Записи Synology
352 опубликованных записей вендора synology.
Профиль для исследователя
- Попали в KEV
- 2 · 0,6 %
- С эксплойтом
- 6 · 1,7 %
- Pre-auth RCE
- 44
- С записью об исправлении
- 40,3 %
- Медиана: публикация → KEV
- 439 дн.
Повторяющиеся классы
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')47
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')37
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')25
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor18
- CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')15
- CWE-400 Uncontrolled Resource Consumption11
Классы уязвимостей, которые чаще всего встречаются у этого вендора: куда смотреть.
CWEВсе записи
352 записей| Срочность | CVE | Уязвимость | Критичность | KEV | EPSS | Опубликовано |
|---|---|---|---|---|---|---|
91Срочно | CVE-2021-3156Готовый эксплойт | Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root sudo project · sudo · CWE-193 | Высокая7,8 | KEV | 99,9 % | 26 янв. 2021 г. |
82Срочно | CVE-2020-1472Готовый эксплойт | Netlogon Elevation of Privilege Vulnerabilitymicrosoft · windows server 1903 | Средняя5,5 | KEV | 99,3 % | 17 авг. 2020 г. |
65На этой неделе | CVE-2017-14491Proof of concept | Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code viathekelleys · dnsmasq · CWE-787 | Критическая9,8 | — | 86,4 % | 3 окт. 2017 г. |
65На этой неделе | CVE-2018-1160Proof of concept | Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsi_opensess.c.netatalk · netatalk · CWE-787 | Критическая9,8 | — | 86,4 % | 20 дек. 2018 г. |
65На этой неделе | CVE-2013-6955Готовый эксплойт | webman/imageSelector.cgi in Synology DiskStation Manager (DSM) 4.0 before 4.0-2259, 4.2 before 4.2-3243, and 4.3 before 4.3-3810 Update 1 alsynology · diskstation manager · CWE-264 | Критическая10,0 | — | 84,5 % | 9 янв. 2014 г. |
60На этой неделе | CVE-2017-9554Готовый эксплойт | An information exposure vulnerability in forget_passwd.cgi in Synology DiskStation Manager (DSM) before 6.1.3-15152 allows remote attackers synology · diskstation manager · CWE-200 | Средняя5,3 | — | 76,7 % | 24 июл. 2017 г. |
57В плане | CVE-2017-15889Готовый эксплойт | Command injection vulnerability in smart.cgi in Synology DiskStation Manager (DSM) before 5.2-5967-5 allows remote authenticated users to exsynology · diskstation manager · CWE-77 | Высокая8,8 | — | 73,6 % | 4 дек. 2017 г. |
57В плане | CVE-2021-44142Proof of concept | The Samba vfs_fruit module uses extended file attributes (EA, xattr) to provide "...enhanced compatibility with Apple SMB clients and interosamba · samba · CWE-125 | Высокая8,8 | — | 73,5 % | 21 февр. 2022 г. |
56В плане | CVE-2019-9515Эксплойта нет | Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of serviceapple · swiftnio · CWE-400 | Высокая7,5 | — | 87,2 % | 13 авг. 2019 г. |
55В плане | CVE-2019-9514Эксплойта нет | Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of serviceapple · swiftnio · CWE-400 | Высокая7,5 | — | 82,8 % | 13 авг. 2019 г. |
54В плане | CVE-2019-9513Эксплойта нет | Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of serviceapple · swiftnio · CWE-400 | Высокая7,5 | — | 81,5 % | 13 авг. 2019 г. |
51В плане | CVE-2016-10329Эксплойта нет | Command injection vulnerability in login.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to execute arbitrary code vsynology · photo station · CWE-77 | Критическая9,8 | — | 40,8 % | 12 мая 2017 г. |
50В плане | CVE-2017-5753Proof of concept | Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an atintel · atom c · CWE-203 | Средняя5,6 | — | 93,8 % | 4 янв. 2018 г. |
48В плане | CVE-2019-9511Proof of concept | Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of serviceapple · swiftnio · CWE-400 | Высокая7,5 | — | 59,5 % | 13 авг. 2019 г. |
48В плане | CVE-2024-10443Proof of concept | Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in Task Manager component in Synolosynology · photos · CWE-78 | Критическая9,8 | — | 28,5 % | 15 нояб. 2024 г. |
45В плане | CVE-2022-43931Эксплойта нет | Out-of-bounds write vulnerability in Remote Desktop Functionality in Synology VPN Plus Server before 1.4.3-0534 and 1.4.4-0635 allows remotesynology · vpn plus server · CWE-787 | Критическая10,0 | — | 16,8 % | 3 янв. 2023 г. |
44В плане | CVE-2017-11155Proof of concept | An information exposure vulnerability in index.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to obtaisynology · photo station · CWE-205 | Высокая7,5 | — | 47,4 % | 8 авг. 2017 г. |
44В плане | CVE-2017-11151Proof of concept | A vulnerability in synotheme_upload.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to upload arbitrarysynology · photo station · CWE-287 | Критическая9,8 | — | 16,2 % | 8 авг. 2017 г. |
44В плане | CVE-2015-6912Proof of concept | Synology Video Station before 1.5-0763 allows remote attackers to execute arbitrary shell commands via shell metacharacters in the subtitle_synology · video station · CWE-77 | Критическая10,0 | — | 11,7 % | 11 сент. 2015 г. |
43В плане | CVE-2019-9516Эксплойта нет | Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of serviceapple · swiftnio · CWE-400 | Средняя6,5 | — | 57,4 % | 13 авг. 2019 г. |
43В плане | CVE-2017-11153Proof of concept | Deserialization vulnerability in synophoto_csPhotoMisc.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers synology · photo station · CWE-502 | Критическая9,8 | — | 12,1 % | 8 авг. 2017 г. |
41В плане | CVE-2020-27655Эксплойта нет | Improper access control vulnerability in Synology Router Manager (SRM) before 1.2.4-8081 allows remote attackers to access restricted resoursynology · router manager · CWE-269 | Критическая10,0 | — | 1,7 % | 29 окт. 2020 г. |
40В плане | CVE-2018-8897Готовый эксплойт | A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the debian · debian linux · CWE-362 | Высокая7,8 | — | 18,4 % | 8 мая 2018 г. |
40В плане | CVE-2020-27654Эксплойта нет | Improper access control vulnerability in lbd in Synology Router Manager (SRM) before 1.2.4-8081 allows remote attackers to execute arbitrarysynology · router manager · CWE-269 | Критическая9,8 | — | 4,6 % | 29 окт. 2020 г. |
40В плане | CVE-2020-27660Эксплойта нет | SQL injection vulnerability in request.cgi in Synology SafeAccess before 1.2.3-0234 allows remote attackers to execute arbitrary SQL commandsynology · safeaccess · CWE-89 | Критическая9,8 | — | 4,6 % | 30 нояб. 2020 г. |
- CVE-2021-315691Срочно
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root
ВысокаяCVSS 7,8KEVГотовый эксплойтEPSS 99 %sudo project · sudo26 янв. 2021 г.
- CVE-2020-147282Срочно
Netlogon Elevation of Privilege Vulnerability
СредняяCVSS 5,5KEVГотовый эксплойтEPSS 99 %microsoft · windows server 190317 авг. 2020 г.
- CVE-2017-1449165На этой неделе
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via
КритическаяCVSS 9,8Proof of conceptEPSS 86 %thekelleys · dnsmasq3 окт. 2017 г.
- CVE-2018-116065На этой неделе
Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsi_opensess.c.
КритическаяCVSS 9,8Proof of conceptEPSS 86 %netatalk · netatalk20 дек. 2018 г.
- CVE-2013-695565На этой неделе
webman/imageSelector.cgi in Synology DiskStation Manager (DSM) 4.0 before 4.0-2259, 4.2 before 4.2-3243, and 4.3 before 4.3-3810 Update 1 al
КритическаяCVSS 10,0Готовый эксплойтEPSS 84 %synology · diskstation manager9 янв. 2014 г.
- CVE-2017-955460На этой неделе
An information exposure vulnerability in forget_passwd.cgi in Synology DiskStation Manager (DSM) before 6.1.3-15152 allows remote attackers
СредняяCVSS 5,3Готовый эксплойтEPSS 76 %synology · diskstation manager24 июл. 2017 г.
- CVE-2017-1588957В плане
Command injection vulnerability in smart.cgi in Synology DiskStation Manager (DSM) before 5.2-5967-5 allows remote authenticated users to ex
ВысокаяCVSS 8,8Готовый эксплойтEPSS 73 %synology · diskstation manager4 дек. 2017 г.
- CVE-2021-4414257В плане
The Samba vfs_fruit module uses extended file attributes (EA, xattr) to provide "...enhanced compatibility with Apple SMB clients and intero
ВысокаяCVSS 8,8Proof of conceptEPSS 73 %samba · samba21 февр. 2022 г.
- CVE-2019-951556В плане
Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service
ВысокаяCVSS 7,5Эксплойта нетEPSS 87 %apple · swiftnio13 авг. 2019 г.
- CVE-2019-951455В плане
Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service
ВысокаяCVSS 7,5Эксплойта нетEPSS 82 %apple · swiftnio13 авг. 2019 г.
- CVE-2019-951354В плане
Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service
ВысокаяCVSS 7,5Эксплойта нетEPSS 81 %apple · swiftnio13 авг. 2019 г.
- CVE-2016-1032951В плане
Command injection vulnerability in login.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to execute arbitrary code v
КритическаяCVSS 9,8Эксплойта нетEPSS 40 %synology · photo station12 мая 2017 г.
- CVE-2017-575350В плане
Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an at
СредняяCVSS 5,6Proof of conceptEPSS 93 %intel · atom c4 янв. 2018 г.
- CVE-2019-951148В плане
Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service
ВысокаяCVSS 7,5Proof of conceptEPSS 59 %apple · swiftnio13 авг. 2019 г.
- CVE-2024-1044348В плане
Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in Task Manager component in Synolo
КритическаяCVSS 9,8Proof of conceptEPSS 28 %synology · photos15 нояб. 2024 г.
- CVE-2022-4393145В плане
Out-of-bounds write vulnerability in Remote Desktop Functionality in Synology VPN Plus Server before 1.4.3-0534 and 1.4.4-0635 allows remote
КритическаяCVSS 10,0Эксплойта нетEPSS 16 %synology · vpn plus server3 янв. 2023 г.
- CVE-2017-1115544В плане
An information exposure vulnerability in index.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to obtai
ВысокаяCVSS 7,5Proof of conceptEPSS 47 %synology · photo station8 авг. 2017 г.
- CVE-2017-1115144В плане
A vulnerability in synotheme_upload.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to upload arbitrary
КритическаяCVSS 9,8Proof of conceptEPSS 16 %synology · photo station8 авг. 2017 г.
- CVE-2015-691244В плане
Synology Video Station before 1.5-0763 allows remote attackers to execute arbitrary shell commands via shell metacharacters in the subtitle_
КритическаяCVSS 10,0Proof of conceptEPSS 11 %synology · video station11 сент. 2015 г.
- CVE-2019-951643В плане
Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service
СредняяCVSS 6,5Эксплойта нетEPSS 57 %apple · swiftnio13 авг. 2019 г.
- CVE-2017-1115343В плане
Deserialization vulnerability in synophoto_csPhotoMisc.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers
КритическаяCVSS 9,8Proof of conceptEPSS 12 %synology · photo station8 авг. 2017 г.
- CVE-2020-2765541В плане
Improper access control vulnerability in Synology Router Manager (SRM) before 1.2.4-8081 allows remote attackers to access restricted resour
КритическаяCVSS 10,0Эксплойта нетEPSS 1 %synology · router manager29 окт. 2020 г.
- CVE-2018-889740В плане
A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the
ВысокаяCVSS 7,8Готовый эксплойтEPSS 18 %debian · debian linux8 мая 2018 г.
- CVE-2020-2765440В плане
Improper access control vulnerability in lbd in Synology Router Manager (SRM) before 1.2.4-8081 allows remote attackers to execute arbitrary
КритическаяCVSS 9,8Эксплойта нетEPSS 4 %synology · router manager29 окт. 2020 г.
- CVE-2020-2766040В плане
SQL injection vulnerability in request.cgi in Synology SafeAccess before 1.2.3-0234 allows remote attackers to execute arbitrary SQL command
КритическаяCVSS 9,8Эксплойта нетEPSS 4 %synology · safeaccess30 нояб. 2020 г.