Synology vulnerabilities
317 CVEs and advisories name Synology as an affected vendor, newest first. Follow it as a feed.
- CVE-2024-29230Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in SnapShot.CountByCategory webapi compon
- CVE-2024-29229Missing authorization vulnerability in GetLiveViewPath webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 a
- CVE-2024-29228Missing authorization vulnerability in GetStmUrlPath webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 all
- CVE-2024-29227Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Layout.LayoutSave webapi component in
- CVE-2024-0854URL redirection to untrusted site ('Open Redirect') vulnerability in file access component in Synology DiskStation Manager (DSM) before 6.2.
- CVE-2023-5748Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in cgi component in Synology SSL VPN Client before 1.4.
- CVE-2023-5746A vulnerability regarding use of externally-controlled format string is found in the cgi component.
- CVE-2023-41741Exposure of sensitive information to an unauthorized actor vulnerability in cgi component in Synology Router Manager (SRM) before 1.3.1-9346
- CVE-2023-41740Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in cgi component in Synology Router Manager (SR
- CVE-2023-41739Uncontrolled resource consumption vulnerability in File Functionality in Synology Router Manager (SRM) before 1.3.1-9346-6 allows remote aut
- CVE-2023-41738Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in Directory Domain Functionality i
- CVE-2023-2729Use of insufficiently random values vulnerability in User Management Functionality in Synology DiskStation Manager (DSM) before 7.2-64561 al
- CVE-2023-0142Uncontrolled search path element vulnerability in Backup Management functionality in Synology DiskStation Manager (DSM) before 6.2.4-25556-8
- CVE-2023-32956Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in CGI component in Synology Router
- CVE-2023-32955Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in DHCP Client Functionality in Syn
- CVE-2023-0077Integer overflow or wraparound vulnerability in CGI component in Synology Router Manager (SRM) before 1.2.5-8227-6 and 1.3.1-9346-3 allows r
- CVE-2022-43932Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in CGI component in Synolog
- CVE-2022-43931Out-of-bounds write vulnerability in Remote Desktop Functionality in Synology VPN Plus Server before 1.4.3-0534 and 1.4.4-0635 allows remote
- CVE-2022-43748Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in file operation management in Synology Presto
- CVE-2022-43749Improper privilege management vulnerability in summary report management in Synology Presto File Server before 2.1.2-1601 allows remote auth
- CVE-2022-27622Server-Side Request Forgery (SSRF) vulnerability in Package Center functionality in Synology DiskStation Manager (DSM) before 7.1-42661 allo
- CVE-2022-27623Missing authentication for critical function vulnerability in iSCSI management functionality in Synology DiskStation Manager (DSM) before 7.
- CVE-2022-3576A vulnerability regarding out-of-bounds read is found in the session processing functionality of Out-of-Band (OOB) Management.
- CVE-2022-27624A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the packet decryption function
- CVE-2022-27625A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the message processing functio
- CVE-2022-27626A vulnerability regarding concurrent execution using shared resource with improper synchronization ('Race Condition') is found in the sessio
- CVE-2022-27621Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology USB Copy before
- CVE-2022-27620Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology SSO Server befo
- CVE-2022-27619Cleartext transmission of sensitive information vulnerability in authentication management in Synology Note Station Client before 2.2.2-609
- CVE-2022-27618Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology Storage Analyze