Vendor

Synology

344 known vulnerabilities.

Products

DiskStation Manager (DSM) 99 Synology Router Manager (SRM) 43 Surveillance Station 25 Synology Photo Station 18 Synology DiskStation Manager (DSM) 13 Photo Station 12 Camera Firmware 9 Calendar 6 Unified Controller (DSMUC) 6 BeeDrive for desktop 6 Synology Drive Client 6 Media Server 5 Synology Calendar 5 Synology Active Backup for Business Agent 5 Note Station 4 Drive 4 Active Backup for Business 4 Synology SSL VPN Client 3 Download Station 3 Audio Station 3 Synology Chat Server 3 BeeStation OS (BSM) 3 Safe Access 3 Synology Download Station 3 Synology Video Station 2 Office 2 Application Service 2 Presto File Server 2 Synology Drive Server 2 File Station 2 SSL VPN Client 2 Chat 2 CardDAV Server 2 Hyper Backup 2 Synology Note Station Client 2 MailPlus Server 2 SSO Server 2 Synology Assistant 2 Synology Docker 1 VPN Plus Server 1

All Critical High Medium Low Exploited only Public exploit

93 results · Clear filters · Feed

High 7.7

CVE-2024-29228

Missing authorization vulnerability in GetStmUrlPath webapi component in Synology Surveillance Station before 9.2.0-928…

Synology Surveillance Station

Mar 28, 2024
High 7.2

CVE-2023-41738

Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in Directory D…

Synology Synology Router Manager (SRM)

Aug 31, 2023
High 8.1

CVE-2023-32955

Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in DHCP Client…

Synology Synology Router Manager (SRM)

May 16, 2023
High 7.5

CVE-2022-43932

Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in CGI…

Synology Synology Router Manager (SRM)

Jan 5, 2023
High 7.4

CVE-2022-27623

Missing authentication for critical function vulnerability in iSCSI management functionality in Synology DiskStation Ma…

Synology DiskStation Manager (DSM)

Oct 25, 2022
High 7.2

CVE-2022-27616

Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in webapi comp…

Synology DiskStation Manager (DSM)

Aug 3, 2022
High 7.3

CVE-2022-27612

Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in cgi component in Synology Audio…

Synology Audio Station

Jul 28, 2022
High 8.7

CVE-2022-22685

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Syn…

Synology WebDAV Server

Jul 28, 2022
High 8.3

CVE-2022-27613

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in webapi component …

Synology CardDAV Server

Jul 28, 2022
High 7.2

CVE-2022-22684

Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in task manage…

Synology DiskStation Manager (DSM)

Jul 28, 2022
High 7.7

CVE-2022-27615

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in cgi component in Synolo…

Synology DNS Server

Jul 28, 2022
High 8.1

CVE-2022-22681

Session fixation vulnerability in access control management in Synology Photo Station before 6.8.16-3506 allows remote …

Synology Photo Station

Jul 6, 2022
High 8.8

CVE-2022-22688

Improper neutralization of special elements used in a command ('Command Injection') vulnerability in File service funct…

Synology DiskStation Manager (DSM)

Mar 25, 2022
High 7.5

CVE-2021-29084

Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in Sec…

Synology DiskStation Manager (DSM)

Jun 23, 2021
High 8.6

CVE-2021-29085

Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in fil…

Synology DiskStation Manager (DSM)

Jun 23, 2021
High 7.5

CVE-2021-29087

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Syn…

Synology DiskStation Manager (DSM)

Jun 23, 2021
High 7.2

CVE-2021-29090

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in PHP component in …

Synology Synology Photo Station

Jun 2, 2021
High 7.7

CVE-2021-29091

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in file management compone…

Synology Synology Photo Station

Jun 2, 2021
High 7.7

CVE-2021-33184

Server-Side request forgery (SSRF) vulnerability in task management component in Synology Download Station before 3.8.1…

Synology Synology Download Station

Jun 1, 2021
High 7.9

CVE-2021-33183

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability container volume managemen…

Synology Synology Docker

Jun 1, 2021
High 7.8

CVE-2021-29088

Improper limitation of a pathname to a restricted directory ('Path Traversal') in cgi component in Synology DiskStation…

Synology Synology DiskStation Manager (DSM)

Jun 1, 2021
High 8.8

CVE-2021-29092

Unrestricted upload of file with dangerous type vulnerability in file management component in Synology Photo Station be…

Synology Synology Photo Station

Jun 1, 2021
High 7.3

CVE-2021-33180

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in cgi component in …

Synology Synology Media Server

Jun 1, 2021
High 8.8

CVE-2021-31439

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Synology Di…

Synology DiskStation Manager netatalk netatalk Debian Ubuntu Alpine

May 21, 2021
High 7.2

CVE-2021-29083

Improper neutralization of special elements used in an OS command in SYNO.Core.Network.PPPoE in Synology DiskStation Ma…

Synology Synology DiskStation Manager (DSM)

Apr 1, 2021
High 8.3

CVE-2021-26566

Insertion of sensitive information into sent data vulnerability in synorelayd in Synology DiskStation Manager (DSM) bef…

Synology Synology DiskStation Manager (DSM)

Feb 26, 2021
High 8.3

CVE-2021-26565

Cleartext transmission of sensitive information vulnerability in synorelayd in Synology DiskStation Manager (DSM) befor…

Synology Synology DiskStation Manager (DSM)

Feb 26, 2021
High 8.2

CVE-2021-26563

Incorrect authorization vulnerability in synoagentregisterd in Synology DiskStation Manager (DSM) before 6.2.4-25553 al…

Synology DiskStation Manager (DSM)

Feb 26, 2021
High 8.3

CVE-2021-26564

Cleartext transmission of sensitive information vulnerability in synorelayd in Synology DiskStation Manager (DSM) befor…

Synology Synology DiskStation Manager (DSM)

Feb 26, 2021
High 8.4

CVE-2020-27659

Multiple cross-site scripting (XSS) vulnerabilities in Synology SafeAccess before 1.2.3-0234 allow remote attackers to …

Synology Safe Access

Nov 30, 2020
High 8.3

CVE-2020-27652

Algorithm downgrade vulnerability in QuickConnect in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man…

Synology DiskStation Manager (DSM)

Oct 29, 2020
High 8.3

CVE-2020-27648

Improper certificate validation vulnerability in OpenVPN client in Synology DiskStation Manager (DSM) before 6.2.3-2542…

Synology DiskStation Manager (DSM)

Oct 29, 2020
High 7.1

CVE-2020-27658

Synology Router Manager (SRM) before 1.2.4-8081 does not include the HTTPOnly flag in a Set-Cookie header for the sessi…

Synology Synology Router Manager (SRM)

Oct 29, 2020
High 8.3

CVE-2020-27653

Algorithm downgrade vulnerability in QuickConnect in Synology Router Manager (SRM) before 1.2.4-8081 allows man-in-the-…

Synology Synology Router Manager (SRM)

Oct 29, 2020
High 8.3

CVE-2020-27649

Improper certificate validation vulnerability in OpenVPN client in Synology Router Manager (SRM) before 1.2.4-8081 allo…

Synology Synology Router Manager (SRM)

Oct 29, 2020
High 8.6

CVE-2019-11823

CRLF injection vulnerability in Network Center in Synology Router Manager (SRM) before 1.2.3-8017-2 allows remote attac…

Synology Synology Router Manager (SRM)

May 4, 2020
High 7.3

CVE-2019-11829

OS command injection vulnerability in drivers_syno_import_user.php in Synology Calendar before 2.3.1-0617 allows remote…

Synology Calendar

Jun 30, 2019
High 7.3

CVE-2019-11821

SQL injection vulnerability in synophoto_csPhotoDB.php in Synology Photo Station before 6.8.11-3489 and before 6.3-2977…

Synology Photo Station

Jun 30, 2019
High 8.0

CVE-2019-11826

Relative path traversal vulnerability in SYNO.PhotoTeam.Upload.Item in Synology Moments before 1.3.0-0691 allows remote…

Synology Photo Moments

Jun 30, 2019
High 7.5

CVE-2018-13296

Uncontrolled resource consumption vulnerability in TLS configuration in Synology MailPlus Server before 2.0.5-0606 allo…

Synology MailPlus Server

Apr 1, 2019

Synology

Products

Missing authorization vulnerability in GetStmUrlPath webapi component in Synology Surveillance Station before 9.2.0-928…

Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in Directory D…

Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in DHCP Client…

Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in CGI…

Missing authentication for critical function vulnerability in iSCSI management functionality in Synology DiskStation Ma…

Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in webapi comp…

Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in cgi component in Synology Audio…

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Syn…

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in webapi component …

Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in task manage…

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in cgi component in Synolo…

Session fixation vulnerability in access control management in Synology Photo Station before 6.8.16-3506 allows remote …

Improper neutralization of special elements used in a command ('Command Injection') vulnerability in File service funct…

Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in Sec…

Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in fil…

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Syn…

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in PHP component in …

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in file management compone…

Server-Side request forgery (SSRF) vulnerability in task management component in Synology Download Station before 3.8.1…

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability container volume managemen…

Improper limitation of a pathname to a restricted directory ('Path Traversal') in cgi component in Synology DiskStation…

Unrestricted upload of file with dangerous type vulnerability in file management component in Synology Photo Station be…

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in cgi component in …

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Synology Di…

Improper neutralization of special elements used in an OS command in SYNO.Core.Network.PPPoE in Synology DiskStation Ma…

Insertion of sensitive information into sent data vulnerability in synorelayd in Synology DiskStation Manager (DSM) bef…

Cleartext transmission of sensitive information vulnerability in synorelayd in Synology DiskStation Manager (DSM) befor…

Incorrect authorization vulnerability in synoagentregisterd in Synology DiskStation Manager (DSM) before 6.2.4-25553 al…

Cleartext transmission of sensitive information vulnerability in synorelayd in Synology DiskStation Manager (DSM) befor…

Multiple cross-site scripting (XSS) vulnerabilities in Synology SafeAccess before 1.2.3-0234 allow remote attackers to …

Algorithm downgrade vulnerability in QuickConnect in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man…

Improper certificate validation vulnerability in OpenVPN client in Synology DiskStation Manager (DSM) before 6.2.3-2542…

Synology Router Manager (SRM) before 1.2.4-8081 does not include the HTTPOnly flag in a Set-Cookie header for the sessi…

Algorithm downgrade vulnerability in QuickConnect in Synology Router Manager (SRM) before 1.2.4-8081 allows man-in-the-…

Improper certificate validation vulnerability in OpenVPN client in Synology Router Manager (SRM) before 1.2.4-8081 allo…

CRLF injection vulnerability in Network Center in Synology Router Manager (SRM) before 1.2.3-8017-2 allows remote attac…

OS command injection vulnerability in drivers_syno_import_user.php in Synology Calendar before 2.3.1-0617 allows remote…

SQL injection vulnerability in synophoto_csPhotoDB.php in Synology Photo Station before 6.8.11-3489 and before 6.3-2977…

Relative path traversal vulnerability in SYNO.PhotoTeam.Upload.Item in Synology Moments before 1.3.0-0691 allows remote…

Uncontrolled resource consumption vulnerability in TLS configuration in Synology MailPlus Server before 2.0.5-0606 allo…