Vulnerabilities > Synology

DATE CVE VULNERABILITY TITLE RISK
2022-03-25 CVE-2022-22687 Classic Buffer Overflow vulnerability in Synology products
Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in Authentication functionality in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via unspecified vectors.
network
low complexity
synology CWE-120
7.5
2022-03-25 CVE-2022-22688 Command Injection vulnerability in Synology Diskstation Manager
Improper neutralization of special elements used in a command ('Command Injection') vulnerability in File service functionality in Synology DiskStation Manager (DSM) before 6.2.4-25556-2 allows remote authenticated users to execute arbitrary commands via unspecified vectors.
network
low complexity
synology CWE-77
6.5
2022-02-21 CVE-2021-44142 Out-of-bounds Write vulnerability in multiple products
The Samba vfs_fruit module uses extended file attributes (EA, xattr) to provide "...enhanced compatibility with Apple SMB clients and interoperability with a Netatalk 3 AFP fileserver." Samba versions prior to 4.13.17, 4.14.12 and 4.15.5 with vfs_fruit configured allow out-of-bounds heap read and write via specially crafted extended file attributes.
network
low complexity
samba debian canonical synology fedoraproject redhat CWE-787
critical
9.0
2022-02-07 CVE-2021-43925 SQL Injection vulnerability in Synology Diskstation Manager
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Log Management functionality in Synology DiskStation Manager (DSM) before 7.0.1-42218-2 allows remote attackers to inject SQL commands via unspecified vectors.
network
low complexity
synology CWE-89
7.5
2022-02-07 CVE-2021-43926 SQL Injection vulnerability in Synology Diskstation Manager
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Log Management functionality in Synology DiskStation Manager (DSM) before 7.0.1-42218-2 allows remote attackers to inject SQL commands via unspecified vectors.
network
low complexity
synology CWE-89
7.5
2022-02-07 CVE-2021-43927 SQL Injection vulnerability in Synology Diskstation Manager
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Security Management functionality in Synology DiskStation Manager (DSM) before 7.0.1-42218-2 allows remote attackers to inject SQL commands via unspecified vectors.
network
low complexity
synology CWE-89
7.5
2022-02-07 CVE-2021-43928 OS Command Injection vulnerability in Synology Mail Station
Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in mail sending and receiving component in Synology Mail Station before 20211105-10315 allows remote authenticated users to execute arbitrary commands via unspecified vectors.
network
low complexity
synology CWE-78
6.5
2022-02-07 CVE-2021-43929 Injection vulnerability in Synology Diskstation Manager
Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in work flow management in Synology DiskStation Manager (DSM) before 7.0.1-42218-2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
network
low complexity
synology CWE-74
4.0
2022-02-07 CVE-2022-22679 Path Traversal vulnerability in Synology Diskstation Manager
Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in support service management in Synology DiskStation Manager (DSM) before 7.0.1-42218-2 allows remote authenticated users to write arbitrary files via unspecified vectors.
network
low complexity
synology CWE-22
4.0
2022-02-07 CVE-2022-22680 Unspecified vulnerability in Synology Diskstation Manager
Exposure of sensitive information to an unauthorized actor vulnerability in Web Server in Synology DiskStation Manager (DSM) before 7.0.1-42218-2 allows remote attackers to obtain sensitive information via unspecified vectors.
network
low complexity
synology
5.0