Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools

synology

Source -

NVDADP

BOS Name -

Synology, Inc.

CNA CVEs -

0

ADP CVEs -

21

CISA CVEs -

0

NVD CVEs -

331
Related CVEsRelated ProductsRelated AssignersReports
332Vulnerabilities found
CVE-2022-27624
Assigner-Synology Inc.
ShareView Details
Assigner-Synology Inc.
CVSS Score-10||CRITICAL
EPSS-1.49% / 71.43%
||
7 Day CHG~0.00%
Published-20 Oct, 2022 | 05:50
Updated-07 May, 2025 | 14:44
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the packet decryption functionality of Out-of-Band (OOB) Management. This allows remote attackers to execute arbitrary commands via unspecified vectors. The following models with Synology DiskStation Manager (DSM) versions before 7.1.1-42962-2 may be affected: DS3622xs+, FS3410, and HD6500.

Action-Not Available
Vendor-Synology, Inc.
Product-diskstation_managerds3622xs\+hd6500fs3410DiskStation Manager (DSM)
CWE ID-CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2022-27625
Assigner-Synology Inc.
ShareView Details
Assigner-Synology Inc.
CVSS Score-10||CRITICAL
EPSS-1.48% / 71.19%
||
7 Day CHG~0.00%
Published-20 Oct, 2022 | 05:50
Updated-07 May, 2025 | 20:50
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the message processing functionality of Out-of-Band (OOB) Management. This allows remote attackers to execute arbitrary commands via unspecified vectors. The following models with Synology DiskStation Manager (DSM) versions before 7.1.1-42962-2 may be affected: DS3622xs+, FS3410, and HD6500.

Action-Not Available
Vendor-Synology, Inc.
Product-diskstation_managerds3622xs\+hd6500fs3410DiskStation Manager (DSM)
CWE ID-CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2022-27626
Assigner-Synology Inc.
ShareView Details
Assigner-Synology Inc.
CVSS Score-10||CRITICAL
EPSS-0.98% / 58.66%
||
7 Day CHG~0.00%
Published-20 Oct, 2022 | 05:50
Updated-08 May, 2025 | 13:42
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A vulnerability regarding concurrent execution using shared resource with improper synchronization ('Race Condition') is found in the session processing functionality of Out-of-Band (OOB) Management. This allows remote attackers to execute arbitrary commands via unspecified vectors. The following models with Synology DiskStation Manager (DSM) versions before 7.1.1-42962-2 may be affected: DS3622xs+, FS3410, and HD6500.

Action-Not Available
Vendor-Synology, Inc.
Product-diskstation_managerds3622xs\+hd6500fs3410DiskStation Manager (DSM)
CWE ID-CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2022-27621
Assigner-Synology Inc.
ShareView Details
Assigner-Synology Inc.
CVSS Score-5.5||MEDIUM
EPSS-0.65% / 47.52%
||
7 Day CHG~0.00%
Published-03 Aug, 2022 | 05:55
Updated-14 Jan, 2025 | 19:29
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology USB Copy before 2.2.0-1086 allows remote authenticated users to read or write arbitrary files via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-diskstation_managerusb_copyUSB Copy
CWE ID-CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2022-27620
Assigner-Synology Inc.
ShareView Details
Assigner-Synology Inc.
CVSS Score-6.8||MEDIUM
EPSS-1.29% / 67.12%
||
7 Day CHG~0.00%
Published-03 Aug, 2022 | 02:55
Updated-14 Jan, 2025 | 19:29
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology SSO Server before 2.2.3-0331 allows remote authenticated users to read arbitrary files via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-diskstation_managersso_serverSSO Server
CWE ID-CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2022-27619
Assigner-Synology Inc.
ShareView Details
Assigner-Synology Inc.
CVSS Score-6.8||MEDIUM
EPSS-0.33% / 25.05%
||
7 Day CHG~0.00%
Published-03 Aug, 2022 | 02:25
Updated-17 Sep, 2024 | 02:46
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Cleartext transmission of sensitive information vulnerability in authentication management in Synology Note Station Client before 2.2.2-609 allows man-in-the-middle attackers to obtain sensitive information via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-note_stationSynology Note Station Client
CWE ID-CWE-319
Cleartext Transmission of Sensitive Information
CVE-2022-27618
Assigner-Synology Inc.
ShareView Details
Assigner-Synology Inc.
CVSS Score-6.8||MEDIUM
EPSS-1.19% / 64.66%
||
7 Day CHG~0.00%
Published-03 Aug, 2022 | 02:20
Updated-14 Jan, 2025 | 19:29
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology Storage Analyzer before 2.1.0-0390 allows remote authenticated users to delete arbitrary files via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-diskstation_managerstorage_analyzerStorage Analyzer
CWE ID-CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2022-27617
Assigner-Synology Inc.
ShareView Details
Assigner-Synology Inc.
CVSS Score-5||MEDIUM
EPSS-0.78% / 52.11%
||
7 Day CHG~0.00%
Published-03 Aug, 2022 | 02:15
Updated-14 Jan, 2025 | 19:29
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology Calendar before 2.3.4-0631 allows remote authenticated users to download arbitrary files via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-diskstation_managercalendarSynology Calendar
CWE ID-CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2022-27616
Assigner-Synology Inc.
ShareView Details
Assigner-Synology Inc.
CVSS Score-7.2||HIGH
EPSS-1.60% / 73.31%
||
7 Day CHG~0.00%
Published-03 Aug, 2022 | 02:10
Updated-14 Jan, 2025 | 19:29
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in webapi component in Synology DiskStation Manager (DSM) before 7.0.1-42218-3 allows remote authenticated users to execute arbitrary commands via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-diskstation_managerDiskStation Manager (DSM)
CWE ID-CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2022-27611
Assigner-Synology Inc.
ShareView Details
Assigner-Synology Inc.
CVSS Score-5.4||MEDIUM
EPSS-0.90% / 55.79%
||
7 Day CHG~0.00%
Published-28 Jul, 2022 | 07:10
Updated-16 Sep, 2024 | 16:58
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology Audio Station before 6.5.4-3367 allows remote authenticated users to delete arbitrary files via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-audio_stationAudio Station
CWE ID-CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2022-27612
Assigner-Synology Inc.
ShareView Details
Assigner-Synology Inc.
CVSS Score-7.3||HIGH
EPSS-0.78% / 52.08%
||
7 Day CHG~0.00%
Published-28 Jul, 2022 | 07:10
Updated-17 Sep, 2024 | 00:45
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in cgi component in Synology Audio Station before 6.5.4-3367 allows remote attackers to execute arbitrary commands via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-audio_stationAudio Station
CWE ID-CWE-120
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
CVE-2022-22683
Assigner-Synology Inc.
ShareView Details
Assigner-Synology Inc.
CVSS Score-10||CRITICAL
EPSS-1.29% / 67.23%
||
7 Day CHG~0.00%
Published-28 Jul, 2022 | 07:00
Updated-14 Jan, 2025 | 19:29
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in cgi component in Synology Media Server before 1.8.1-2876 allows remote attackers to execute arbitrary code via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-diskstation_managermedia_serverrouter_managerMedia Server
CWE ID-CWE-120
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
CVE-2022-27614
Assigner-Synology Inc.
ShareView Details
Assigner-Synology Inc.
CVSS Score-5.3||MEDIUM
EPSS-0.78% / 52.30%
||
7 Day CHG~0.00%
Published-28 Jul, 2022 | 06:55
Updated-14 Jan, 2025 | 19:29
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Exposure of sensitive information to an unauthorized actor vulnerability in web server in Synology Media Server before 1.8.1-2876 allows remote attackers to obtain sensitive information via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-diskstation_managermedia_serverrouter_managerMedia Server
CWE ID-CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
CVE-2022-22685
Assigner-Synology Inc.
ShareView Details
Assigner-Synology Inc.
CVSS Score-8.7||HIGH
EPSS-1.10% / 62.15%
||
7 Day CHG~0.00%
Published-28 Jul, 2022 | 06:45
Updated-17 Sep, 2024 | 01:56
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology WebDAV Server before 2.4.0-0062 allows remote authenticated users to delete arbitrary files via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-webdav_serverWebDAV Server
CWE ID-CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2022-27613
Assigner-Synology Inc.
ShareView Details
Assigner-Synology Inc.
CVSS Score-8.3||HIGH
EPSS-0.91% / 56.38%
||
7 Day CHG~0.00%
Published-28 Jul, 2022 | 06:35
Updated-17 Sep, 2024 | 01:40
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in webapi component in Synology CardDAV Server before 6.0.10-0153 allows remote authenticated users to inject SQL commands via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-carddav_serverCardDAV Server
CWE ID-CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2022-22684
Assigner-Synology Inc.
ShareView Details
Assigner-Synology Inc.
CVSS Score-7.2||HIGH
EPSS-1.52% / 71.91%
||
7 Day CHG~0.00%
Published-28 Jul, 2022 | 06:25
Updated-14 Jan, 2025 | 19:29
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in task management component in Synology DiskStation Manager (DSM) before 6.2.4-25553 allows remote authenticated users to execute arbitrary commands via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-diskstation_managerDiskStation Manager (DSM)
CWE ID-CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2022-27615
Assigner-Synology Inc.
ShareView Details
Assigner-Synology Inc.
CVSS Score-7.7||HIGH
EPSS-1.04% / 60.49%
||
7 Day CHG~0.00%
Published-28 Jul, 2022 | 04:00
Updated-16 Sep, 2024 | 23:16
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in cgi component in Synology DNS Server before 2.2.2-5027 allows remote authenticated users to delete arbitrary files via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-dns_serverDNS Server
CWE ID-CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2022-27610
Assigner-Synology Inc.
ShareView Details
Assigner-Synology Inc.
CVSS Score-6.5||MEDIUM
EPSS-1.33% / 68.14%
||
7 Day CHG~0.00%
Published-27 Jul, 2022 | 08:00
Updated-16 Sep, 2024 | 20:03
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology DiskStation Manager (DSM) before 6.2.3-25423 allows remote authenticated users to delete arbitrary files via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-diskstation_managerDiskStation Manager (DSM)
CWE ID-CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2022-22686
Assigner-Synology Inc.
ShareView Details
Assigner-Synology Inc.
CVSS Score-6.5||MEDIUM
EPSS-0.32% / 24.68%
||
7 Day CHG+0.03%
Published-26 Jul, 2022 | 01:30
Updated-16 Sep, 2024 | 19:14
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Cross-Site Request Forgery (CSRF) vulnerability in webapi component in Synology Calendar before 2.3.4-0631 allows remote authenticated users to hijack the authentication of administrators via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-calendarSynology Calendar
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2022-22682
Assigner-Synology Inc.
ShareView Details
Assigner-Synology Inc.
CVSS Score-6.5||MEDIUM
EPSS-0.53% / 41.36%
||
7 Day CHG~0.00%
Published-12 Jul, 2022 | 06:20
Updated-17 Sep, 2024 | 00:20
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Event Management in Synology Calendar before 2.4.5-10930 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-calendarSynology Calendar
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2022-22681
Assigner-Synology Inc.
ShareView Details
Assigner-Synology Inc.
CVSS Score-8.1||HIGH
EPSS-0.95% / 57.66%
||
7 Day CHG+0.02%
Published-06 Jul, 2022 | 07:35
Updated-16 Sep, 2024 | 16:18
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Session fixation vulnerability in access control management in Synology Photo Station before 6.8.16-3506 allows remote attackers to bypass security constraint via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-photo_stationPhoto Station
CWE ID-CWE-384
Session Fixation
CVE-2022-22687
Assigner-Synology Inc.
ShareView Details
Assigner-Synology Inc.
CVSS Score-9.8||CRITICAL
EPSS-2.28% / 81.36%
||
7 Day CHG~0.00%
Published-25 Mar, 2022 | 06:55
Updated-14 Jan, 2025 | 19:29
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in Authentication functionality in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-diskstation_managerdiskstation_manager_unified_controllerDiskStation Manager (DSM)
CWE ID-CWE-120
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
CVE-2022-22688
Assigner-Synology Inc.
ShareView Details
Assigner-Synology Inc.
CVSS Score-8.8||HIGH
EPSS-1.57% / 72.88%
||
7 Day CHG~0.00%
Published-25 Mar, 2022 | 06:55
Updated-14 Jan, 2025 | 19:29
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Improper neutralization of special elements used in a command ('Command Injection') vulnerability in File service functionality in Synology DiskStation Manager (DSM) before 6.2.4-25556-2 allows remote authenticated users to execute arbitrary commands via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-diskstation_managerDiskStation Manager (DSM)
CWE ID-CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CVE-2021-44142
Assigner-Red Hat, Inc.
ShareView Details
Assigner-Red Hat, Inc.
CVSS Score-8.8||HIGH
EPSS-73.72% / 99.42%
||
7 Day CHG~0.00%
Published-21 Feb, 2022 | 14:30
Updated-23 Apr, 2025 | 19:02
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

The Samba vfs_fruit module uses extended file attributes (EA, xattr) to provide "...enhanced compatibility with Apple SMB clients and interoperability with a Netatalk 3 AFP fileserver." Samba versions prior to 4.13.17, 4.14.12 and 4.15.5 with vfs_fruit configured allow out-of-bounds heap read and write via specially crafted extended file attributes. A remote attacker with write access to extended file attributes can execute arbitrary code with the privileges of smbd, typically root.

Action-Not Available
Vendor-SambaCanonical Ltd.Red Hat, Inc.Fedora ProjectSynology, Inc.Debian GNU/Linux
Product-enterprise_linux_serverubuntu_linuxsambaenterprise_linux_server_update_services_for_sap_solutionsenterprise_linux_server_ausenterprise_linuxvirtualization_hostenterprise_linux_desktopdiskstation_managergluster_storagecodeready_linux_builderenterprise_linux_for_scientific_computingdebian_linuxenterprise_linux_workstationfedoraenterprise_linux_for_ibm_z_systemsenterprise_linux_eusenterprise_linux_for_power_little_endian_eusenterprise_linux_server_tusenterprise_linux_for_power_little_endianenterprise_linux_for_ibm_z_systems_eusenterprise_linux_resilient_storageenterprise_linux_for_power_big_endianSamba
CWE ID-CWE-125
Out-of-bounds Read
CWE ID-CWE-787
Out-of-bounds Write
CVE-2022-22679
Assigner-Synology Inc.
ShareView Details
Assigner-Synology Inc.
CVSS Score-6.5||MEDIUM
EPSS-1.16% / 63.74%
||
7 Day CHG~0.00%
Published-07 Feb, 2022 | 02:15
Updated-14 Jan, 2025 | 19:29
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in support service management in Synology DiskStation Manager (DSM) before 7.0.1-42218-2 allows remote authenticated users to write arbitrary files via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-diskstation_managerDiskStation Manager (DSM)
CWE ID-CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2021-43929
Assigner-Synology Inc.
ShareView Details
Assigner-Synology Inc.
CVSS Score-6.5||MEDIUM
EPSS-0.60% / 44.93%
||
7 Day CHG~0.00%
Published-07 Feb, 2022 | 02:15
Updated-14 Jan, 2025 | 19:29
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in work flow management in Synology DiskStation Manager (DSM) before 7.0.1-42218-2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-diskstation_managerDiskStation Manager (DSM)
CWE ID-CWE-74
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-43928
Assigner-Synology Inc.
ShareView Details
Assigner-Synology Inc.
CVSS Score-9.9||CRITICAL
EPSS-1.86% / 77.09%
||
7 Day CHG~0.00%
Published-07 Feb, 2022 | 02:15
Updated-17 Sep, 2024 | 00:10
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in mail sending and receiving component in Synology Mail Station before 20211105-10315 allows remote authenticated users to execute arbitrary commands via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-mail_stationMail Station
CWE ID-CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2021-43927
Assigner-Synology Inc.
ShareView Details
Assigner-Synology Inc.
CVSS Score-4.7||MEDIUM
EPSS-0.88% / 55.19%
||
7 Day CHG~0.00%
Published-07 Feb, 2022 | 02:15
Updated-14 Jan, 2025 | 19:29
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Security Management functionality in Synology DiskStation Manager (DSM) before 7.0.1-42218-2 allows remote attackers to inject SQL commands via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-diskstation_managerDiskStation Manager (DSM)
CWE ID-CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2021-43926
Assigner-Synology Inc.
ShareView Details
Assigner-Synology Inc.
CVSS Score-4.7||MEDIUM
EPSS-0.88% / 55.19%
||
7 Day CHG~0.00%
Published-07 Feb, 2022 | 02:15
Updated-14 Jan, 2025 | 19:29
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Log Management functionality in Synology DiskStation Manager (DSM) before 7.0.1-42218-2 allows remote attackers to inject SQL commands via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-diskstation_managerDiskStation Manager (DSM)
CWE ID-CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2021-43925
Assigner-Synology Inc.
ShareView Details
Assigner-Synology Inc.
CVSS Score-4.7||MEDIUM
EPSS-0.88% / 55.19%
||
7 Day CHG~0.00%
Published-07 Feb, 2022 | 02:15
Updated-14 Jan, 2025 | 19:29
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Log Management functionality in Synology DiskStation Manager (DSM) before 7.0.1-42218-2 allows remote attackers to inject SQL commands via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-diskstation_managerDiskStation Manager (DSM)
CWE ID-CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2022-22680
Assigner-Synology Inc.
ShareView Details
Assigner-Synology Inc.
CVSS Score-5.3||MEDIUM
EPSS-1.14% / 63.34%
||
7 Day CHG~0.00%
Published-07 Feb, 2022 | 02:10
Updated-14 Jan, 2025 | 19:29
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Exposure of sensitive information to an unauthorized actor vulnerability in Web Server in Synology DiskStation Manager (DSM) before 7.0.1-42218-2 allows remote attackers to obtain sensitive information via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-diskstation_managerDiskStation Manager (DSM)
CWE ID-CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
CVE-2021-29084
Assigner-Synology Inc.
ShareView Details
Assigner-Synology Inc.
CVSS Score-7.5||HIGH
EPSS-1.33% / 68.14%
||
7 Day CHG~0.00%
Published-23 Jun, 2021 | 09:55
Updated-14 Jan, 2025 | 19:29
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in Security Advisor report management component in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to read arbitrary files via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-diskstation_managerdiskstation_manager_unified_controllerDiskStation Manager (DSM)
CWE ID-CWE-74
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CVE-2021-29085
Assigner-Synology Inc.
ShareView Details
Assigner-Synology Inc.
CVSS Score-8.6||HIGH
EPSS-1.33% / 68.14%
||
7 Day CHG~0.00%
Published-23 Jun, 2021 | 09:55
Updated-14 Jan, 2025 | 19:29
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in file sharing management component in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to read arbitrary files via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-diskstation_managerdiskstation_manager_unified_controllerDiskStation Manager (DSM)
CWE ID-CWE-74
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CVE-2021-29087
Assigner-Synology Inc.
ShareView Details
Assigner-Synology Inc.
CVSS Score-7.5||HIGH
EPSS-1.40% / 69.57%
||
7 Day CHG~0.00%
Published-23 Jun, 2021 | 09:55
Updated-14 Jan, 2025 | 19:29
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to write arbitrary files via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-diskstation_managerdiskstation_manager_unified_controllerDiskStation Manager (DSM)
CWE ID-CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2021-27649
Assigner-Synology Inc.
ShareView Details
Assigner-Synology Inc.
CVSS Score-9.8||CRITICAL
EPSS-2.01% / 78.78%
||
7 Day CHG~0.00%
Published-23 Jun, 2021 | 09:50
Updated-14 Jan, 2025 | 19:29
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Use after free vulnerability in file transfer protocol component in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-diskstation_managerdiskstation_manager_unified_controllerDiskStation Manager (DSM)
CWE ID-CWE-416
Use After Free
CVE-2021-29086
Assigner-Synology Inc.
ShareView Details
Assigner-Synology Inc.
CVSS Score-5.3||MEDIUM
EPSS-1.18% / 64.44%
||
7 Day CHG~0.00%
Published-23 Jun, 2021 | 09:50
Updated-14 Jan, 2025 | 19:29
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Exposure of sensitive information to an unauthorized actor vulnerability in webapi component in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to obtain sensitive information via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-diskstation_managerdiskstation_manager_unified_controllerDiskStation Manager (DSM)
CWE ID-CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
CVE-2021-34808
Assigner-Synology Inc.
ShareView Details
Assigner-Synology Inc.
CVSS Score-5.8||MEDIUM
EPSS-1.02% / 59.67%
||
7 Day CHG~0.00%
Published-18 Jun, 2021 | 03:00
Updated-17 Sep, 2024 | 03:47
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Server-Side Request Forgery (SSRF) vulnerability in cgi component in Synology Media Server before 1.8.3-2881 allows remote attackers to access intranet resources via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-media_serverMedia Server
CWE ID-CWE-918
Server-Side Request Forgery (SSRF)
CVE-2021-34809
Assigner-Synology Inc.
ShareView Details
Assigner-Synology Inc.
CVSS Score-9.9||CRITICAL
EPSS-1.93% / 77.93%
||
7 Day CHG~0.00%
Published-18 Jun, 2021 | 03:00
Updated-16 Sep, 2024 | 19:56
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Improper neutralization of special elements used in a command ('Command Injection') vulnerability in task management component in Synology Download Station before 3.8.16-3566 allows remote authenticated users to execute arbitrary code via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-download_stationDownload Station
CWE ID-CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CVE-2021-34810
Assigner-Synology Inc.
ShareView Details
Assigner-Synology Inc.
CVSS Score-9.9||CRITICAL
EPSS-1.37% / 69.02%
||
7 Day CHG~0.00%
Published-18 Jun, 2021 | 03:00
Updated-16 Sep, 2024 | 16:14
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Improper privilege management vulnerability in cgi component in Synology Download Station before 3.8.16-3566 allows remote authenticated users to execute arbitrary code via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-download_stationDownload Station
CWE ID-CWE-269
Improper Privilege Management
CVE-2021-34811
Assigner-Synology Inc.
ShareView Details
Assigner-Synology Inc.
CVSS Score-5||MEDIUM
EPSS-0.76% / 51.62%
||
7 Day CHG~0.00%
Published-18 Jun, 2021 | 03:00
Updated-16 Sep, 2024 | 17:48
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Server-Side Request Forgery (SSRF) vulnerability in task management component in Synology Download Station before 3.8.16-3566 allows remote authenticated users to access intranet resources via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-download_stationDownload Station
CWE ID-CWE-918
Server-Side Request Forgery (SSRF)
CVE-2021-34812
Assigner-Synology Inc.
ShareView Details
Assigner-Synology Inc.
CVSS Score-5.8||MEDIUM
EPSS-1.12% / 62.75%
||
7 Day CHG~0.00%
Published-18 Jun, 2021 | 03:00
Updated-17 Sep, 2024 | 01:31
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Use of hard-coded credentials vulnerability in php component in Synology Calendar before 2.4.0-0761 allows remote attackers to obtain sensitive information via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-calendarSynology Calendar
CWE ID-CWE-798
Use of Hard-coded Credentials
CVE-2021-29089
Assigner-Synology Inc.
ShareView Details
Assigner-Synology Inc.
CVSS Score-9.8||CRITICAL
EPSS-1.93% / 77.87%
||
7 Day CHG~0.00%
Published-02 Jun, 2021 | 02:15
Updated-16 Sep, 2024 | 21:04
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in thumbnail component in Synology Photo Station before 6.8.14-3500 allows remote attackers users to execute arbitrary SQL commands via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-photo_stationSynology Photo Station
CWE ID-CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2021-29090
Assigner-Synology Inc.
ShareView Details
Assigner-Synology Inc.
CVSS Score-7.2||HIGH
EPSS-1.67% / 74.39%
||
7 Day CHG~0.00%
Published-02 Jun, 2021 | 02:00
Updated-17 Sep, 2024 | 03:29
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in PHP component in Synology Photo Station before 6.8.14-3500 allows remote authenticated users to execute arbitrary SQL command via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-photo_stationSynology Photo Station
CWE ID-CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2021-29091
Assigner-Synology Inc.
ShareView Details
Assigner-Synology Inc.
CVSS Score-7.7||HIGH
EPSS-1.14% / 63.35%
||
7 Day CHG~0.00%
Published-02 Jun, 2021 | 02:00
Updated-16 Sep, 2024 | 17:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in file management component in Synology Photo Station before 6.8.14-3500 allows remote authenticated users to write arbitrary files via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-photo_stationSynology Photo Station
CWE ID-CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2021-33181
Assigner-Synology Inc.
ShareView Details
Assigner-Synology Inc.
CVSS Score-6.6||MEDIUM
EPSS-0.97% / 58.27%
||
7 Day CHG~0.00%
Published-01 Jun, 2021 | 09:50
Updated-17 Sep, 2024 | 03:34
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Server-Side Request Forgery (SSRF) vulnerability in webapi component in Synology Video Station before 2.4.10-1632 allows remote authenticated users to send arbitrary request to intranet resources via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-video_stationSynology Video Station
CWE ID-CWE-918
Server-Side Request Forgery (SSRF)
CVE-2021-33182
Assigner-Synology Inc.
ShareView Details
Assigner-Synology Inc.
CVSS Score-5||MEDIUM
EPSS-1.11% / 62.56%
||
7 Day CHG~0.00%
Published-01 Jun, 2021 | 09:50
Updated-14 Jan, 2025 | 19:29
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in PDF Viewer component in Synology DiskStation Manager (DSM) before 6.2.4-25553 allows remote authenticated users to read limited files via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-diskstation_managerSynology DiskStation Manager (DSM)
CWE ID-CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2021-33184
Assigner-Synology Inc.
ShareView Details
Assigner-Synology Inc.
CVSS Score-7.7||HIGH
EPSS-1.00% / 59.17%
||
7 Day CHG~0.00%
Published-01 Jun, 2021 | 09:50
Updated-17 Sep, 2024 | 04:09
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Server-Side request forgery (SSRF) vulnerability in task management component in Synology Download Station before 3.8.15-3563 allows remote authenticated users to read arbitrary files via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-download_stationSynology Download Station
CWE ID-CWE-918
Server-Side Request Forgery (SSRF)
CVE-2021-33183
Assigner-Synology Inc.
ShareView Details
Assigner-Synology Inc.
CVSS Score-7.9||HIGH
EPSS-0.29% / 20.63%
||
7 Day CHG~0.00%
Published-01 Jun, 2021 | 09:50
Updated-17 Sep, 2024 | 03:33
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability container volume management component in Synology Docker before 18.09.0-0515 allows local users to read or write arbitrary files via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-dockerSynology Docker
CWE ID-CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2021-29088
Assigner-Synology Inc.
ShareView Details
Assigner-Synology Inc.
CVSS Score-7.8||HIGH
EPSS-0.32% / 24.00%
||
7 Day CHG~0.00%
Published-01 Jun, 2021 | 09:45
Updated-14 Jan, 2025 | 19:29
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Improper limitation of a pathname to a restricted directory ('Path Traversal') in cgi component in Synology DiskStation Manager (DSM) before 6.2.4-25553 allows local users to execute arbitrary code via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-diskstation_managerSynology DiskStation Manager (DSM)
CWE ID-CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2021-29092
Assigner-Synology Inc.
ShareView Details
Assigner-Synology Inc.
CVSS Score-8.8||HIGH
EPSS-1.75% / 75.45%
||
7 Day CHG~0.00%
Published-01 Jun, 2021 | 09:45
Updated-16 Sep, 2024 | 19:05
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Unrestricted upload of file with dangerous type vulnerability in file management component in Synology Photo Station before 6.8.14-3500 allows remote authenticated users to execute arbitrary code via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-photo_stationSynology Photo Station
CWE ID-CWE-434
Unrestricted Upload of File with Dangerous Type
CVE-2021-33180
Assigner-Synology Inc.
ShareView Details
Assigner-Synology Inc.
CVSS Score-7.3||HIGH
EPSS-0.99% / 58.92%
||
7 Day CHG~0.00%
Published-01 Jun, 2021 | 09:45
Updated-17 Sep, 2024 | 03:34
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in cgi component in Synology Media Server before 1.8.1-2876 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-media_serverSynology Media Server
CWE ID-CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
  • Previous
  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • Next