CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2023-0077
https://notcve.org/view.php?id=CVE-2023-0077
Integer overflow or wraparound vulnerability in CGI component in Synology Router Manager (SRM) before 1.2.5-8227-6 and 1.3.1-9346-3 allows remote attackers to overflow buffers via unspecified vectors. Vulnerabilidad de desbordamiento de enteros o envoltura en el componente CGI en Synology Router Manager (SRM) anterior a 1.2.5-8227-6 y 1.3.1-9346-3 permite a atacantes remotos desbordar búfers a través de vectores no especificados. • https://www.synology.com/en-global/security/advisory/Synology_SA_22_25 •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2022-43932 – Synology RT6600ax Command Injection Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2022-43932
Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in CGI component in Synology Router Manager (SRM) before 1.2.5-8227-6 and 1.3.1-9346-3 allows remote attackers to read arbitrary files via unspecified vectors. La neutralización inadecuada de elementos especiales en la salida utilizada por una vulnerabilidad de componente descendente ("Inyección") en el componente CGI en Synology Router Manager (SRM) anterior a v1.2.5-8227-6 y v1.3.1-9346-3 permite a atacantes remotos leer datos arbitrarios archivos a través de vectores no especificados. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Synology RT6600ax routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the libsynoskd library. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. • https://www.synology.com/en-global/security/advisory/Synology_SA_22_25 •
CVSS: 10.0EPSS: 0%CPEs: 4EXPL: 0CVE-2022-43931
https://notcve.org/view.php?id=CVE-2022-43931
Out-of-bounds write vulnerability in Remote Desktop Functionality in Synology VPN Plus Server before 1.4.3-0534 and 1.4.4-0635 allows remote attackers to execute arbitrary commands via unspecified vectors. • https://www.synology.com/en-global/security/advisory/Synology_SA_22_26 •
CVSS: 10.0EPSS: 0%CPEs: 4EXPL: 0CVE-2022-22683
https://notcve.org/view.php?id=CVE-2022-22683
Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in cgi component in Synology Media Server before 1.8.1-2876 allows remote attackers to execute arbitrary code via unspecified vectors. Una vulnerabilidad de la copia del búfer sin comprobar el tamaño de la entrada ("Desbordamiento de Búfer Clásico") en el componente cgi en Synology Media Server versiones anteriores a 1.8.1-2876, permite a atacantes remotos ejecutar código arbitrario por medio de vectores no especificados • https://www.synology.com/security/advisory/Synology_SA_20_24 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2022-27614
https://notcve.org/view.php?id=CVE-2022-27614
Exposure of sensitive information to an unauthorized actor vulnerability in web server in Synology Media Server before 1.8.1-2876 allows remote attackers to obtain sensitive information via unspecified vectors. Una vulnerabilidad de exposición de información confidencial a un actor no autorizado en el servidor web de Synology Media Server versiones anteriores a 1.8.1-2876, que permite a atacantes remotos obtener información confidencial por medio de vectores no especificados • https://www.synology.com/security/advisory/Synology_SA_20_24 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •