DM
Product
Diskstation Manager
On CISA KEVExploited in the wild
96
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 18High 45Medium 25Low 2
Watch
Add Diskstation Manager to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-9517 | 7.5 | Aug 13 | Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service Affected: 6.2 |
| CVE-2019-9515 | 7.5 | Aug 13 | Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service Affected: 6.2 |
| CVE-2019-9514 | 7.5 | Aug 13 | Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service Affected: 6.2 |
| CVE-2019-9513 | 7.5 | Aug 13 | Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service Affected: 6.2 |
| CVE-2019-9511 | 7.5 | Aug 13 | Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service Affected: 6.2 |
| CVE-2018-7185 | 7.5 | Mar 6 | The protocol engine in ntp 4.2.6 before 4.2.8p11 allows a remote attackers to cause a denial of service (disruption) by continually sending a packet with a zero-origin timestamp… Affected: 5.2 before 6.1.6-15266 |
| CVE-2018-7184 | 7.5 | Mar 6 | ntpd in ntp 4.2.8p4 before 4.2.8p11 drops bad packets before updating the "received" timestamp, which allows remote attackers to cause a denial of service (disruption) by sending… Affected: 5.2; 6.0; 6.1 |
| CVE-2017-9553 | 7.5 | Jul 24 | A design flaw in SYNO.API.Encryption in Synology DiskStation Manager (DSM) before 6.1.3-15152 allows remote attackers to bypass the encryption protection mechanism via the crafted… Affected: through 6.1.1-15101-4 |
| CVE-2021-26560 | 7.4 | Feb 26 | Cleartext transmission of sensitive information vulnerability in synoagentregisterd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-middle attackers… Affected: before 6.2.3-25426-3 |
| CVE-2022-27616 | 7.2 | Aug 3 | Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in webapi component in Synology DiskStation Manager (DSM) before… Affected: 6.2 before 6.2.4-25556-5; 7.0 before 7.0.1-42218-3 |
| CVE-2021-29083 | 7.2 | Apr 1 | Improper neutralization of special elements used in an OS command in SYNO.Core.Network.PPPoE in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote authenticated… Affected: before 6.2.3-25426-3 |
| CVE-2018-8920 | 7.2 | Dec 24 | Improper neutralization of escape vulnerability in Log Exporter in Synology DiskStation Manager (DSM) before 6.1.6-15266 allows remote attackers to inject arbitrary content to… Affected: before 6.1.6-15266 |
| CVE-2017-12075 | 7.2 | Jun 8 | Command injection vulnerability in EZ-Internet in Synology DiskStation Manager (DSM) before 6.2-23739 allows remote authenticated users to execute arbitrary command via the… Affected: before 6.2-23739 |
| CVE-2021-26563 | 6.7 | Feb 26 | Incorrect authorization vulnerability in synoagentregisterd in Synology DiskStation Manager (DSM) before 6.2.4-25553 allows local users to execute arbitrary code via unspecified… Affected: before 6.2.4-25553 |
| CVE-2019-19344 | 6.5 | Jan 21 | There is a use-after-free issue in all samba 4.9.x versions before 4.9.18, all samba 4.10.x versions before 4.10.12 and all samba 4.11.x versions before 4.11.5, essentially due to… Affected: 6.2 |
| CVE-2019-14907 | 6.5 | Jan 21 | All samba versions 4.9.x before 4.9.18, 4.10.x before 4.10.12 and 4.11.x before 4.11.5 have an issue where if it is set with "log level = 3" (or above) then the string obtained… Affected: 6.2 |
| CVE-2019-9516 | 6.5 | Aug 13 | Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service Affected: 6.2 |
| CVE-2018-13286 | 6.5 | Apr 1 | Incorrect default permissions vulnerability in synouser.conf in Synology Diskstation Manager (DSM) before 6.2-23739-1 allows remote authenticated users to obtain sensitive… Affected: 5.2 before 5.2-5967-8; 6.0 before 6.0.3-8754-8; 6.1 before 6.1.7-15284-1; 6.2 before 6.2-23739-1 |
| CVE-2017-16766 | 6.5 | Dec 22 | An improper access control vulnerability in synodsmnotify in Synology DiskStation Manager (DSM) before 6.1.4-15217 and before 6.0.3-8754-6 allows local users to inject arbitrary… Affected: 6.0.0 before 6.0.3-8754-6 |
| CVE-2017-15894 | 6.5 | Dec 8 | Directory traversal vulnerability in the SYNO.FileStation.Extract in Synology DiskStation Manager (DSM) 6.0.x before 6.0.3-8754-3 and before 5.2-5967-6 allows remote authenticated… Affected: 5.2 before 5.2-5967-6; 6.0 before 6.0.3-8754-3 |
| CVE-2019-3870 | 6.1 | Apr 9 | A vulnerability was found in Samba from version (including) 4.9 to versions before 4.9.6 and 4.10.2 Affected: 5.2; 6.1; 6.2 |
| CVE-2021-26565 | 5.9 | Feb 26 | Cleartext transmission of sensitive information vulnerability in synorelayd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-middle attackers to obtain… Affected: before 6.2.3-25426-3 |
| CVE-2018-13280 | 5.9 | Jul 30 | Use of insufficiently random values vulnerability in SYNO.Encryption.GenRandomKey in Synology DiskStation Manager (DSM) before 6.2-23739 allows man-in-the-middle attackers to… Affected: before 6.2-23739 |
| CVE-2024-0854 | 5.4 | Jan 24 | URL redirection to untrusted site ('Open Redirect') vulnerability in file access component in Synology DiskStation Manager (DSM) before 6.2.4-25556-8, 7.0.1-42218-7, 7.1.1-42962-7… Affected: before 7.2.1-69057-2 |
| CVE-2021-43929 | 5.4 | Feb 7 | Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in work flow management in Synology DiskStation Manager (DSM)… Affected: 6.2 before 6.2.4-25556-3; 7.0 before 7.0.1-42218-2 |
| CVE-2018-13293 | 5.4 | Apr 1 | Cross-site scripting (XSS) vulnerability in Control Panel SSO Settings in Synology DiskStation Manager (DSM) before 6.2.1-23824 allows remote authenticated users to inject… Affected: 5.2 before 6.2.1-23824 |
| CVE-2017-16774 | 5.4 | Apr 1 | Cross-site scripting (XSS) vulnerability in SYNO.Core.PersonalNotification.Event in Synology DiskStation Manager (DSM) before 6.1.4-15217-3 allows remote authenticated users to… Affected: 5.2 before 6.1.4-15217-3 |
| CVE-2018-8917 | 5.4 | Dec 24 | Cross-site scripting (XSS) vulnerability in info.cgi in Synology DiskStation Manager (DSM) before 6.1.6-15266 allows remote attackers to inject arbitrary web script or HTML via… Affected: before 6.1.6-15266 |
| CVE-2024-50629 | 5.3 | Mar 19 | Improper encoding or escaping of output vulnerability in the webapi component in Synology BeeStation OS (BSM) before 1.1-65374 and Synology DiskStation Manager (DSM) before… Affected: 7.1 before 7.1.1-42962-7; 7.2 before 7.2-64570-4; 7.2.1-69057 before 7.2.1-69057-6; 7.2.2 before 7.2.2-72806-1 |
| CVE-2024-10445 | 5.3 | Mar 19 | Improper certificate validation vulnerability in the update functionality in Synology BeeStation OS (BSM) before 1.1-65374 and Synology DiskStation Manager (DSM) before… Affected: 6.2 before 6.2.4-25556-8; 7.2 before 7.2-64570-4; 7.2.1-69057 before 7.2.1-69057-6; 7.2.2 before 7.2.2-72806-1 |
| CVE-2018-7170 | 5.3 | Mar 6 | ntpd in ntp 4.2.x before 4.2.8p7 and 4.3.x before 4.3.92 allows authenticated users that know the private symmetric key to create arbitrarily-many ephemeral associations in order… Affected: 5.2 before 6.1.6-15266 |
| CVE-2017-9554 | 5.3 | Jul 24 | An information exposure vulnerability in forget_passwd.cgi in Synology DiskStation Manager (DSM) before 6.1.3-15152 allows remote attackers to enumerate valid usernames via… Affected: through 6.1.1-15101-4 |
| CVE-2022-22679 | 4.9 | Feb 7 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in support service management in Synology DiskStation Manager (DSM) before… Affected: 6.2 before 6.2.4-25556-3; 7.0 before 7.0.1-42218-2 |
| CVE-2017-12076 | 4.9 | Aug 28 | Uncontrolled Resource Consumption vulnerability in SYNO.Core.PortForwarding.Rules in Synology DiskStation (DSM) before 6.1.1-15088 allows remote authenticated attacker to exhaust… Affected: through 6.1; 6.1.1 |
| CVE-2022-27622 | 4.3 | Oct 25 | Server-Side Request Forgery (SSRF) vulnerability in Package Center functionality in Synology DiskStation Manager (DSM) before 7.1-42661 allows remote authenticated users to access… Affected: before 7.1-42661 |
| CVE-2021-33182 | 4.3 | Jun 1 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in PDF Viewer component in Synology DiskStation Manager (DSM) before 6.2.4-25553… Affected: before 6.2.4-25553 |
| CVE-2018-13291 | 4.3 | Apr 1 | Information exposure vulnerability in /usr/syno/etc/mount.conf in Synology DiskStation Manager (DSM) before 6.2.1-23824 allows remote authenticated users to obtain sensitive… Affected: 5.2 before 6.2.1-23824 |
| CVE-2018-13281 | 4.3 | Oct 31 | Information exposure vulnerability in SYNO.Core.ACL in Synology DiskStation Manager (DSM) before 6.2-23739-2 allows remote authenticated users to determine the existence and… Affected: 6.1 before 6.1.7-15284-2; 6.2 before 6.2-23739-2; 5.2; 6.0 |
| CVE-2020-27656 | 3.7 | Oct 29 | Cleartext transmission of sensitive information vulnerability in DDNS in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-in-the-middle attackers to eavesdrop… Affected: 6.2 before 6.2.3-25426-2 |
| CVE-2020-27650 | 3.7 | Oct 29 | Synology DiskStation Manager (DSM) before 6.2.3-25426-2 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to… Affected: 6.2 before 6.2.3-25426-2 |
| CVE-2015-4655 | – | Jun 18 | Cross-site scripting (XSS) vulnerability in Synology DiskStation Manager (DSM) before 5.2-5565 Update 1 allows remote attackers to inject arbitrary web script or HTML via the… Affected: through 5.2-5565 |
| CVE-2015-2809 | – | Apr 1 | The Multicast DNS (mDNS) responder in Synology DiskStation Manager (DSM) before 3.1 inadvertently responds to unicast queries with source addresses that are not link-local, which… Affected: through 3.0 |
| CVE-2012-1556 | – | Sep 12 | Cross-site scripting (XSS) vulnerability in Synology Photo Station 5 for DiskStation Manager (DSM) 3.2-1955 allows remote attackers to inject arbitrary web script or HTML via the… Affected: 3.2-1955 |
| CVE-2014-2264 | – | Mar 2 | The OpenVPN module in Synology DiskStation Manager (DSM) 4.3-3810 update 1 has a hardcoded root password of synopass, which makes it easier for remote attackers to obtain access… Affected: 4.3-3810 |
| CVE-2013-6955 | – | Jan 9 | webman/imageSelector.cgi in Synology DiskStation Manager (DSM) 4.0 before 4.0-2259, 4.2 before 4.2-3243, and 4.3 before 4.3-3810 Update 1 allows remote attackers to append data to… Affected: 4.0; 4.2; 4.3; 4.3-3810 |
| CVE-2013-6987 | – | Dec 31 | Multiple directory traversal vulnerabilities in the FileBrowser components in Synology DiskStation Manager (DSM) before 4.3-3810 Update 3 allow remote attackers to read, write,… Affected: 4.3-3810 |