Read the docs

Synology

Records375All Threatist records
Exploited (KEV)2In CISA KEV
CVSS critical61CVSS 9.0–10.0
CVSS high133CVSS 7.0–8.9

Exploited now

Synology records in CISA KEV
TI-2021-02242 Sudo Heap-Based Buffer Overflow Vulnerability Priority CRITICAL 93KEV 2022-04-06TI-2020-01431 Microsoft Netlogon Privilege Escalation Vulnerability Priority CRITICAL 100KEV 2021-11-03

Components

Products in the NVD configurations · select one to filter the records
Diskstation Manager 97 records CRITICAL Router Manager 59 records CRITICAL Photo Station 33 records HIGH Surveillance Station 25 records MEDIUM Vs960hd Firmware 22 records CRITICAL Diskstation Manager Unified Controller 20 records CRITICAL Skynas 16 records CRITICAL Skynas Firmware 13 records CRITICAL

Records

8 records in Download Station · all components

TI-2021-13803 CVE-2021-34809 · GHSA-46j9-2j4r-83q6

Command injection in Synology Download Station

Priority MEDIUM 46

Improper neutralization of special elements used in a command ('Command Injection') vulnerability in task management component in Synology Download Station before 3.8.16-3566 allows remote authenticated users to execute…

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.01935 Published 2021-06-18 Fixed in 3.8.16-3566 CWE-77
TI-2021-13804 CVE-2021-34810 · GHSA-473c-wh3w-ppx8

Improper privilege management in Synology Download Station

Priority MEDIUM 45

Improper privilege management vulnerability in cgi component in Synology Download Station before 3.8.16-3566 allows remote authenticated users to execute arbitrary code via unspecified vectors.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.01369 Published 2021-06-18 Fixed in 3.8.16-3566 CWE-269
TI-2017-08213 CVE-2017-11156 · GHSA-qqc7-r2fw-p594

Incorrect default permissions in Synology Download Station

Priority LOW 38

Synology Download Station 3.8.x before 3.8.5-3475 and 3.x before 3.5-2984 uses weak permissions (0777) for ui/dlm/btsearch directory, which allows remote authenticated users to execute arbitrary code by uploading an exec…

CVSS 3.0HIGH 7.8 Local Low privileges No interaction EPSS 0.02302 Published 2017-08-14 No fix listed CWE-276
TI-2021-12735 CVE-2021-33184 · GHSA-xqrp-5pxm-3qxh

Server-side request forgery in Synology Download Station

Priority LOW 36

Server-Side request forgery (SSRF) vulnerability in task management component in Synology Download Station before 3.8.15-3563 allows remote authenticated users to read arbitrary files via unspecified vectors.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.01 Published 2021-06-01 Fixed in 3.8.15-3563 CWE-918
TI-2017-08206 CVE-2017-11149 · GHSA-p6v2-8cvh-3w66

Server-side request forgery in Synology Download Station

Priority LOW 32

Server-side request forgery (SSRF) vulnerability in Downloader in Synology Download Station 3.8.x before 3.8.5-3475 and 3.x before 3.5-2984 allows remote authenticated users to download arbitrary local files via crafted…

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01599 Published 2017-08-14 No fix listed CWE-918
TI-2021-13805 CVE-2021-34811 · GHSA-h4r4-pw7f-hp8j

Server-side request forgery in Synology Download Station

Priority LOW 24

Server-Side Request Forgery (SSRF) vulnerability in task management component in Synology Download Station before 3.8.16-3566 allows remote authenticated users to access intranet resources via unspecified vectors.

CVSS 3.1MEDIUM 5.0 Network Low privileges No interaction EPSS 0.00764 Published 2021-06-18 Fixed in 3.8.16-3566 CWE-918
TI-2015-05767 CVE-2015-6913 · GHSA-q5j8-mj88-p78h

Cross-site scripting (XSS) vulnerability in the "Create download task via URL" feature in…

Priority LOW 24

Cross-site scripting (XSS) vulnerability in the "Create download task via URL" feature in Synology Download Station before 3.5-2967 allows remote attackers to inject arbitrary web script or HTML via the urls parameter in…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01917 Published 2015-09-11 No fix listed CWE-79
Open these records in search →