Synology vulnerabilities
317 CVEs and advisories name Synology as an affected vendor, newest first. Follow it as a feed.
- CVE-2023-52949Missing authentication for critical function vulnerability in proxy settings functionality in Synology Active Backup for Business Agent befo
- CVE-2023-52948Missing encryption of sensitive data vulnerability in settings functionality in Synology Active Backup for Business Agent before 2.7.0-3221
- CVE-2023-52947Missing authentication for critical function vulnerability in logout functionality in Synology Active Backup for Business Agent before 2.6.3
- CVE-2023-52950Missing encryption of sensitive data vulnerability in login component in Synology Active Backup for Business Agent before 2.7.0-3221 allows
- CVE-2022-49041Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in backup task management functionality in Synology Dri
- CVE-2022-49040Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in connection management functionality in Synology Driv
- CVE-2022-49039Out-of-bounds write vulnerability in backup task management functionality in Synology Drive Client before 3.4.0-15721 allows local users wit
- CVE-2022-49038Inclusion of functionality from untrusted control sphere vulnerability in OpenSSL DLL component in Synology Drive Client before 3.3.0-15082
- CVE-2022-49037Insertion of sensitive information into log file vulnerability in proxy settings component in Synology Drive Client before 3.3.0-15082 allow
- CVE-2023-52946Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in vss service component in Synology Drive Client befor
- CVE-2024-39350A vulnerability regarding authentication bypass by spoofing is found in the RTSP functionality.
- CVE-2024-39348Download of code without integrity check vulnerability in AirPrint functionality in Synology Router Manager (SRM) before 1.2.5-8227-11 and 1
- CVE-2024-39347Incorrect default permissions vulnerability in firewall functionality in Synology Router Manager (SRM) before 1.2.5-8227-11 and 1.3.1-9346-8
- CVE-2024-39352A vulnerability regarding incorrect authorization is found in the firmware upgrade functionality.
- CVE-2024-39351A vulnerability regarding improper neutralization of special elements used in an OS command ('OS Command Injection') is found in the NTP con
- CVE-2024-39349A vulnerability regarding buffer copy without checking size of input ('Classic Buffer Overflow') is found in the libjansson component and it
- CVE-2023-47803A vulnerability regarding improper limitation of a pathname to a restricted directory ('Path Traversal') is found in the Language Settings f
- CVE-2023-47802A vulnerability regarding improper neutralization of special elements used in an OS command ('OS Command Injection') is found in the IP bloc
- CVE-2024-5463A vulnerability regarding buffer copy without checking the size of input ('Classic Buffer Overflow') has been found in the login component.
- CVE-2024-29241Missing authorization vulnerability in System webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows rem
- CVE-2024-29240Missing authorization vulnerability in LayoutSave webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allows
- CVE-2024-29239Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Recording.CountByCategory webapi compo
- CVE-2024-29238Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Log.CountByCategory webapi component i
- CVE-2024-29237Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in ActionRule.Delete webapi component in
- CVE-2024-29236Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in AudioPattern.Delete webapi component i
- CVE-2024-29235Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in IOModule.EnumLog webapi component in S
- CVE-2024-29234Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Group.Save webapi component in Synolog
- CVE-2024-29233Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Emap.Delete webapi component in Synolo
- CVE-2024-29232Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Alert.Enum webapi component in Synolog
- CVE-2024-29231Improper validation of array index vulnerability in UserPrivilege.Enum webapi component in Synology Surveillance Station before 9.2.0-9289 a