Synology vulnerabilities
317 CVEs and advisories name Synology as an affected vendor, newest first. Follow it as a feed.
- CVE-2022-27617Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology Calendar before
- CVE-2022-27616Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in webapi component in Synology Dis
- CVE-2022-27611Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology Audio Station b
- CVE-2022-27612Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in cgi component in Synology Audio Station before 6.5.4
- CVE-2022-22683Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in cgi component in Synology Media Server before 1.8.1-
- CVE-2022-27614Exposure of sensitive information to an unauthorized actor vulnerability in web server in Synology Media Server before 1.8.1-2876 allows rem
- CVE-2022-22685Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology WebDAV Server b
- CVE-2022-27613Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in webapi component in Synology CardDAV S
- CVE-2022-22684Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in task management component in Syn
- CVE-2022-27615Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in cgi component in Synology DNS Server before
- CVE-2022-27610Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology DiskStation Man
- CVE-2022-22686Cross-Site Request Forgery (CSRF) vulnerability in webapi component in Synology Calendar before 2.3.4-0631 allows remote authenticated users
- CVE-2022-22682Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Event Management in Synology Calendar
- CVE-2022-22681Session fixation vulnerability in access control management in Synology Photo Station before 6.8.16-3506 allows remote attackers to bypass s
- CVE-2022-22687Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in Authentication functionality in Synology DiskStation
- CVE-2022-22688Improper neutralization of special elements used in a command ('Command Injection') vulnerability in File service functionality in Synology
- CVE-2022-22679Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in support service management in Synology DiskS
- CVE-2021-43929Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in work flow management in
- CVE-2021-43928Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in mail sending and receiving compo
- CVE-2021-43927Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Security Management functionality in S
- CVE-2021-43926Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Log Management functionality in Synolo
- CVE-2021-43925Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Log Management functionality in Synolo
- CVE-2022-22680Exposure of sensitive information to an unauthorized actor vulnerability in Web Server in Synology DiskStation Manager (DSM) before 7.0.1-42
- CVE-2021-29084Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in Security Advisor report
- CVE-2021-29085Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in file sharing management
- CVE-2021-29087Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology DiskStation Man
- CVE-2021-27649Use after free vulnerability in file transfer protocol component in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote at
- CVE-2021-29086Exposure of sensitive information to an unauthorized actor vulnerability in webapi component in Synology DiskStation Manager (DSM) before 6.
- CVE-2021-34808Server-Side Request Forgery (SSRF) vulnerability in cgi component in Synology Media Server before 1.8.3-2881 allows remote attackers to acce
- CVE-2021-34809Improper neutralization of special elements used in a command ('Command Injection') vulnerability in task management component in Synology D