Page 5 of 47 results (0.004 seconds)

CVSS: 5.6EPSS: 94%CPEs: 1467EXPL: 10

CVE-2017-5753 – Multiple CPUs - 'Spectre' Information Disclosure

https://notcve.org/view.php?id=CVE-2017-5753

04 Jan 2018 — Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis. Los sistemas con microprocesadores con ejecución especulativa y predicción de ramas podrían permitir la revelación no autorizada de información al atacante con acceso de usuario local mediante un análisis de un canal lateral. An industry-wide issue was found in the way many modern microprocessor designs have imp... • https://packetstorm.news/files/id/145645 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-203: Observable Discrepancy •

CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0

CVE-2017-15894

https://notcve.org/view.php?id=CVE-2017-15894

08 Dec 2017 — Directory traversal vulnerability in the SYNO.FileStation.Extract in Synology DiskStation Manager (DSM) 6.0.x before 6.0.3-8754-3 and before 5.2-5967-6 allows remote authenticated users to write arbitrary files via the dest_folder_path parameter. Una vulnerabilidad de salto de directorio en SYNO.FileStation.Extract en Synology DiskStation Manager (DSM) en versiones 6.0.x anteriores a la 6.0.3-8754-3 y anteriores a la 5.2-5967-6 permite que usuarios remotos autenticados escriban archivos arbitrarios mediante... • https://www.synology.com/en-global/support/security/Synology_SA_17_70_DSM • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •

CVSS: 10.0EPSS: 68%CPEs: 54EXPL: 4

CVE-2017-14491 – Dnsmasq < 2.78 - 2-byte Heap Overflow

https://notcve.org/view.php?id=CVE-2017-14491

02 Oct 2017 — Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response. Un desbordamiento de búfer basado en memoria dinámica (heap) en dnsmasq en versiones anteriores a la 2.78 permite a los atacantes provocar una denegación de servicio (cierre inesperado) o ejecutar código arbitrario utilizando una respuesta DNS manipulada. A heap buffer overflow was found in dnsmasq in the code responsible for building DNS replie... • https://packetstorm.news/files/id/144480 • CWE-122: Heap-based Buffer Overflow CWE-787: Out-of-bounds Write •

CVSS: 4.9EPSS: 0%CPEs: 2EXPL: 0

CVE-2017-12076

https://notcve.org/view.php?id=CVE-2017-12076

28 Aug 2017 — Uncontrolled Resource Consumption vulnerability in SYNO.Core.PortForwarding.Rules in Synology DiskStation (DSM) before 6.1.1-15088 allows remote authenticated attacker to exhaust the memory resources of the machine, causing a denial of service attack. Una vulnerabilidad de consumo de recursos sin control en SYNO.Core.PortForwarding.Rules en Synology DiskStation (DSM) para versiones anteriores a la 6.1.1-15088 permite a un atacante autenticado remoto agotar los recursos de memoria de la máquina, provocando u... • https://www.synology.com/en-global/support/security/Synology_SA_17_48_DSM • CWE-400: Uncontrolled Resource Consumption •

CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0

CVE-2017-9553

https://notcve.org/view.php?id=CVE-2017-9553

24 Jul 2017 — A design flaw in SYNO.API.Encryption in Synology DiskStation Manager (DSM) before 6.1.3-15152 allows remote attackers to bypass the encryption protection mechanism via the crafted version parameter. Un fallo de diseño en el archivo SYNO.API.Encryption en Synology DiskStation Manager (DSM) anterior a versión 6.1.3-15152 permite a los atacantes remotos omitir el mecanismo de protección de encriptación mediante el parámetro de versión creado. • https://www.2-sec.com/2017/06/2-secs-expert-team-uncovers-new-vulnerability-popular-synology-nas-device •

CVSS: 5.3EPSS: 64%CPEs: 1EXPL: 5

CVE-2017-9554 – Synology DiskStation Manager (DSM) < 6.1.3-15152 - 'forget_passwd.cgi' User Enumeration

https://notcve.org/view.php?id=CVE-2017-9554

24 Jul 2017 — An information exposure vulnerability in forget_passwd.cgi in Synology DiskStation Manager (DSM) before 6.1.3-15152 allows remote attackers to enumerate valid usernames via unspecified vectors. Una vulnerabilidad de exposición de información en el archivo forget_passwd.cgi en Synology DiskStation Manager (DSM) anterior a la versión 6.1.3-15152, permite a los atacantes remotos enumerar nombres de usuario válidos por medio de vectores no especificados. Synology DiskStation Manager (DMS) versions prior to 6.1.... • https://packetstorm.news/files/id/181198 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1

CVE-2015-4655

https://notcve.org/view.php?id=CVE-2015-4655

18 Jun 2015 — Cross-site scripting (XSS) vulnerability in Synology DiskStation Manager (DSM) before 5.2-5565 Update 1 allows remote attackers to inject arbitrary web script or HTML via the "compound" parameter to entry.cgi. Vulnerabilidad de XSS en Synology DiskStation Manager (DSM) anterior a 5.2-5565 Update 1 permite a atacantes remotos inyectar secuencias de comandos web arbitrarios o HTML a través del parámetro 'compound' en entry.cgi. • http://seclists.org/fulldisclosure/2015/May/109 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •