Note:
This project will be discontinued after December 13, 2021. [more]
Product:
Diskstation_manager
(Synology)| Repositories | https://github.com/torvalds/linux |
| #Vulnerabilities | 88 |
| Date | Id | Summary | Products | Score | Patch | Annotated |
|---|---|---|---|---|---|---|
| 2021-06-23 | CVE-2021-29087 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to write arbitrary files via unspecified vectors. | Diskstation_manager, Diskstation_manager_unified_controller | 7.5 | ||
| 2021-06-01 | CVE-2021-29088 | Improper limitation of a pathname to a restricted directory ('Path Traversal') in cgi component in Synology DiskStation Manager (DSM) before 6.2.4-25553 allows local users to execute arbitrary code via unspecified vectors. | Diskstation_manager | 7.8 | ||
| 2021-06-01 | CVE-2021-33182 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in PDF Viewer component in Synology DiskStation Manager (DSM) before 6.2.4-25553 allows remote authenticated users to read limited files via unspecified vectors. | Diskstation_manager | 4.3 | ||
| 2018-12-24 | CVE-2018-8920 | Improper neutralization of escape vulnerability in Log Exporter in Synology DiskStation Manager (DSM) before 6.1.6-15266 allows remote attackers to inject arbitrary content to have an unspecified impact by exporting an archive in CSV format. | Diskstation_manager | 7.2 | ||
| 2021-02-26 | CVE-2021-26565 | Cleartext transmission of sensitive information vulnerability in synorelayd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-middle attackers to obtain sensitive information via an HTTP session. | Diskstation_manager, Diskstation_manager_unified_controller, Skynas_firmware, Vs960hd_firmware | 5.9 | ||
| 2021-04-01 | CVE-2021-29083 | Improper neutralization of special elements used in an OS command in SYNO.Core.Network.PPPoE in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote authenticated users to execute arbitrary code via realname parameter. | Diskstation_manager | 7.2 | ||
| 2021-03-12 | CVE-2021-27647 | Out-of-bounds Read vulnerability in iscsi_snapshot_comm_core in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via crafted web requests. | Diskstation_manager | 9.8 | ||
| 2021-03-12 | CVE-2021-27646 | Use After Free vulnerability in iscsi_snapshot_comm_core in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via crafted web requests. | Diskstation_manager | 9.8 | ||
| 2020-10-29 | CVE-2020-27648 | Improper certificate validation vulnerability in OpenVPN client in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. | Diskstation_manager, Skynas_firmware | 9.0 | ||
| 2020-10-29 | CVE-2020-27650 | Synology DiskStation Manager (DSM) before 6.2.3-25426-2 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session. | Diskstation_manager, Skynas_firmware | 3.7 |