synology download station 3.5-2982 vulnerabilities and exploits

(subscribe to this query)

Server-side request forgery (SSRF) vulnerability in Downloader in Synology Download Station 3.8.x prior to 3.8.5-3475 and 3.x prior to 3.5-2984 allows remote authenticated users to download arbitrary local files via crafted URI.

Synology Download Station 3.8.x prior to 3.8.5-3475 and 3.x prior to 3.5-2984 uses weak permissions (0777) for ui/dlm/btsearch directory, which allows remote authenticated users to execute arbitrary code by uploading an executable via unspecified vectors.

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Product List Vendor List Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook