Skip to content
OpenAdvisories

Vendor

Synology

344 known vulnerabilities.

Products

DiskStation Manager (DSM) 99 Synology Router Manager (SRM) 43 Surveillance Station 25 Synology Photo Station 18 Synology DiskStation Manager (DSM) 13 Photo Station 12 Camera Firmware 9 Calendar 6 Unified Controller (DSMUC) 6 BeeDrive for desktop 6 Synology Drive Client 6 Media Server 5 Synology Calendar 5 Synology Active Backup for Business Agent 5 Note Station 4 Drive 4 Active Backup for Business 4 Synology SSL VPN Client 3 Download Station 3 Audio Station 3 Synology Chat Server 3 BeeStation OS (BSM) 3 Safe Access 3 Synology Download Station 3 Synology Video Station 2 Office 2 Application Service 2 Presto File Server 2 Synology Drive Server 2 File Station 2 SSL VPN Client 2 Chat 2 CardDAV Server 2 Hyper Backup 2 Synology Note Station Client 2 MailPlus Server 2 SSO Server 2 Synology Assistant 2 Synology Docker 1 VPN Plus Server 1
All Critical High Medium Low Exploited only Public exploit

344 results · Feed

  • Medium 5.6
    CVE-2018-13282

    Session fixation vulnerability in SYNO.PhotoStation.Auth in Synology Photo Station before 6.8.7-3481 allows remote atta…

    Synology Photo Station
  • High 7.4
    CVE-2018-13280

    Use of insufficiently random values vulnerability in SYNO.Encryption.GenRandomKey in Synology DiskStation Manager (DSM)…

    Synology DiskStation Manager (DSM)
  • Unscored —
    CVE-2016-6554

    Synology NAS servers DS107, DS116, and DS213, use default credentials

    Synology NAS servers DS107, firmware version 3.1-1639 and prior, and DS116, DS213, firmware versions prior to 5.2-5644-1, use non-random default credentials of: guest:(blank) and admin:(blank) . A remote network attacker can gain privileged access to a vulner…

    Synology NAS server DS116 NAS server DS107 NAS server DS213
  • High 7.3
    CVE-2018-8929

    Improper restriction of communication channel to intended endpoints vulnerability in HTTP daemon in Synology SSL VPN Cl…

    Synology SSL VPN Client
  • Medium 6.5
    CVE-2018-8928

    Cross-site scripting (XSS) vulnerability in Address Book Editor in Synology CardDAV Server before 6.0.8-0086 allows rem…

    Synology CardDAV Server
  • Medium 6.5
    CVE-2017-16773

    Improper authorization vulnerability in Highlight Preview in Synology Universal Search before 1.0.5-0135 allows remote …

    Synology Universal Search
  • Medium 5.4
    CVE-2018-8927

    Improper authorization vulnerability in SYNO.Cal.Event in Calendar before 2.1.2-0511 allows remote authenticated users …

    Synology Calendar
  • Medium 6.3
    CVE-2018-8916

    Unverified password change vulnerability in Change Password in Synology DiskStation Manager (DSM) before 6.2-23739 allo…

    Synology DiskStation Manager (DSM)
  • High 8.8
    CVE-2018-8925

    Cross-site request forgery (CSRF) vulnerability in admin/user.php in Synology Photo Station before 6.8.5-3471 and befor…

    Synology Photo Station
  • High 8.8
    CVE-2018-8926

    Permissive regular expression vulnerability in synophoto_dsm_user in Synology Photo Station before 6.8.5-3471 and befor…

    Synology Photo Station
  • High 7.2
    CVE-2017-12075

    Command injection vulnerability in EZ-Internet in Synology DiskStation Manager (DSM) before 6.2-23739 allows remote aut…

    Synology DiskStation Manager (DSM)
  • High 7.2
    CVE-2017-12078

    Command injection vulnerability in EZ-Internet in Synology Router Manager (SRM) before 1.1.6-6931 allows remote authent…

    Synology Synology Router Manager (SRM)
  • Medium 6.5
    CVE-2018-8924

    Cross-site scripting (XSS) vulnerability in Title Tootip in Synology Office before 3.0.3-2143 allows remote authenticat…

    Synology Office
  • Medium 6.5
    CVE-2018-8923

    Cross-site scripting (XSS) vulnerability in Attachment Preview in Synology File Station before 1.1.4-0122 allows remote…

    Synology File Station
  • Medium 6.5
    CVE-2018-8921

    Cross-site scripting (XSS) vulnerability in File Sharing Notify Toast in Synology Drive before 1.0.2-10275 allows remot…

    Synology Drive
  • Medium 6.5
    CVE-2018-8922

    Improper access control vulnerability in Synology Drive before 1.0.2-10275 allows remote authenticated users to access …

    Synology Drive
  • Medium 6.5
    CVE-2018-8915

    Cross-site scripting (XSS) vulnerability in Notification Center in Synology Calendar before 2.1.1-0502 allows remote au…

    Synology Calendar
  • Medium 6.5
    CVE-2018-8910

    Cross-site scripting (XSS) vulnerability in Attachment Preview in Synology Drive before 1.0.1-10253 allows remote authe…

    Synology Drive
  • High 7.3
    CVE-2018-8914

    SQL injection vulnerability in UPnP DMA in Synology Media Server before 1.7.6-2842 and before 1.4-2654 allows remote at…

    Synology Media Server
  • Medium 6.5
    CVE-2018-8912

    Cross-site scripting (XSS) vulnerability in SYNO.NoteStation.Note in Synology Note Station before 2.5.1-0844 allows rem…

    Synology Note Station
  • Medium 6.5
    CVE-2018-8911

    Cross-site scripting (XSS) vulnerability in Attachment Preview in Synology Note Station before 2.5.1-0844 allows remote…

    Synology Note Station
  • Unscored —
    CVE-2017-16772

    Improper input validation vulnerability in SYNOPHOTO_Flickr_MultiUpload in Synology Photo Station before 6.8.3-3463 and…

    Synology Photo Station
  • Unscored —
    CVE-2017-16771

    Cross-site scripting (XSS) vulnerability in Log Viewer in Synology Photo Station before 6.8.3-3463 and before 6.3-2971 …

    Synology Photo Station
  • Unscored —
    CVE-2017-16770

    File and directory information exposure vulnerability in SYNO.SurveillanceStation.PersonalSettings.Photo in Synology Su…

    Synology Surveillance Station
  • Unscored —
    CVE-2017-16767

    Cross-site scripting (XSS) vulnerability in User Profile in Synology Surveillance Station before 8.1.2-5469 allows remo…

    Synology Surveillance Station
  • Unscored —
    CVE-2017-16769

    Exposure of private information vulnerability in Photo Viewer in Synology Photo Station 6.8.1-3458 allows remote attack…

    Synology Synology Photo Station
  • Unscored —
    CVE-2017-15892

    Multiple cross-site scripting (XSS) vulnerabilities in Slash Command Creator in Synology Chat before 2.0.0-1124 allow r…

    Synology Chat
  • Unscored —
    CVE-2017-15886

    Server-side request forgery (SSRF) vulnerability in Link Preview in Synology Chat before 2.0.0-1124 allows remote authe…

    Synology Chat
  • Unscored —
    CVE-2017-16766

    An improper access control vulnerability in synodsmnotify in Synology DiskStation Manager (DSM) before 6.1.4-15217 and …

    Synology DiskStation Manager (DSM)
  • Unscored —
    CVE-2017-12072

    Cross-site scripting (XSS) vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.8.0-3456 allows r…

    Synology Photo Station
  • Unscored —
    CVE-2017-15890

    Cross-site scripting (XSS) vulnerability in Disclaimer in Synology MailPlus Server before 1.4.0-0415 allows remote auth…

    Synology MailPlus Server
  • Unscored —
    CVE-2017-15893

    Directory traversal vulnerability in the SYNO.FileStation.Extract in Synology File Station before 1.1.1-0099 allows rem…

    Synology Synology File Station
  • Unscored —
    CVE-2017-15895

    Directory traversal vulnerability in the SYNO.FileStation.Extract in Synology Router Manager (SRM) before 1.1.5-6542-4 …

    Synology Synology Router Manager (SRM)
  • Unscored —
    CVE-2017-15891

    Improper access control vulnerability in SYNO.Cal.EventBase in Synology Calendar before 2.0.1-0242 allows remote authen…

    Synology Synology Calendar
  • Unscored —
    CVE-2017-15894

    Directory traversal vulnerability in the SYNO.FileStation.Extract in Synology DiskStation Manager (DSM) 6.0.x before 6.…

    Synology Synology DiskStation Manager (DSM)
  • Unscored —
    CVE-2017-12079

    Files or directories accessible to external parties vulnerability in picasa.php in Synology Photo Station before 6.8.1-…

    Synology Photo Station
  • Unscored —
    CVE-2017-12080

    An information exposure vulnerability in default HTTP configuration file in Synology Photo Station before 6.8.1-3458 an…

    Synology Photo Station
  • Unscored —
    CVE-2017-15889 Public exploit EPSS 74%

    Command injection vulnerability in smart.cgi in Synology DiskStation Manager (DSM) before 5.2-5967-5 allows remote auth…

    Synology DiskStation Manager (DSM)
  • Unscored —
    CVE-2017-15887

    An improper restriction of excessive authentication attempts vulnerability in /principals in Synology CardDAV Server be…

    Synology Synology CardDAV Server
  • Unscored —
    CVE-2017-15888

    Cross-site scripting (XSS) vulnerability in Custom Internet Radio List in Synology Audio Station before 6.3.0-3260 allo…

    Synology Synology Audio Station