Read the docs

Synology

Records375All Threatist records
Exploited (KEV)2In CISA KEV
CVSS critical61CVSS 9.0–10.0
CVSS high133CVSS 7.0–8.9

Exploited now

Synology records in CISA KEV

Components

Products in the NVD configurations · select one to filter the records

Records

8 records in Active Backup For Business Agent · all components

Priority LOW 30

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in agent-related functionality in Synology Active Backup for Business before 2.7.1-13234, 2.7.1-23234 and 2.7.1-3234 allows rem…

CVSS 3.1MEDIUM 6.5 Network High privileges No interaction EPSS 0.00572 Published 2025-02-13 Fixed in 2.7.1-3234, 2.7.1-13234 +1 CWE-22
Priority LOW 29

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in encrypted share umount functionality in Synology Active Backup for Business before 2.7.1-13234, 2.7.1-23234 and 2.7.1-3234 a…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00395 Published 2025-02-13 Fixed in 2.7.1-3234, 2.7.1-13234 +1 CWE-73
Priority LOW 26

An origin validation error vulnerability in Synology Active Backup for Business Agent before 3.1.0-4967 allows local users to write arbitrary files with restricted content and conduct denial-of-service during installatio…

CVSS 3.1MEDIUM 6.1 Local No auth User interaction EPSS 0.00086 Published 2026-05-27 Fixed in 3.1.0-4967 CWE-346
Priority LOW 26

Missing authentication for critical function vulnerability in proxy settings functionality in Synology Active Backup for Business Agent before 2.7.0-3221 allows local users to obtain user credential via unspecified vecto…

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00176 Published 2024-09-26 Fixed in 2.7.0-3221 CWE-306
Priority LOW 25

Missing encryption of sensitive data vulnerability in login component in Synology Active Backup for Business Agent before 2.7.0-3221 allows adjacent man-in-the-middle attackers to obtain user credential via unspecified v…

CVSS 3.1MEDIUM 5.3 Adjacent network No auth No interaction EPSS 0.0008 Published 2024-09-26 Fixed in 2.7.0-3221 CWE-311
Priority LOW 23

Missing encryption of sensitive data vulnerability in settings functionality in Synology Active Backup for Business Agent before 2.7.0-3221 allows local users to obtain user credential via unspecified vectors.

CVSS 3.1MEDIUM 5.0 Local Low privileges User interaction EPSS 0.00085 Published 2024-09-26 Fixed in 2.7.0-3221 CWE-311
Priority LOW 18

Missing authentication for critical function vulnerability in logout functionality in Synology Active Backup for Business Agent before 2.6.3-3101 allows local users to logout the client via unspecified vectors.

CVSS 3.1MEDIUM 4.0 Local No auth No interaction EPSS 0.00164 Published 2024-09-26 Fixed in 2.7.0-3221 CWE-306
Priority LOW 14

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in share file list functionality in Synology Active Backup for Business before 2.7.1-13234, 2.7.1-23234 and 2.7.1-3234 allows r…

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.00476 Published 2025-02-13 Fixed in 2.7.1-13234, 2.7.1-23234 +1 CWE-22
Open these records in search →