 allows remote authenticated users to execute arbitrary OS comm… |
CVE-2018-13283 | High | 8.8 | 2019-04-01 | Lack of administrator control over security vulnerability in client.cgi in Synology SSL VPN Client before 1.2.5-0226 allows remote attackers to conduct man-in-… |
CVE-2017-16775 | High | 7.1 | 2019-04-01 | Improper restriction of rendered UI layers or frames vulnerability in SSOOauth.cgi in Synology SSO Server before 2.1.3-0129 allows remote attackers to conduct… |
CVE-2017-16774 | Medium | 6.5 | 2019-04-01 | Cross-site scripting (XSS) vulnerability in SYNO.Core.PersonalNotification.Event in Synology DiskStation Manager (DSM) before 6.1.4-15217-3 allows remote authe… |
CVE-2018-8920 | High | 7.2 | 2018-12-24 | Improper neutralization of escape vulnerability in Log Exporter in Synology DiskStation Manager (DSM) before 6.1.6-15266 allows remote attackers to inject arbi… |
CVE-2018-8919 | High | 8.3 | 2018-12-24 | Information exposure vulnerability in SYNO.Core.Desktop.SessionData in Synology DiskStation Manager (DSM) before 6.1.6-15266 allows remote attackers to steal c… |
CVE-2018-8917 | Medium | 6.5 | 2018-12-24 | Cross-site scripting (XSS) vulnerability in info.cgi in Synology DiskStation Manager (DSM) before 6.1.6-15266 allows remote attackers to inject arbitrary web s… |
CVE-2018-8918 | Medium | 6.5 | 2018-12-24 | Cross-site scripting (XSS) vulnerability in info.cgi in Synology Router Manager (SRM) before 1.1.7-6941 allows remote attackers to inject arbitrary web script… |
CVE-2018-1160 | Critical | 9.8 | 2018-12-20 | Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsi_opensess.c. This is due to lack of bounds checking on attacker controlled data. A remote… |
CVE-2018-13282 | Medium | 5.6 | 2018-10-31 | Session fixation vulnerability in SYNO.PhotoStation.Auth in Synology Photo Station before 6.8.7-3481 allows remote attackers to hijack web sessions via the PHP… |
CVE-2018-13281 | Medium | 4.3 | 2018-10-31 | Information exposure vulnerability in SYNO.Core.ACL in Synology DiskStation Manager (DSM) before 6.2-23739-2 allows remote authenticated users to determine the… |
CVE-2018-13280 | High | 7.4 | 2018-07-30 | Use of insufficiently random values vulnerability in SYNO.Encryption.GenRandomKey in Synology DiskStation Manager (DSM) before 6.2-23739 allows man-in-the-midd… |
CVE-2016-6554 | Critical | 9.8 | 2018-07-13 | Synology NAS servers DS107, firmware version 3.1-1639 and prior, and DS116, DS213, firmware versions prior to 5.2-5644-1, use non-random default credentials of… |
CVE-2018-8929 | High | 7.3 | 2018-07-06 | Improper restriction of communication channel to intended endpoints vulnerability in HTTP daemon in Synology SSL VPN Client before 1.2.4-0224 allows remote att… |
CVE-2018-8928 | Medium | 6.5 | 2018-07-05 | Cross-site scripting (XSS) vulnerability in Address Book Editor in Synology CardDAV Server before 6.0.8-0086 allows remote authenticated users to inject arbitr… |
CVE-2017-16773 | Medium | 6.5 | 2018-07-05 | Improper authorization vulnerability in Highlight Preview in Synology Universal Search before 1.0.5-0135 allows remote authenticated users to bypass permission… |
CVE-2018-8927 | Medium | 5.4 | 2018-06-14 | Improper authorization vulnerability in SYNO.Cal.Event in Calendar before 2.1.2-0511 allows remote authenticated users to create arbitrary events via the (1) c… |
CVE-2018-8926 | High | 8.8 | 2018-06-08 | Permissive regular expression vulnerability in synophoto_dsm_user in Synology Photo Station before 6.8.5-3471 and before 6.3-2975 allows remote authenticated u… |
CVE-2018-8925 | High | 8.8 | 2018-06-08 | Cross-site request forgery (CSRF) vulnerability in admin/user.php in Synology Photo Station before 6.8.5-3471 and before 6.3-2975 allows remote attackers to hi… |
CVE-2018-8916 | Medium | 6.3 | 2018-06-08 | Unverified password change vulnerability in Change Password in Synology DiskStation Manager (DSM) before 6.2-23739 allows remote authenticated users to reset p… |
CVE-2017-12078 | High | 7.2 | 2018-06-08 | Command injection vulnerability in EZ-Internet in Synology Router Manager (SRM) before 1.1.6-6931 allows remote authenticated users to execute arbitrary comman… |
CVE-2017-12075 | High | 7.2 | 2018-06-08 | Command injection vulnerability in EZ-Internet in Synology DiskStation Manager (DSM) before 6.2-23739 allows remote authenticated users to execute arbitrary co… |
CVE-2018-8924 | Medium | 6.5 | 2018-06-05 | Cross-site scripting (XSS) vulnerability in Title Tootip in Synology Office before 3.0.3-2143 allows remote authenticated users to inject arbitrary web script… |
CVE-2018-8923 | Medium | 6.5 | 2018-06-05 | Cross-site scripting (XSS) vulnerability in Attachment Preview in Synology File Station before 1.1.4-0122 allows remote authenticated users to inject arbitrary… |
CVE-2018-8922 | Medium | 6.5 | 2018-06-01 | Improper access control vulnerability in Synology Drive before 1.0.2-10275 allows remote authenticated users to access non-shared files or folders via unspecif… |
CVE-2018-8921 | Medium | 6.5 | 2018-06-01 | Cross-site scripting (XSS) vulnerability in File Sharing Notify Toast in Synology Drive before 1.0.2-10275 allows remote authenticated users to inject arbitrar… |
CVE-2018-8915 | Medium | 6.5 | 2018-05-10 | Cross-site scripting (XSS) vulnerability in Notification Center in Synology Calendar before 2.1.1-0502 allows remote authenticated users to inject arbitrary we… |
CVE-2018-8914 | High | 7.3 | 2018-05-10 | SQL injection vulnerability in UPnP DMA in Synology Media Server before 1.7.6-2842 and before 1.4-2654 allows remote attackers to execute arbitrary SQL command… |
CVE-2018-8910 | Medium | 6.5 | 2018-05-10 | Cross-site scripting (XSS) vulnerability in Attachment Preview in Synology Drive before 1.0.1-10253 allows remote authenticated users to inject arbitrary web s… |
CVE-2018-8912 | Medium | 6.5 | 2018-05-09 | Cross-site scripting (XSS) vulnerability in SYNO.NoteStation.Note in Synology Note Station before 2.5.1-0844 allows remote authenticated users to inject arbitr… |
CVE-2018-8911 | Medium | 6.5 | 2018-05-09 | Cross-site scripting (XSS) vulnerability in Attachment Preview in Synology Note Station before 2.5.1-0844 allows remote authenticated users to inject arbitrary… |
CVE-2018-8897 | High | 7.8 | 2018-05-08 | A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the development of some… |
CVE-2017-16772 | High | 8.8 | 2018-03-22 | Improper input validation vulnerability in SYNOPHOTO_Flickr_MultiUpload in Synology Photo Station before 6.8.3-3463 and before 6.3-2971 allows remote authentic… |