Synology vulnerabilities
375 vulnerabilities
Known vulnerabilities in Synology products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 114 products.
Products
50 of 114- Diskstation Manager97 vulnerabilities
- Diskstation Manager (Dsm)72 vulnerabilities
- Router Manager59 vulnerabilities
- Synology Router Manager (Srm)43 vulnerabilities
- Photo Station33 vulnerabilities
- Skynas29 vulnerabilities
- Surveillance Station25 vulnerabilities
- Vs960Hd23 vulnerabilities
- Diskstation Manager Unified Controller20 vulnerabilities
- Synology Photo Station19 vulnerabilities
- Synology Diskstation Manager (Dsm)13 vulnerabilities
- Calendar11 vulnerabilities
- Bc5009 vulnerabilities
- Camera9 vulnerabilities
- Tc5009 vulnerabilities
- Active Backup For Business Agent8 vulnerabilities
- Download Station8 vulnerabilities
- Beedrive6 vulnerabilities
- Beedrive For Desktop6 vulnerabilities
- Drive Client6 vulnerabilities
- Drive Server6 vulnerabilities
- Media Server6 vulnerabilities
- Synology Drive Client6 vulnerabilities
- Unified Controller (Dsmuc)6 vulnerabilities
- Video Station6 vulnerabilities
- Dns Server5 vulnerabilities
- Note Station5 vulnerabilities
- Radius Server5 vulnerabilities
- Ssl Vpn Client5 vulnerabilities
- Synology Active Backup For Business Agent5 vulnerabilities
- Synology Calendar5 vulnerabilities
- Active Backup For Business4 vulnerabilities
- Audio Station4 vulnerabilities
- Beestation Os4 vulnerabilities
- Directory Server4 vulnerabilities
- Drive4 vulnerabilities
- Assistant3 vulnerabilities
- Beestation OS (Bsm)3 vulnerabilities
- Carddav Server3 vulnerabilities
- Chat3 vulnerabilities
- File Station3 vulnerabilities
- Mailplus Server3 vulnerabilities
- Office3 vulnerabilities
- Safe Access3 vulnerabilities
- Synology Chat Server3 vulnerabilities
- Synology Download Station3 vulnerabilities
- Synology SSL VPN Client3 vulnerabilities
- Virtual Diskstation Manager3 vulnerabilities
- Application Service2 vulnerabilities
- Dsm2 vulnerabilities
CVE-2018-13286synologydiskstation_manager+1
EPSS score1.31%
Incorrect default permissions vulnerability in synouser.conf in Synology Diskstation Manager (DSM) before 6.2-23739-1 allows remote authenticated users to obtain sensitive information via the world readable configuration.CVE-2018-13294synologyapplication_serviceEPSS score1.29%
Information exposure vulnerability in SYNO.Personal.Profile in Synology Application Service before 1.5.4-0320 allows remote authenticated users to obtain sensitive system information via the uid parameter.CVE-2018-13280synologydiskstation_manager+1EPSS score0.63%
Use of insufficiently random values vulnerability in SYNO.Encryption.GenRandomKey in Synology DiskStation Manager (DSM) before 6.2-23739 allows man-in-the-middle attackers to compromise non-HTTPS sessions via unspecified vectors.CVE-2018-13295synologyapplication_serviceEPSS score1.29%
Information exposure vulnerability in SYNO.Personal.Application.Info in Synology Application Service before 1.5.4-0320 allows remote authenticated users to obtain sensitive system information via the version parameter.CVE-2018-13285synologyrouter_manager+1EPSS score2.38%
Command injection vulnerability in ftpd in Synology Router Manager (SRM) before 1.1.7-6941-1 allows remote authenticated users to execute arbitrary OS commands via the (1) MKD or (2) RMD command.CVE-2018-13299synologycalendarEPSS score1.36%
Relative path traversal vulnerability in Attachment Uploader in Synology Calendar before 2.2.2-0532 allows remote authenticated users to upload arbitrary files via the filename parameter.CVE-2018-13289synologyrouter_manager+1EPSS score1.64%
Information exposure vulnerability in SYNO.FolderSharing.List in Synology Router Manager (SRM) before 1.1.7-6941-2 allows remote attackers to obtain sensitive information via the (1) folder_path or (2) real_path parameter.CVE-2018-13283synologyssl_vpn_clientEPSS score1.38%
Lack of administrator control over security vulnerability in client.cgi in Synology SSL VPN Client before 1.2.5-0226 allows remote attackers to conduct man-in-the-middle attacks via the (1) command, (2) hostname, or (3) port parameter.CVE-2018-13284synologydiskstation_manager+1EPSS score2.31%
Command injection vulnerability in ftpd in Synology Diskstation Manager (DSM) before 6.2-23739-1 allows remote authenticated users to execute arbitrary OS commands via the (1) MKD or (2) RMD command.CVE-2018-13282synologyphoto_stationEPSS score0.96%
Session fixation vulnerability in SYNO.PhotoStation.Auth in Synology Photo Station before 6.8.7-3481 allows remote attackers to hijack web sessions via the PHPSESSID parameter.CVE-2018-13290synologyrouter_manager+1EPSS score1.31%
Information exposure vulnerability in SYNO.Core.ACL in Synology Router Manager (SRM) before 1.1.7-6941-2 allows remote authenticated users to determine the existence of files or obtain sensitive information of files via the file_path parameter.CVE-2018-13288synologyfile_stationEPSS score1.49%
Information exposure vulnerability in SYNO.FolderSharing.List in Synology File Station before 1.2.3-0252 and before 1.1.5-0125 allows remote attackers to obtain sensitive information via the (1) folder_path or (2) real_path parameter.CVE-2018-13296synologymailplus_serverEPSS score1.76%
Uncontrolled resource consumption vulnerability in TLS configuration in Synology MailPlus Server before 2.0.5-0606 allows remote attackers to conduct denial-of-service attacks via client-initiated renegotiation.CVE-2018-13298synologyandroid moments+1EPSS score0.94%
Channel accessible by non-endpoint vulnerability in privacy page in Synology Android Moments before 1.2.3-199 allows man-in-the-middle attackers to execute arbitrary code via unspecified vectors.CVE-2018-13297synologydrive+1EPSS score1.49%
Information exposure vulnerability in SYNO.SynologyDrive.Files in Synology Drive before 1.1.2-10562 allows remote attackers to obtain sensitive system information via the dsm_path parameter.CVE-2018-13292synologyrouter_manager+1EPSS score1.31%
Information exposure vulnerability in /usr/syno/etc/mount.conf in Synology Router Manager (SRM) before 1.1.7-6941-2 allows remote authenticated users to obtain sensitive information via the world readable configuration.CVE-2018-13281synologydiskstation_manager+3EPSS score1.18%
Information exposure vulnerability in SYNO.Core.ACL in Synology DiskStation Manager (DSM) before 6.2-23739-2 allows remote authenticated users to determine the existence and obtain the metadata of arbitrary files via the file_path parameter.CVE-2018-13287synologyrouter_manager+1EPSS score1.34%
Incorrect default permissions vulnerability in synouser.conf in Synology Router Manager (SRM) before 1.1.7-6941-1 allows remote authenticated users to obtain sensitive information via the world readable configuration.CVE-2018-13293synologydiskstation_manager+1EPSS score0.80%
Cross-site scripting (XSS) vulnerability in Control Panel SSO Settings in Synology DiskStation Manager (DSM) before 6.2.1-23824 allows remote authenticated users to inject arbitrary web script or HTML via the URL parameter.CVE-2018-13291synologydiskstation_manager+1EPSS score1.19%
Information exposure vulnerability in /usr/syno/etc/mount.conf in Synology DiskStation Manager (DSM) before 6.2.1-23824 allows remote authenticated users to obtain sensitive information via the world readable configuration.