Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
synology vulnerabilities and exploits
(subscribe to this query)
312
VMScore
CVE-2018-8921
Cross-site scripting (XSS) vulnerability in File Sharing Notify Toast in Synology Drive prior to 1.0.2-10275 allows remote authenticated users to inject arbitrary web script or HTML via the malicious file name.
Synology Drive
312
VMScore
CVE-2018-8924
Cross-site scripting (XSS) vulnerability in Title Tootip in Synology Office prior to 3.0.3-2143 allows remote authenticated users to inject arbitrary web script or HTML via the malicious file name.
Synology Office
356
VMScore
CVE-2018-8927
Improper authorization vulnerability in SYNO.Cal.Event in Calendar prior to 2.1.2-0511 allows remote authenticated users to create arbitrary events via the (1) cal_id or (2) original_cal_id parameter.
Synology Calendar
445
VMScore
CVE-2018-13297
Information exposure vulnerability in SYNO.SynologyDrive.Files in Synology Drive prior to 1.1.2-10562 allows remote malicious users to obtain sensitive system information via the dsm_path parameter.
Synology Drive
605
VMScore
CVE-2018-13298
Channel accessible by non-endpoint vulnerability in privacy page in Synology Android Moments prior to 1.2.3-199 allows man-in-the-middle malicious users to execute arbitrary code via unspecified vectors.
Synology Moments
356
VMScore
CVE-2018-13299
Relative path traversal vulnerability in Attachment Uploader in Synology Calendar prior to 2.2.2-0532 allows remote authenticated users to upload arbitrary files via the filename parameter.
Synology Calendar
NA
CVE-2022-27614
Exposure of sensitive information to an unauthorized actor vulnerability in web server in Synology Media Server prior to 1.8.1-2876 allows remote malicious users to obtain sensitive information via unspecified vectors.
Synology Media Server
NA
CVE-2022-27617
Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology Calendar prior to 2.3.4-0631 allows remote authenticated users to download arbitrary files via unspecified vectors.
Synology Calendar
NA
CVE-2022-27618
Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology Storage Analyzer prior to 2.1.0-0390 allows remote authenticated users to delete arbitrary files via unspecified vectors.
Synology Storage Analyzer
NA
CVE-2022-27620
Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology SSO Server prior to 2.2.3-0331 allows remote authenticated users to read arbitrary files via unspecified vectors.
Synology Sso Server
VMScore
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2020-4463
CVE-2024-3400
deserialization
CVE-2024-21788
CVE-2023-42433
CVE-2024-21841
CVE-2024-22095
local file inclusion
memory leak
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
3
4
5
6
7
8
9
10
NEXT »