Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

11 records

Vendor: Synology Component: Calendar Clear all filters
TI-2022-10598 CVE-2022-27617 · GHSA-fqf3-wwvm-vgr9

Path traversal in Synology Calendar

Priority LOW 25

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology Calendar before 2.3.4-0631 allows remote authenticated users to download arbitrary files via un…

CVSS 3.1MEDIUM 5.0 Network Low privileges No interaction EPSS 0.00933 Published 2022-08-03 Fixed in 2.3.4-0631 CWE-22
TI-2022-06947 CVE-2022-22686 · GHSA-pp3f-g5wr-f3gv

Cross-site request forgery in Synology Calendar

Priority LOW 35

Cross-Site Request Forgery (CSRF) vulnerability in webapi component in Synology Calendar before 2.3.4-0631 allows remote authenticated users to hijack the authentication of administrators via unspecified vectors.

CVSS 3.1HIGH 8.0 Network Low privileges User interaction EPSS 0.00341 Published 2022-07-26 Fixed in 2.3.4-0631 CWE-352
TI-2022-06943 CVE-2022-22682 · GHSA-42p8-93qx-mrrc

Cross-site scripting in Synology Calendar

Priority LOW 30

Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Event Management in Synology Calendar before 2.4.5-10930 allows remote authenticated users to inject arbitrary web scr…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00557 Published 2022-07-12 Fixed in 2.4.5-10930 CWE-79
TI-2021-13806 CVE-2021-34812 · GHSA-w3f5-2mqc-5c62

Hard-coded credentials in Synology Calendar

Priority LOW 35

Use of hard-coded credentials vulnerability in php component in Synology Calendar before 2.4.0-0761 allows remote attackers to obtain sensitive information via unspecified vectors.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01119 Published 2021-06-18 Fixed in 2.4.0-0761 CWE-798
TI-2019-08865 CVE-2019-11829 · GHSA-2c6q-2f39-j65x

OS command injection in Synology Calendar

Priority MEDIUM 46

OS command injection vulnerability in drivers_syno_import_user.php in Synology Calendar before 2.3.1-0617 allows remote attackers to execute arbitrary commands via the crafted 'X-Real-IP' header.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02249 Published 2019-06-30 Fixed in 2.3.1-0617 CWE-78
TI-2019-08861 CVE-2019-11825 · GHSA-x5gw-2qjg-7h6j

Cross-site scripting in Synology Calendar

Priority LOW 30

Cross-site scripting (XSS) vulnerability in Event Editor in Synology Calendar before 2.3.0-0615 allows remote attackers to inject arbitrary web script or HTML via the title parameter.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00788 Published 2019-06-30 Fixed in 2.3.0-0615 CWE-79
TI-2019-08857 CVE-2019-11820 · GHSA-h7q5-jggm-p2vj

Insufficiently protected credentials in Synology Calendar

Priority LOW 25

Information exposure through process environment vulnerability in Synology Calendar before 2.3.3-0620 allows local users to obtain credentials via cmdline.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00281 Published 2019-05-09 Fixed in 2.3.3-0620 CWE-522
TI-2018-09547 CVE-2018-13299 · GHSA-rx7v-r27h-28rm

Path traversal in Synology Calendar

Priority LOW 32

Relative path traversal vulnerability in Attachment Uploader in Synology Calendar before 2.2.2-0532 allows remote authenticated users to upload arbitrary files via the filename parameter.

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01364 Published 2019-04-01 Fixed in 2.2.2-0532 CWE-23
TI-2018-06465 CVE-2018-8927 · GHSA-pc82-888m-pq3g

Incorrect authorization in Synology Calendar

Priority LOW 31

Improper authorization vulnerability in SYNO.Cal.Event in Calendar before 2.1.2-0511 allows remote authenticated users to create arbitrary events via the (1) cal_id or (2) original_cal_id parameter.

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00907 Published 2018-06-14 Fixed in 2.1.2-0511 CWE-863
TI-2018-06453 CVE-2018-8915 · GHSA-jc52-h9fr-wjmq

Cross-site scripting in Synology Calendar

Priority LOW 30

Cross-site scripting (XSS) vulnerability in Notification Center in Synology Calendar before 2.1.1-0502 allows remote authenticated users to inject arbitrary web script or HTML via title parameter.

CVSS 3.0MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00787 Published 2018-05-10 Fixed in 2.1.1-0502 CWE-79
TI-2017-11638 CVE-2017-15891 · GHSA-9x4q-j758-h4gx

Improper access control in Synology Calendar

Priority LOW 31

Improper access control vulnerability in SYNO.Cal.EventBase in Synology Calendar before 2.0.1-0242 allows remote authenticated users to modify calendar event via unspecified vectors.

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01036 Published 2017-12-08 Fixed in 2.0.1-0242 CWE-284