CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0CVE-2018-13286
https://notcve.org/view.php?id=CVE-2018-13286
Incorrect default permissions vulnerability in synouser.conf in Synology Diskstation Manager (DSM) before 6.2-23739-1 allows remote authenticated users to obtain sensitive information via the world readable configuration. Una vulnerabilidad de permisos por defecto incorrectos en synouser.conf en Synology Diskstation Manager (DSM), en versiones anteriores a la 6.2-23739-1, permite a los usuarios remotos autenticados obtener información sensible mediante la configuración de lectura global. • https://www.synology.com/security/advisory/Synology_SA_18_33 • CWE-276: Incorrect Default Permissions •
CVSS: 9.0EPSS: 0%CPEs: 4EXPL: 0CVE-2018-13284
https://notcve.org/view.php?id=CVE-2018-13284
Command injection vulnerability in ftpd in Synology Diskstation Manager (DSM) before 6.2-23739-1 allows remote authenticated users to execute arbitrary OS commands via the (1) MKD or (2) RMD command. Una vulnerabilidad de inyección de comandos en ftpd en Synology Diskstation Manager (DSM), en versiones anteriores a la 6.2-23739-1, permite a los usuarios remotos autenticados ejecutar comandos arbitrarios del sistema operativo mediante los comandos (1) MKD o (2) RMD. • https://www.synology.com/security/advisory/Synology_SA_18_33 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 10.0EPSS: 90%CPEs: 9EXPL: 6CVE-2018-1160 – Netatalk 3.1.12 - Authentication Bypass (PoC)
https://notcve.org/view.php?id=CVE-2018-1160
Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsi_opensess.c. This is due to lack of bounds checking on attacker controlled data. A remote unauthenticated attacker can leverage this vulnerability to achieve arbitrary code execution. Netatalk, en versiones anteriores a la 3.1.12, es vulnerable a una escritura fuera de límites en dsi_opensess.c. Esto se debe a la falta de comprobación de límites de los datos controlados por el atacante. • https://www.exploit-db.com/exploits/46048 https://www.exploit-db.com/exploits/46034 https://www.exploit-db.com/exploits/46675 https://github.com/SachinThanushka/CVE-2018-1160 http://netatalk.sourceforge.net/3.1/ReleaseNotes3.1.12.html http://packetstormsecurity.com/files/152440/QNAP-Netatalk-Authentication-Bypass.html http://www.securityfocus.com/bid/106301 https://attachments.samba.org/attachment.cgi?id=14735 https://github.com/tenable/poc/tree/master/netatalk/cve_2018_1160 https:/ • CWE-787: Out-of-bounds Write •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 0CVE-2018-13281
https://notcve.org/view.php?id=CVE-2018-13281
Information exposure vulnerability in SYNO.Core.ACL in Synology DiskStation Manager (DSM) before 6.2-23739-2 allows remote authenticated users to determine the existence and obtain the metadata of arbitrary files via the file_path parameter. Vulnerabilidad de exposición de información en SYNO.Core.ACL en Synology DiskStation Manager (DSM) en versiones anteriores a la 6.2-23739-2 permite que usuarios autenticados remotos determinen la existencia y obtengan los metadatos de archivos arbitrarios mediante el parámetro file_path. • https://www.synology.com/en-global/support/security/Synology_SA_18_36 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.4EPSS: 0%CPEs: 1EXPL: 0CVE-2018-13280
https://notcve.org/view.php?id=CVE-2018-13280
Use of insufficiently random values vulnerability in SYNO.Encryption.GenRandomKey in Synology DiskStation Manager (DSM) before 6.2-23739 allows man-in-the-middle attackers to compromise non-HTTPS sessions via unspecified vectors. Vulnerabilidad de uso de valores insuficientemente aleatorios en SYNO.Encryption.GenRandomKey en Synology DiskStation Manager (DSM) en versiones anteriores a la 6.2-23739 permite que atacantes Man-in-the-Middle (MitM) comprometan sesiones que no son HTTPS mediante vectores sin especificar. • https://www.synology.com/en-global/support/security/Synology_SA_18_39 • CWE-330: Use of Insufficiently Random Values •