Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

8 records

Vendor: Synology Component: Download Station Clear all filters
TI-2021-13803 CVE-2021-34809 · GHSA-46j9-2j4r-83q6

Command injection in Synology Download Station

Priority MEDIUM 46

Improper neutralization of special elements used in a command ('Command Injection') vulnerability in task management component in Synology Download Station before 3.8.16-3566 allows remote authenticated users to execute…

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.01935 Published 2021-06-18 Fixed in 3.8.16-3566 CWE-77
TI-2021-13804 CVE-2021-34810 · GHSA-473c-wh3w-ppx8

Improper privilege management in Synology Download Station

Priority MEDIUM 45

Improper privilege management vulnerability in cgi component in Synology Download Station before 3.8.16-3566 allows remote authenticated users to execute arbitrary code via unspecified vectors.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.01369 Published 2021-06-18 Fixed in 3.8.16-3566 CWE-269
TI-2021-13805 CVE-2021-34811 · GHSA-h4r4-pw7f-hp8j

Server-side request forgery in Synology Download Station

Priority LOW 24

Server-Side Request Forgery (SSRF) vulnerability in task management component in Synology Download Station before 3.8.16-3566 allows remote authenticated users to access intranet resources via unspecified vectors.

CVSS 3.1MEDIUM 5.0 Network Low privileges No interaction EPSS 0.00764 Published 2021-06-18 Fixed in 3.8.16-3566 CWE-918
TI-2021-12735 CVE-2021-33184 · GHSA-xqrp-5pxm-3qxh

Server-side request forgery in Synology Download Station

Priority LOW 36

Server-Side request forgery (SSRF) vulnerability in task management component in Synology Download Station before 3.8.15-3563 allows remote authenticated users to read arbitrary files via unspecified vectors.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.01 Published 2021-06-01 Fixed in 3.8.15-3563 CWE-918
TI-2017-08213 CVE-2017-11156 · GHSA-qqc7-r2fw-p594

Incorrect default permissions in Synology Download Station

Priority LOW 38

Synology Download Station 3.8.x before 3.8.5-3475 and 3.x before 3.5-2984 uses weak permissions (0777) for ui/dlm/btsearch directory, which allows remote authenticated users to execute arbitrary code by uploading an exec…

CVSS 3.0HIGH 7.8 Local Low privileges No interaction EPSS 0.02302 Published 2017-08-14 No fix listed CWE-276
TI-2017-08206 CVE-2017-11149 · GHSA-p6v2-8cvh-3w66

Server-side request forgery in Synology Download Station

Priority LOW 32

Server-side request forgery (SSRF) vulnerability in Downloader in Synology Download Station 3.8.x before 3.8.5-3475 and 3.x before 3.5-2984 allows remote authenticated users to download arbitrary local files via crafted…

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01599 Published 2017-08-14 No fix listed CWE-918
TI-2015-05767 CVE-2015-6913 · GHSA-q5j8-mj88-p78h

Cross-site scripting (XSS) vulnerability in the "Create download task via URL" feature in…

Priority LOW 24

Cross-site scripting (XSS) vulnerability in the "Create download task via URL" feature in Synology Download Station before 3.5-2967 allows remote attackers to inject arbitrary web script or HTML via the urls parameter in…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01917 Published 2015-09-11 No fix listed CWE-79