CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 2CVE-2020-27660
https://notcve.org/view.php?id=CVE-2020-27660
SQL injection vulnerability in request.cgi in Synology SafeAccess before 1.2.3-0234 allows remote attackers to execute arbitrary SQL commands via the domain parameter. Una vulnerabilidad de inyección SQL en el archivo request.cgi en Synology SafeAccess versiones anteriores a 1.2.3-0234, permite a atacantes remotos ejecutar comandos SQL arbitrarios por medio del parámetro domain • https://github.com/thomasfady/Synology_SA_20_25 https://www.synology.com/security/advisory/Synology_SA_20_25 https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1087 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.4EPSS: 0%CPEs: 1EXPL: 2CVE-2020-27659
https://notcve.org/view.php?id=CVE-2020-27659
Multiple cross-site scripting (XSS) vulnerabilities in Synology SafeAccess before 1.2.3-0234 allow remote attackers to inject arbitrary web script or HTML via the (1) domain or (2) profile parameter. Múltiples vulnerabilidades de tipo cross-site scripting (XSS) en Synology SafeAccess versiones anteriores a 1.2.3-0234, permiten a atacantes remotos inyectar script web o HTML arbitrario por medio del parámetro (1) domain o (2) profile • https://github.com/thomasfady/Synology_SA_20_25 https://www.synology.com/security/advisory/Synology_SA_20_25 https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1087 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2020-27656
https://notcve.org/view.php?id=CVE-2020-27656
Cleartext transmission of sensitive information vulnerability in DDNS in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-in-the-middle attackers to eavesdrop authentication information of DNSExit via unspecified vectors. Una vulnerabilidad de transmisión de información confidencial en texto sin cifrar en DDNS en Synology DiskStation Manager (DSM) versiones anteriores a 6.2.3-25426-2, permite a atacantes de tipo man-in-the-middle rastrear una información de autenticación de DNSExit por medio de vectores no especificados • https://www.synology.com/security/advisory/Synology_SA_20_18 https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1071 • CWE-319: Cleartext Transmission of Sensitive Information •
CVSS: 8.3EPSS: 0%CPEs: 3EXPL: 1CVE-2020-27652
https://notcve.org/view.php?id=CVE-2020-27652
Algorithm downgrade vulnerability in QuickConnect in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-in-the-middle attackers to spoof servers and obtain sensitive information via unspecified vectors. Una vulnerabilidad de degradación del Algoritmo en QuickConnect en Synology DiskStation Manager (DSM) versiones anteriores a 6.2.3-25426-2, permite a atacantes de tipo man-in-the-middle falsificar servidores y obtener información confidencial por medio de vectores no especificados • https://www.synology.com/security/advisory/Synology_SA_20_18 https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1061 • CWE-327: Use of a Broken or Risky Cryptographic Algorithm •
CVSS: 5.8EPSS: 0%CPEs: 3EXPL: 0CVE-2020-27650
https://notcve.org/view.php?id=CVE-2020-27650
Synology DiskStation Manager (DSM) before 6.2.3-25426-2 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session. Synology DiskStation Manager (DSM) versiones anteriores a 6.2.3-25426-2 no establece el flag Secure para la cookie de sesión en una sesión HTTPS, lo que hace más fácil a atacantes remotos capturar esta cookie al interceptar su transmisión dentro de una sesión HTTP • https://www.synology.com/security/advisory/Synology_SA_20_18 • CWE-311: Missing Encryption of Sensitive Data CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute •