Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: Synology DiskStation Manager (DSM) 6.2.3-25426-2 Clear all filters
TI-2020-16771 CVE-2020-27656 · GHSA-8mf3-6333-x5rm

Cleartext transmission of sensitive information in Synology DiskStation Manager

Priority LOW 30

Cleartext transmission of sensitive information vulnerability in DDNS in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-in-the-middle attackers to eavesdrop authentication information of DNSExit via u…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00547 Published 2020-10-29 Fixed in 6.2.3-25426-2 CWE-319
TI-2020-16767 CVE-2020-27652 · GHSA-c4cp-hjxc-9m9g

Broken or risky cryptographic algorithm in Synology DiskStation Manager

Priority LOW 38

Algorithm downgrade vulnerability in QuickConnect in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-in-the-middle attackers to spoof servers and obtain sensitive information via unspecified vectors.

CVSS 3.1HIGH 8.3 Network No auth User interaction EPSS 0.00832 Published 2020-10-29 Fixed in 6.2.3-25426-2 CWE-327
TI-2020-16765 CVE-2020-27650 · GHSA-pr6j-q8cq-rhhr

Synology DiskStation Manager (DSM) before 6.2.3-25426-2 does not set the Secure flag for…

Priority LOW 27

Synology DiskStation Manager (DSM) before 6.2.3-25426-2 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its trans…

CVSS 3.1MEDIUM 5.8 Network No auth User interaction EPSS 0.00559 Published 2020-10-29 Fixed in 6.2.3-25426-2 CWE-614
TI-2020-16763 CVE-2020-27648 · GHSA-f7vf-74cx-834m

Improper certificate validation in Synology DiskStation Manager

Priority MEDIUM 40

Improper certificate validation vulnerability in OpenVPN client in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafte…

CVSS 3.1CRITICAL 9.0 Network No auth No interaction EPSS 0.00719 Published 2020-10-29 Fixed in 6.2.3-25426-2 CWE-295