CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-0854
https://notcve.org/view.php?id=CVE-2024-0854
24 Jan 2024 — URL redirection to untrusted site ('Open Redirect') vulnerability in file access component in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 allows remote authenticated users to conduct phishing attacks via unspecified vectors. La vulnerabilidad de redirección de URL a un sitio que no es de confianza ("Open Redirect") en el componente de acceso a archivos de Synology DiskStation Manager (DSM) anterior a 7.2.1-69057-2 permite a usuarios remotos autenticados realizar ataques de phishing a través de v... • https://www.synology.com/en-global/security/advisory/Synology_SA_24_02 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2022-27622
https://notcve.org/view.php?id=CVE-2022-27622
25 Oct 2022 — Server-Side Request Forgery (SSRF) vulnerability in Package Center functionality in Synology DiskStation Manager (DSM) before 7.1-42661 allows remote authenticated users to access intranet resources via unspecified vectors. Una vulnerabilidad de tipo Server-Side Request Forgery (SSRF) en la funcionalidad Package Center en Synology DiskStation Manager (DSM) versiones anteriores a 7.1-42661, permite a usuarios remotos autenticados acceder a recursos de la intranet por medio de vectores no especificados • https://www.synology.com/security/advisory/Synology_SA_22_18 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 9.4EPSS: 0%CPEs: 1EXPL: 0CVE-2022-27623
https://notcve.org/view.php?id=CVE-2022-27623
25 Oct 2022 — Missing authentication for critical function vulnerability in iSCSI management functionality in Synology DiskStation Manager (DSM) before 7.1-42661 allows remote attackers to read or write arbitrary files via unspecified vectors. Una falta de autenticación para la vulnerabilidad de la función crítica en la funcionalidad iSCSI management en Synology DiskStation Manager (DSM) versiones anteriores a 7.1-42661, permite a atacantes remotos leer o escribir archivos arbitrarios por medio de vectores no especificad... • https://www.synology.com/security/advisory/Synology_SA_22_18 • CWE-306: Missing Authentication for Critical Function •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2022-3576
https://notcve.org/view.php?id=CVE-2022-3576
20 Oct 2022 — A vulnerability regarding out-of-bounds read is found in the session processing functionality of Out-of-Band (OOB) Management. This allows remote attackers to obtain sensitive information via unspecified vectors. The following models with Synology DiskStation Manager (DSM) versions before 7.1.1-42962-2 may be affected: DS3622xs+, FS3410, and HD6500. Se ha encontrado una vulnerabilidad relativa a la lectura fuera de límites en la funcionalidad session processing de Out-of-Band (OOB) Management. Esto permite ... • https://www.synology.com/security/advisory/Synology_SA_22_17 • CWE-125: Out-of-bounds Read •
CVSS: 10.0EPSS: 0%CPEs: 4EXPL: 0CVE-2022-27624
https://notcve.org/view.php?id=CVE-2022-27624
20 Oct 2022 — A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the packet decryption functionality of Out-of-Band (OOB) Management. This allows remote attackers to execute arbitrary commands via unspecified vectors. The following models with Synology DiskStation Manager (DSM) versions before 7.1.1-42962-2 may be affected: DS3622xs+, FS3410, and HD6500. Se ha encontrado una vulnerabilidad relativa a la restricción inapropiada de operaciones dentro de los límites... • https://www.synology.com/security/advisory/Synology_SA_22_17 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 10.0EPSS: 0%CPEs: 4EXPL: 0CVE-2022-27625
https://notcve.org/view.php?id=CVE-2022-27625
20 Oct 2022 — A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the message processing functionality of Out-of-Band (OOB) Management. This allows remote attackers to execute arbitrary commands via unspecified vectors. The following models with Synology DiskStation Manager (DSM) versions before 7.1.1-42962-2 may be affected: DS3622xs+, FS3410, and HD6500. Se ha encontrado una vulnerabilidad relativa a la restricción inapropiada de operaciones dentro de los límite... • https://www.synology.com/security/advisory/Synology_SA_22_17 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 10.0EPSS: 0%CPEs: 4EXPL: 0CVE-2022-27626
https://notcve.org/view.php?id=CVE-2022-27626
20 Oct 2022 — A vulnerability regarding concurrent execution using shared resource with improper synchronization ('Race Condition') is found in the session processing functionality of Out-of-Band (OOB) Management. This allows remote attackers to execute arbitrary commands via unspecified vectors. The following models with Synology DiskStation Manager (DSM) versions before 7.1.1-42962-2 may be affected: DS3622xs+, FS3410, and HD6500. Se ha detectado una vulnerabilidad relativa a la ejecución concurrente usando recursos co... • https://www.synology.com/security/advisory/Synology_SA_22_17 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2022-22684
https://notcve.org/view.php?id=CVE-2022-22684
28 Jul 2022 — Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in task management component in Synology DiskStation Manager (DSM) before 6.2.4-25553 allows remote authenticated users to execute arbitrary commands via unspecified vectors. La neutralización inadecuada de los elementos especiales utilizados en un comando del sistema operativo ("inyección de comandos del sistema operativo") es una vulnerabilidad del componente de gestión de tareas de Synology DiskStatio... • https://www.synology.com/security/advisory/Synology_SA_21_03 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2021-33182
https://notcve.org/view.php?id=CVE-2021-33182
01 Jun 2021 — Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in PDF Viewer component in Synology DiskStation Manager (DSM) before 6.2.4-25553 allows remote authenticated users to read limited files via unspecified vectors. Una vulnerabilidad de limitación inapropiada de un nombre de ruta a un directorio restringido ("Path Traversal") en el componente PDF Viewer en Synology DiskStation Manager (DSM) versiones anteriores a 6.2.4-25553, permite a usuarios autenticados remotos le... • https://www.synology.com/security/advisory/Synology_SA_21_03 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-29088
https://notcve.org/view.php?id=CVE-2021-29088
01 Jun 2021 — Improper limitation of a pathname to a restricted directory ('Path Traversal') in cgi component in Synology DiskStation Manager (DSM) before 6.2.4-25553 allows local users to execute arbitrary code via unspecified vectors. Una vulnerabilidad de limitación inapropiada de un nombre de ruta a un directorio restringido ("Path Traversal") en el componente cgi en Synology DiskStation Manager (DSM) versiones anteriores a 6.2.4-25553 permite a usuarios locales ejecutar código arbitrario por medio de vectores no esp... • https://www.synology.com/security/advisory/Synology_SA_21_03 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •