Vulnerability index

Browse CVEs

280 matching
Filters 1 Clear all
Severity

Filters apply as you choose them.

Moments HIGH 8.1
CVE-2018-13298

Channel accessible by non-endpoint vulnerability in privacy page in Synology Android Moments before 1.2.3-199 allows man-in-the-middle attackers to e…

Fix: 1.2.3-199+
Fix from $1,950 2019-04-01
Mailplus Server HIGH 7.5
CVE-2018-13296

Uncontrolled resource consumption vulnerability in TLS configuration in Synology MailPlus Server before 2.0.5-0606 allows remote attackers to conduct…

Fix: 2.0.5-0606+
Fix from $1,950 2019-04-01
Ssl Vpn Client HIGH 7.4
CVE-2018-13283

Lack of administrator control over security vulnerability in client.cgi in Synology SSL VPN Client before 1.2.5-0226 allows remote attackers to condu…

Fix: 1.2.5-0226+
Fix from $1,950 2019-04-01
Diskstation Manager MEDIUM 6.5
CVE-2018-13286

Incorrect default permissions vulnerability in synouser.conf in Synology Diskstation Manager (DSM) before 6.2-23739-1 allows remote authenticated use…

Fix: 5.2-5967-8 / 6.0.3-8754-8+
Fix from $1,600 2019-04-01
Router Manager MEDIUM 6.5
CVE-2018-13287

Incorrect default permissions vulnerability in synouser.conf in Synology Router Manager (SRM) before 1.1.7-6941-1 allows remote authenticated users t…

Fix: 1.1.7-6941-1+
Fix from $1,600 2019-04-01
Application Service MEDIUM 6.5
CVE-2018-13294

Information exposure vulnerability in SYNO.Personal.Profile in Synology Application Service before 1.5.4-0320 allows remote authenticated users to ob…

Fix: 1.5.4-0320+
Fix from $1,600 2019-04-01
Application Service MEDIUM 6.5
CVE-2018-13295

Information exposure vulnerability in SYNO.Personal.Application.Info in Synology Application Service before 1.5.4-0320 allows remote authenticated us…

Fix: 1.5.4-0320+
Fix from $1,600 2019-04-01
Calendar MEDIUM 6.5
CVE-2018-13299

Relative path traversal vulnerability in Attachment Uploader in Synology Calendar before 2.2.2-0532 allows remote authenticated users to upload arbit…

Fix: 2.2.2-0532+
Fix from $1,600 2019-04-01
Sso Server MEDIUM 6.1
CVE-2017-16775

Improper restriction of rendered UI layers or frames vulnerability in SSOOauth.cgi in Synology SSO Server before 2.1.3-0129 allows remote attackers t…

Fix: 2.1.3-0129+
Fix from $1,600 2019-04-01
Web Station MEDIUM 6.1
CVE-2018-8913

Missing custom error page vulnerability in Synology Web Station before 2.1.3-0139 allows remote attackers to conduct phishing attacks via a crafted U…

Fix: 2.1.3-0139+
Fix from $1,600 2019-04-01
Diskstation Manager MEDIUM 5.4
CVE-2017-16774

Cross-site scripting (XSS) vulnerability in SYNO.Core.PersonalNotification.Event in Synology DiskStation Manager (DSM) before 6.1.4-15217-3 allows re…

Fix: 6.1.4-15217-3+
Fix from $1,600 2019-04-01
Diskstation Manager MEDIUM 5.4
CVE-2018-13293

Cross-site scripting (XSS) vulnerability in Control Panel SSO Settings in Synology DiskStation Manager (DSM) before 6.2.1-23824 allows remote authent…

Fix: 6.2.1-23824+
Fix from $1,600 2019-04-01
File Station MEDIUM 5.3
CVE-2018-13288

Information exposure vulnerability in SYNO.FolderSharing.List in Synology File Station before 1.2.3-0252 and before 1.1.5-0125 allows remote attacker…

Fix: 1.1.5-0125 / 1.2.2-0250+
Fix from $1,600 2019-04-01
Router Manager MEDIUM 5.3
CVE-2018-13289

Information exposure vulnerability in SYNO.FolderSharing.List in Synology Router Manager (SRM) before 1.1.7-6941-2 allows remote attackers to obtain …

Fix: 1.1.7-6941-2+
Fix from $1,600 2019-04-01
Drive Server MEDIUM 5.3
CVE-2018-13297

Information exposure vulnerability in SYNO.SynologyDrive.Files in Synology Drive before 1.1.2-10562 allows remote attackers to obtain sensitive syste…

Fix: 1.1.2-10562+
Fix from $1,600 2019-04-01
Diskstation Manager CRITICAL 9.8
CVE-2018-8919

Information exposure vulnerability in SYNO.Core.Desktop.SessionData in Synology DiskStation Manager (DSM) before 6.1.6-15266 allows remote attackers …

Fix: 6.1.6-15266+
Fix from $2,300 2018-12-24
Diskstation Manager HIGH 7.2
CVE-2018-8920

Improper neutralization of escape vulnerability in Log Exporter in Synology DiskStation Manager (DSM) before 6.1.6-15266 allows remote attackers to i…

Fix: 6.1.6-15266+
Fix from $1,950 2018-12-24
Diskstation Manager MEDIUM 5.4
CVE-2018-8917

Cross-site scripting (XSS) vulnerability in info.cgi in Synology DiskStation Manager (DSM) before 6.1.6-15266 allows remote attackers to inject arbit…

Fix: 6.1.6-15266+
Fix from $1,600 2018-12-24
Router Manager MEDIUM 5.4
CVE-2018-8918

Cross-site scripting (XSS) vulnerability in info.cgi in Synology Router Manager (SRM) before 1.1.7-6941 allows remote attackers to inject arbitrary w…

Fix: 1.1.7-6941+
Fix from $1,600 2018-12-24
Photo Station MEDIUM 6.3
CVE-2018-13282

Session fixation vulnerability in SYNO.PhotoStation.Auth in Synology Photo Station before 6.8.7-3481 allows remote attackers to hijack web sessions v…

Fix: 6.3-2976 / 6.8.7-3481+
Fix from $1,600 2018-10-31
Diskstation Manager MEDIUM 5.9
CVE-2018-13280

Use of insufficiently random values vulnerability in SYNO.Encryption.GenRandomKey in Synology DiskStation Manager (DSM) before 6.2-23739 allows man-i…

Fix: 6.2-23739+
Fix from $1,600 2018-07-30
Ds107 Firmware CRITICAL 9.8
CVE-2016-6554

Synology NAS servers DS107, firmware version 3.1-1639 and prior, and DS116, DS213, firmware versions prior to 5.2-5644-1, use non-random default cred…

Fix: after 5.2-5644-1
Fix from $2,300 2018-07-13
Ssl Vpn Client HIGH 8.1
CVE-2018-8929

Improper restriction of communication channel to intended endpoints vulnerability in HTTP daemon in Synology SSL VPN Client before 1.2.4-0224 allows …

Fix: 1.2.4-0224+
Fix from $1,950 2018-07-06
Universal Search HIGH 8.8
CVE-2017-16773

Improper authorization vulnerability in Highlight Preview in Synology Universal Search before 1.0.5-0135 allows remote authenticated users to bypass …

Fix: 1.0.5-0135+
Fix from $1,950 2018-07-05
Carddav Server MEDIUM 5.4
CVE-2018-8928

Cross-site scripting (XSS) vulnerability in Address Book Editor in Synology CardDAV Server before 6.0.8-0086 allows remote authenticated users to inj…

Fix: 6.0.8-0086+
Fix from $1,600 2018-07-05
Calendar MEDIUM 6.5
CVE-2018-8927

Improper authorization vulnerability in SYNO.Cal.Event in Calendar before 2.1.2-0511 allows remote authenticated users to create arbitrary events via…

Fix: 2.1.2-0511+
Fix from $1,600 2018-06-14
Diskstation Manager HIGH 8.8
CVE-2018-8916

Unverified password change vulnerability in Change Password in Synology DiskStation Manager (DSM) before 6.2-23739 allows remote authenticated users …

Fix: 6.2-23739+
Fix from $1,950 2018-06-08
Photo Station HIGH 8.8
CVE-2018-8925

Cross-site request forgery (CSRF) vulnerability in admin/user.php in Synology Photo Station before 6.8.5-3471 and before 6.3-2975 allows remote attac…

Fix: 6.3-2975 / 6.8.5-3471+
Fix from $1,950 2018-06-08
Photo Station HIGH 8.8
CVE-2018-8926

Permissive regular expression vulnerability in synophoto_dsm_user in Synology Photo Station before 6.8.5-3471 and before 6.3-2975 allows remote authe…

Fix: 6.8.5-3471+
Fix from $1,950 2018-06-08
Diskstation Manager HIGH 7.2
CVE-2017-12075

Command injection vulnerability in EZ-Internet in Synology DiskStation Manager (DSM) before 6.2-23739 allows remote authenticated users to execute ar…

Fix: 6.2-23739+
Fix from $1,950 2018-06-08