Skip to content
Noroxi

Synology records

352 published records for vendor synology.

Researcher profile

Entered KEV
2 · 0.6%
Weaponized
6 · 1.7%
Pre-auth RCE
44
With a fix record
40.3%
Median publish → KEV
439 days

Records by year

  1. 17
  2. 18
  3. 19
  4. 20
  5. 21
  6. 22
  7. 23
  8. 24
  9. 25
  10. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

352 records
  • CVE-2021-3156
    91Now

    Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root

    HighCVSS 7.8KEVWeaponizedEPSS 99%

    sudo project · sudoJan 26, 2021

  • CVE-2020-1472
    82Now

    Netlogon Elevation of Privilege Vulnerability

    MediumCVSS 5.5KEVWeaponizedEPSS 99%

    microsoft · windows server 1903Aug 17, 2020

  • CVE-2017-14491
    65This week

    Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via

    CriticalCVSS 9.8Proof of conceptEPSS 86%

    thekelleys · dnsmasqOct 3, 2017

  • CVE-2018-1160
    65This week

    Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsi_opensess.c.

    CriticalCVSS 9.8Proof of conceptEPSS 86%

    netatalk · netatalkDec 20, 2018

  • CVE-2013-6955
    65This week

    webman/imageSelector.cgi in Synology DiskStation Manager (DSM) 4.0 before 4.0-2259, 4.2 before 4.2-3243, and 4.3 before 4.3-3810 Update 1 al

    CriticalCVSS 10.0WeaponizedEPSS 84%

    synology · diskstation managerJan 9, 2014

  • CVE-2017-9554
    60This week

    An information exposure vulnerability in forget_passwd.cgi in Synology DiskStation Manager (DSM) before 6.1.3-15152 allows remote attackers

    MediumCVSS 5.3WeaponizedEPSS 76%

    synology · diskstation managerJul 24, 2017

  • CVE-2017-15889
    57Plan

    Command injection vulnerability in smart.cgi in Synology DiskStation Manager (DSM) before 5.2-5967-5 allows remote authenticated users to ex

    HighCVSS 8.8WeaponizedEPSS 73%

    synology · diskstation managerDec 4, 2017

  • CVE-2021-44142
    57Plan

    The Samba vfs_fruit module uses extended file attributes (EA, xattr) to provide "...enhanced compatibility with Apple SMB clients and intero

    HighCVSS 8.8Proof of conceptEPSS 73%

    samba · sambaFeb 21, 2022

  • CVE-2019-9515
    56Plan

    Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service

    HighCVSS 7.5No exploitEPSS 87%

    apple · swiftnioAug 13, 2019

  • CVE-2019-9514
    55Plan

    Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service

    HighCVSS 7.5No exploitEPSS 82%

    apple · swiftnioAug 13, 2019

  • CVE-2019-9513
    54Plan

    Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service

    HighCVSS 7.5Proof of conceptEPSS 81%

    apple · swiftnioAug 13, 2019

  • CVE-2016-10329
    51Plan

    Command injection vulnerability in login.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to execute arbitrary code v

    CriticalCVSS 9.8No exploitEPSS 40%

    synology · photo stationMay 12, 2017

  • CVE-2017-5753
    50Plan

    Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an at

    MediumCVSS 5.6Proof of conceptEPSS 93%

    intel · atom cJan 4, 2018

  • CVE-2019-9511
    48Plan

    Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service

    HighCVSS 7.5Proof of conceptEPSS 59%

    apple · swiftnioAug 13, 2019

  • CVE-2024-10443
    48Plan

    Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in Task Manager component in Synolo

    CriticalCVSS 9.8Proof of conceptEPSS 28%

    synology · photosNov 15, 2024

  • CVE-2022-43931
    45Plan

    Out-of-bounds write vulnerability in Remote Desktop Functionality in Synology VPN Plus Server before 1.4.3-0534 and 1.4.4-0635 allows remote

    CriticalCVSS 10.0No exploitEPSS 16%

    synology · vpn plus serverJan 3, 2023

  • CVE-2017-11155
    44Plan

    An information exposure vulnerability in index.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to obtai

    HighCVSS 7.5Proof of conceptEPSS 47%

    synology · photo stationAug 8, 2017

  • CVE-2017-11151
    44Plan

    A vulnerability in synotheme_upload.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to upload arbitrary

    CriticalCVSS 9.8Proof of conceptEPSS 16%

    synology · photo stationAug 8, 2017

  • CVE-2015-6912
    44Plan

    Synology Video Station before 1.5-0763 allows remote attackers to execute arbitrary shell commands via shell metacharacters in the subtitle_

    CriticalCVSS 10.0Proof of conceptEPSS 11%

    synology · video stationSep 11, 2015

  • CVE-2019-9516
    43Plan

    Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service

    MediumCVSS 6.5No exploitEPSS 57%

    apple · swiftnioAug 13, 2019

  • CVE-2017-11153
    43Plan

    Deserialization vulnerability in synophoto_csPhotoMisc.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers

    CriticalCVSS 9.8Proof of conceptEPSS 12%

    synology · photo stationAug 8, 2017

  • CVE-2020-27655
    41Plan

    Improper access control vulnerability in Synology Router Manager (SRM) before 1.2.4-8081 allows remote attackers to access restricted resour

    CriticalCVSS 10.0No exploitEPSS 1%

    synology · router managerOct 29, 2020

  • CVE-2018-8897
    40Plan

    A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the

    HighCVSS 7.8WeaponizedEPSS 18%

    debian · debian linuxMay 8, 2018

  • CVE-2020-27654
    40Plan

    Improper access control vulnerability in lbd in Synology Router Manager (SRM) before 1.2.4-8081 allows remote attackers to execute arbitrary

    CriticalCVSS 9.8No exploitEPSS 4%

    synology · router managerOct 29, 2020

  • CVE-2020-27660
    40Plan

    SQL injection vulnerability in request.cgi in Synology SafeAccess before 1.2.3-0234 allows remote attackers to execute arbitrary SQL command

    CriticalCVSS 9.8No exploitEPSS 4%

    synology · safeaccessNov 30, 2020