DM
Product
Diskstation Manager
On CISA KEVExploited in the wild
96
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 18High 45Medium 25Low 2
Watch
Add Diskstation Manager to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-13392 | 9.8 | May 27 | Improper check for unusual or exceptional conditions vulnerability in SSO in Synology DiskStation Manager (DSM) before 7.2.2-72806-5 and 7.3.1-86003-1 (7.2.1-69057 is not… Affected: 7.2.2 before 7.2.2-72806-5; 7.3 through 7.3.1-86003-1 |
| CVE-2024-10441 | 9.8 | Mar 19 | Improper encoding or escaping of output vulnerability in the system plugin daemon in Synology BeeStation OS (BSM) before 1.1-65374 and Synology DiskStation Manager (DSM) before… Affected: 7.2 before 7.2-64570-4; 7.2.1-69057 before 7.2.1-69057-6; 7.2.2 before 7.2.2-72806-1 |
| CVE-2022-27624 | 9.8 | Oct 20 | A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the packet decryption functionality of Out-of-Band (OOB) Management Affected: before 7.1.1-42962-2 |
| CVE-2022-27625 | 9.8 | Oct 20 | A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the message processing functionality of Out-of-Band (OOB) Management Affected: before 7.1.1-42962-2 |
| CVE-2022-22687 | 9.8 | Mar 25 | Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in Authentication functionality in Synology DiskStation Manager (DSM) before 6.2.3-25426-3… Affected: 6.2 before 6.2.3-25426-3 |
| CVE-2021-43927 | 9.8 | Feb 7 | Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Security Management functionality in Synology DiskStation Manager (DSM)… Affected: 6.2 before 6.2.4-25556-3; 7.0 before 7.0.1-42218-2 |
| CVE-2021-43926 | 9.8 | Feb 7 | Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Log Management functionality in Synology DiskStation Manager (DSM) before… Affected: 6.2 before 6.2.4-25556-3; 7.0 before 7.0.1-42218-2 |
| CVE-2021-43925 | 9.8 | Feb 7 | Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Log Management functionality in Synology DiskStation Manager (DSM) before… Affected: 6.2 before 6.2.4-25556-3; 7.0 before 7.0.1-42218-2 |
| CVE-2021-27649 | 9.8 | Jun 23 | Use after free vulnerability in file transfer protocol component in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via… Affected: 6.2 before 6.2.3-25426-3 |
| CVE-2021-27647 | 9.8 | Mar 12 | Out-of-bounds Read vulnerability in iscsi_snapshot_comm_core in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via… Affected: before 6.2.3-25426-3 |
| CVE-2021-27646 | 9.8 | Mar 12 | Use After Free vulnerability in iscsi_snapshot_comm_core in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via crafted… Affected: before 6.2.3-25426-3 |
| CVE-2018-8919 | 9.8 | Dec 24 | Information exposure vulnerability in SYNO.Core.Desktop.SessionData in Synology DiskStation Manager (DSM) before 6.1.6-15266 allows remote attackers to steal credentials via… Affected: before 6.1.6-15266 |
| CVE-2018-1160 | 9.8 | Dec 20 | Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsi_opensess.c Affected: 5.2 before 5.2-5967-9; 6.1 before 6.1.7-15284-3; 6.2 before 6.2.1-23824-4 |
| CVE-2017-14491 | 9.8 | Oct 4 | Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response Affected: 5.2; 6.0; 6.1 |
| CVE-2024-45538 | 9.6 | Dec 4 | Cross-Site Request Forgery (CSRF) vulnerability in WebAPI Framework in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller… Affected: 7.2.1-69057 before 7.2.1-69057-2; 7.2.2-72803 before 7.2.2-72806 |
| CVE-2022-27623 | 9.1 | Oct 25 | Missing authentication for critical function vulnerability in iSCSI management functionality in Synology DiskStation Manager (DSM) before 7.1-42661 allows remote attackers to read… Affected: before 7.1-42661 |
| CVE-2021-26566 | 9.0 | Feb 26 | Insertion of sensitive information into sent data vulnerability in synorelayd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-middle attackers to… Affected: before 6.2.3-25426-3 |
| CVE-2020-27648 | 9.0 | Oct 29 | Improper certificate validation vulnerability in OpenVPN client in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-in-the-middle attackers to spoof servers and… Affected: 6.2 before 6.2.3-25426-2 |
Showing 18