Overview 352 matches · 0 in Waratek scope · 0 protected · 7 exploited · 2 CISA KEV · 21 public PoC · 14 EPSS ≥ 0.5
352matches
0in Waratek scope0.0%
0protected0.0%
7exploited2.0%
2CISA KEV0.6%
21public PoC6.0%
14EPSS ≥ 0.54.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
13
3.7%
Not applicable
339
96.3%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
352
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 49 / year
20102
Not applicable2
Medium1
Low1
not blocked2
No public exploit2
20110
20120
20131
Not applicable1
High1
not blocked1
Working exploit published1
20146
Not applicable6
High2
Medium4
not blocked6
Working exploit published2
No public exploit4
20159
Not applicable9
High3
Medium6
not blocked9
Working exploit published2
No public exploit7
20160
201749
Not applicable49
Critical6
High17
Medium26
not blocked49
Exploited1
Working exploit published7
No public exploit41
201837
Outside Waratek scope4
Not applicable33
Critical4
High13
Medium20
not blocked37
Exploited1
Working exploit published2
No public exploit34
201940
Outside Waratek scope6
Not applicable34
Critical2
High16
Medium21
Low1
not blocked40
Exploited1
Forecast only5
No public exploit34
202022
Outside Waratek scope2
Not applicable20
Critical6
High10
Medium6
not blocked22
Exploited1
No public exploit21
202135
Outside Waratek scope1
Not applicable34
Critical14
High18
Medium3
not blocked35
Exploited1
No public exploit34
202236
Not applicable36
Critical11
High16
Medium9
not blocked36
Exploited1
No public exploit35
202313
Not applicable13
Critical4
High6
Medium3
not blocked13
No public exploit13
202447
Not applicable47
Critical3
High10
Medium34
not blocked47
Working exploit published1
No public exploit46
202528
Not applicable28
Critical4
High11
Medium12
Low1
not blocked28
Exploited1
Proof of concept only1
No public exploit26
202627
Not applicable27
Critical2
High8
Medium14
Low3
not blocked27
No public exploit27
201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-4793 | High | 2026-08-03 | Not applicable | No public exploit | An incorrect default permissions vulnerability in Synology Assistant before 7.0.7-50095 allows local users to read or write arbitrary files and conduct denial-of-service during installation. |
| CVE-2024-47273 | Medium | 2026-06-03 | Not applicable | No public exploit | An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Backup Task functionality in Synology Hyper Backup before 4.1.2-4036 allows remote authenticated users to write specific files via unspecified vectors. |
| CVE-2024-47263 | Medium | 2026-06-03 | Not applicable | No public exploit | An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Backup.Repository webapi component in Synology Hyper Backup before 4.1.2-4036 allows remote authenticated users with administrator privileges to write specific files containing non-sensitive information via unspecified vectors. |
| CVE-2023-52951 | Medium | 2026-06-03 | Not applicable | No public exploit | A cleartext transmission of sensitive information vulnerability in Synology Note Station Client before 2.2.4-703 allows man-in-the-middle attackers to obtain user credential. |
| CVE-2022-49042 | High | 2026-06-03 | Not applicable | No public exploit | An inclusion of functionality from untrusted control sphere vulnerability in MinGW DLL component in Synology Hyper Backup Explorer before 3.0.1-0156 allows local users to execute arbitrary code via unspecified vectors. |
| CVE-2022-49036 | High | 2026-06-03 | Not applicable | No public exploit | An inclusion of functionality from untrusted control sphere vulnerability in OpenSSL configuration in Synology Active Backup for Business Recovery Media Creator before 2.5.0-2081 allows local users to execute arbitrary code via unspecified vectors. |
| CVE-2026-2237 | Medium | 2026-05-27 | Not applicable | No public exploit | A use of get request method with sensitive query strings vulnerability in volume encryption of Synology Storage Manager package before 1.0.1-1100 allows local users on Windows to obtain sensitive information. |
| CVE-2025-66593 | Medium | 2026-05-27 | Not applicable | No public exploit | An origin validation error vulnerability in Synology Assistant before 7.0.6-50085 allows local users to write arbitrary files with restricted content and conduct denial-of-service during installation. |
| CVE-2025-66592 | Medium | 2026-05-27 | Not applicable | No public exploit | An origin validation error vulnerability in Synology Active Backup for Business Agent before 3.1.0-4967 allows local users to write arbitrary files with restricted content and conduct denial-of-service during installation. |
| CVE-2025-30028 | High | 2026-05-27 | Not applicable | No public exploit | A vulnerability in Active Backup for Business allows unauthorized remote attackers to read arbitrary files. |
| CVE-2025-14713 | High | 2026-05-27 | Not applicable | No public exploit | An Exposed Dangerous Method or Function vulnerability in Synology C2 Identity Edge Server package in DSM before 1.76.0-0307 allows remote attackers to obtain user credentials from the edge server. |
| CVE-2025-13593 | Medium | 2026-05-27 | Not applicable | No public exploit | Origin validation error vulnerability in Synology ActiveProtect Agent before 1.1.0-0439 allows local users to write arbitrary files with restricted content and conduct denial-of-service during installation. |
| CVE-2025-13392 | Critical | 2026-05-27 | Not applicable | No public exploit | Improper check for unusual or exceptional conditions vulnerability in SSO in Synology DiskStation Manager (DSM) before 7.2.2-72806-5 and 7.3.1-86003-1 (7.2.1-69057 is not affected) allows remote attackers to bypass authentication with prior knowledge of the distinguished name (DN). |
| CVE-2025-13167 | Medium | 2026-05-27 | Not applicable | No public exploit | Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in contact functionality in Synology Contacts before 1.0.10-20659 allows remote authenticated users to read or write specific files containing non-sensitive information via unspecified vectors. |
| CVE-2025-12686 | Critical | 2026-05-27 | Not applicable | No public exploit | Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in AdminCenter in Synology BeeStation OS before 1.3.2-65648 allows remote attackers to execute arbitrary code via unspecified vectors. |
| CVE-2025-10466 | Medium | 2026-05-27 | Not applicable | No public exploit | Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Safe Access in Synology Safe Access before 1.3.1-0329 allows remote authenticated users with administrator privileges to read or write specific files containing non-sensitive information or conduct limited denial-of-service in SRM. |
| CVE-2024-47272 | Low | 2026-05-27 | Not applicable | No public exploit | Incorrect authorization vulnerability in IO Module functionality in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows remote authenticated users with administrator privileges to limited file write via unspecified vectors. |
| CVE-2024-47271 | Medium | 2026-05-27 | Not applicable | No public exploit | Insufficiently protected credentials vulnerability in IPSpeaker component in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows remote authenticated users with administrator privileges to obtain sensitive information via unspecified vectors. |
| CVE-2024-47270 | Low | 2026-05-27 | Not applicable | No public exploit | Improper preservation of permissions vulnerability in Archiving Push functionality in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows remote authenticated users with administrator privileges to limited file write via unspecified vectors. |
| CVE-2024-47269 | Medium | 2026-05-27 | Not applicable | No public exploit | Cleartext transmission of sensitive information vulnerability in Export Key functionality in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows remote authenticated users with administrator privileges to obtain sensitive information via unspecified vectors. |
| CVE-2024-47268 | Medium | 2026-05-27 | Not applicable | No public exploit | Missing authorization vulnerability in AddOns functionality in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows remote authenticated users with administrator privileges to obtain sensitive information via unspecified vectors. |
| CVE-2024-47267 | Low | 2026-05-27 | Not applicable | No public exploit | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Archiving Pull functionality in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows remote authenticated users with administrator privileges to limited file write via unspecified vectors. |
| CVE-2024-11399 | Medium | 2026-05-27 | Not applicable | No public exploit | Files or directories accessible to external parties vulnerability in redis-server component in Synology BeeDrive for desktop before 1.3.2-13814 allows local users to conduct denial-of-service attacks via unspecified vectors. |
| CVE-2023-52945 | High | 2026-05-27 | Not applicable | No public exploit | Uncontrolled search path element vulnerability in OpenSSL DLL component in Synology BeeDrive for desktop before 1.3.2-13814 allows local users to execute arbitrary code via unspecified vectors. |
| CVE-2021-47961 | High | 2026-04-10 | Not applicable | No public exploit | A plaintext storage of a password vulnerability in Synology SSL VPN Client before 1.4.5-0684 allows remote attackers to access or influence the user's PIN code due to insecure storage. This may lead to unauthorized VPN configuration and potential interception of subsequent VPN traffic when combined with user interaction. |
| CVE-2021-47960 | Medium | 2026-04-10 | Not applicable | No public exploit | A files or directories accessible to external parties vulnerability in Synology SSL VPN Client before 1.4.5-0684 allows remote attackers to access files within the installation directory via a local HTTP server bound to the loopback interface. By leveraging user interaction with a crafted web page, attackers may retrieve sensitive files such as configuration files, certificates, and logs, leading to information disclosure. |
| CVE-2026-3091 | High | 2026-02-24 | Not applicable | No public exploit | An uncontrolled search path element vulnerability in Synology Presto Client before 2.1.3-0672 allows local users to read or write arbitrary files and conduct denial-of-service during installation by placing a malicious DLL in advance in the same directory as the installer. |
| CVE-2025-8074 | Medium | 2025-12-04 | Not applicable | No public exploit | Origin validation error vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.3-13973 allows local users to write arbitrary files with non-sensitive information via unspecified vectors. |
| CVE-2025-54160 | High | 2025-12-04 | Not applicable | No public exploit | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.2-13960 allows local users to execute arbitrary code via unspecified vectors. |
| CVE-2025-54159 | High | 2025-12-04 | Not applicable | No public exploit | Missing authorization vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.2-13960 allows remote attackers to delete arbitrary files via unspecified vectors. |
| CVE-2025-54158 | High | 2025-12-04 | Not applicable | No public exploit | Missing authentication for critical function vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.2-13960 allows local users to execute arbitrary code via unspecified vectors. |
| CVE-2025-29846 | High | 2025-12-04 | Not applicable | No public exploit | A vulnerability in portenable cgi allows remote authenticated users to get the status of installed packages. |
| CVE-2025-29845 | Medium | 2025-12-04 | Not applicable | No public exploit | A vulnerability in VideoPlayer2 subtitle cgi allows remote authenticated users to read .srt files. |
| CVE-2025-29844 | Medium | 2025-12-04 | Not applicable | No public exploit | A vulnerability in FileStation file cgi allows remote authenticated users to read file metadata and path information. |
| CVE-2025-29843 | Medium | 2025-12-04 | Not applicable | No public exploit | A vulnerability in FileStation thumb cgi allows remote authenticated users to read/write image files. |
| CVE-2025-2848 | Medium | 2025-12-04 | Not applicable | No public exploit | A vulnerability in Synology Mail Server allows remote authenticated attackers to read and write non-sensitive settings, and disable some non-critical functions. |
| CVE-2024-5401 | High | 2025-12-04 | Not applicable | No public exploit | Improper control of dynamically-managed code resources vulnerability in WebAPI component in Synology DiskStation Manager (DSM) before 7.1.1-42962-8 and 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote authenticated users to obtain privileges without consent via unspecified vectors. |
| CVE-2024-45539 | High | 2025-12-04 | Not applicable | No public exploit | Out-of-bounds write vulnerability in cgi components in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote attackers to conduct denial-of-service attacks via unspecified vectors. |
| CVE-2024-45538 | Critical | 2025-12-04 | Not applicable | No public exploit | Cross-Site Request Forgery (CSRF) vulnerability in WebAPI Framework in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote attackers to execute arbitrary code via unspecified vectors. |
| CVE-2024-53288 | Medium | 2025-07-23 | Not applicable | No public exploit | Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in NTP Region functionality in Synology Router Manager (SRM) before 1.3.1-9346-11 allows remote authenticated users with administrator privileges to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2024-53287 | Medium | 2025-07-23 | Not applicable | No public exploit | Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in VPN Setting functionality in Synology Router Manager (SRM) before 1.3.1-9346-11 allows remote authenticated users with administrator privileges to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2024-53286 | High | 2025-07-23 | Not applicable | No public exploit | Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in DDNS Record functionality in Synology Router Manager (SRM) before 1.3.1-9346-11 allows remote authenticated users with administrator privileges to execute arbitrary code via unspecified vectors. |
| CVE-2025-4679 | Medium | 2025-05-16 | Not applicable | No public exploit | A vulnerability in Synology Active Backup for Microsoft 365 allows remote authenticated attackers to obtain sensitive information via unspecified vectors. |
| CVE-2025-1021 | High | 2025-04-23 | Not applicable | No public exploit | Missing authorization vulnerability in synocopy in Synology DiskStation Manager (DSM) before 7.1.1-42962-8, 7.2.1-69057-7 and 7.2.2-72806-3 allows remote attackers to read arbitrary files via unspecified vectors. |
| CVE-2024-50631 | High | 2025-03-19 | Not applicable | No public exploit | Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in the system syncing daemon in Synology Drive Server before 3.0.4-12699, 3.2.1-23280, 3.5.0-26085 and 3.5.1-26102 allows remote attackers to inject SQL commands, limited to write operations, via unspecified vectors. |
| CVE-2024-50630 | High | 2025-03-19 | Not applicable | No public exploit | Missing authentication for critical function vulnerability in the webapi component in Synology Drive Server before 3.0.4-12699, 3.2.1-23280, 3.5.0-26085 and 3.5.1-26102 allows remote attackers to obtain administrator credentials via unspecified vectors. |
| CVE-2024-50629 | Medium | 2025-03-19 | Not applicable | Proof of concept only | Improper encoding or escaping of output vulnerability in the webapi component in Synology BeeStation OS (BSM) before 1.1-65374 and Synology DiskStation Manager (DSM) before 7.1.1-42962-7, 7.2-64570-4, 7.2.1-69057-6 and 7.2.2-72806-1 allow remote attackers to read limited files via unspecified vectors. |
| CVE-2024-11131 | Critical | 2025-03-19 | Not applicable | No public exploit | A vulnerability regarding out-of-bounds read is found in the video interface. This allows remote attackers to execute arbitrary code via unspecified vectors. The following models with Synology Camera Firmware versions before 1.2.0-0525 may be affected: BC500, CC400W and TC500. |
| CVE-2024-10445 | Medium | 2025-03-19 | Not applicable | No public exploit | Improper certificate validation vulnerability in the update functionality in Synology BeeStation OS (BSM) before 1.1-65374 and Synology DiskStation Manager (DSM) before 6.2.4-25556-8, 7.1.1-42962-7, 7.2-64570-4, 7.2.1-69057-6 and 7.2.2-72806-1 allow remote attackers to write limited files via unspecified vectors. |
| CVE-2024-10444 | High | 2025-03-19 | Not applicable | No public exploit | Improper certificate validation vulnerability in the LDAP utilities in Synology DiskStation Manager (DSM) before 7.1.1-42962-8, 7.2.1-69057-7 and 7.2.2-72806-3 allows man-in-the-middle attackers to hijack the authentication of administrators via unspecified vectors. |
| CVE-2024-10442 | Critical | 2025-03-19 | Not applicable | No public exploit | Off-by-one error vulnerability in the transmission component in Synology Replication Service before 1.0.12-0066, 1.2.2-0353 and 1.3.0-0423 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote attackers to execute arbitrary code, potentially leading to a broader impact across the system via unspecified vectors. |
| CVE-2024-10441 | Critical | 2025-03-19 | Not applicable | Exploited | Improper encoding or escaping of output vulnerability in the system plugin daemon in Synology BeeStation OS (BSM) before 1.1-65374 and Synology DiskStation Manager (DSM) before 7.2-64570-4, 7.2.1-69057-6 and 7.2.2-72806-1 allows remote attackers to execute arbitrary code via unspecified vectors. |
| CVE-2024-47266 | Low | 2025-02-13 | Not applicable | No public exploit | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in share file list functionality in Synology Active Backup for Business before 2.7.1-13234, 2.7.1-23234 and 2.7.1-3234 allows remote authenticated users with administrator privileges to read specific files containing non-sensitive information via unspecified vectors. |
| CVE-2024-47265 | Medium | 2025-02-13 | Not applicable | No public exploit | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in encrypted share umount functionality in Synology Active Backup for Business before 2.7.1-13234, 2.7.1-23234 and 2.7.1-3234 allows remote authenticated users to write specific files via unspecified vectors. |
| CVE-2024-47264 | Medium | 2025-02-13 | Not applicable | No public exploit | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in agent-related functionality in Synology Active Backup for Business before 2.7.1-13234, 2.7.1-23234 and 2.7.1-3234 allows remote authenticated users with administrator privileges to delete arbitrary files via unspecified vectors. |
| CVE-2024-4464 | High | 2024-12-18 | Not applicable | No public exploit | Authorization bypass through user-controlled key vulnerability in streaming service in Synology Media Server before 1.4-2680, 2.0.5-3152 and 2.2.0-3325 allows remote attackers to read specific files via unspecified vectors. |
| CVE-2024-53285 | Medium | 2024-12-09 | Not applicable | No public exploit | Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in DDNS Record functionality in Synology Router Manager (SRM) before 1.3.1-9346-10 allows remote authenticated users with administrator privileges to read or write specific files containing non-sensitive information and conduct limited denial-of-service attacks by injecting arbitrary web script or HTML. |
| CVE-2024-53284 | Medium | 2024-12-09 | Not applicable | No public exploit | Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in WiFi Connect Setting functionality in Synology Router Manager (SRM) before 1.3.1-9346-10 allows remote authenticated users with administrator privileges to read or write specific files containing non-sensitive information and conduct limited denial-of-service attacks by injecting arbitrary web script or HTML. |
| CVE-2024-53283 | Medium | 2024-12-09 | Not applicable | No public exploit | Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Router Port Forward functionality in Synology Router Manager (SRM) before 1.3.1-9346-10 allows remote authenticated users with administrator privileges to read or write specific files containing non-sensitive information and conduct limited denial-of-service attacks by injecting arbitrary web script or HTML. |
| CVE-2024-53282 | Medium | 2024-12-09 | Not applicable | No public exploit | Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in WiFi Connect MAC Filter functionality in Synology Router Manager (SRM) before 1.3.1-9346-10 allows remote authenticated users with administrator privileges to read or write specific files containing non-sensitive information and conduct limited denial-of-service attacks by injecting arbitrary web script or HTML. |
| CVE-2024-53281 | Medium | 2024-12-09 | Not applicable | No public exploit | Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Network WOL functionality in Synology Router Manager (SRM) before 1.3.1-9346-10 allows remote authenticated users to read or write specific files containing non-sensitive information and conduct limited denial-of-service attacks by injecting arbitrary web script or HTML. |
| CVE-2024-53280 | Medium | 2024-12-09 | Not applicable | No public exploit | Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in network center policy route functionality in Synology Router Manager (SRM) before 1.3.1-9346-10 allows remote authenticated users with administrator privileges to read or write specific files containing non-sensitive information and conduct limited denial-of-service attacks by injecting arbitrary web script or HTML. |
| CVE-2024-53279 | Medium | 2024-12-09 | Not applicable | No public exploit | Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in file station functionality in Synology Router Manager (SRM) before 1.3.1-9346-10 allows remote authenticated users with administrator privileges to read or write specific files containing non-sensitive information and conduct limited denial-of-service attacks by injecting arbitrary web script or HTML. |
| CVE-2024-11398 | High | 2024-12-04 | Not applicable | No public exploit | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in OTP reset functionality in Synology Router Manager (SRM) before 1.3.1-9346-9 allows remote authenticated users to delete arbitrary files via unspecified vectors. |
| CVE-2023-52944 | Medium | 2024-12-04 | Not applicable | No public exploit | Incorrect authorization vulnerability in ActionRule webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allows remote authenticated users to perform limited actions on the set action rules function via unspecified vectors. |
| CVE-2023-52943 | Medium | 2024-12-04 | Not applicable | No public exploit | Incorrect authorization vulnerability in Alert.Setting webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allows remote authenticated users to to perform limited actions on the alerting function via unspecified vectors. |
| CVE-2024-10443 | Critical | 2024-11-15 | Not applicable | Working exploit published | Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in Task Manager component in Synology BeePhotos before 1.0.2-10026 and 1.1.0-10053 and Synology Photos before 1.6.2-0720 and 1.7.0-0795 allows remote attackers to execute arbitrary code via unspecified vectors. |
| CVE-2023-52950 | Medium | 2024-09-26 | Not applicable | No public exploit | Missing encryption of sensitive data vulnerability in login component in Synology Active Backup for Business Agent before 2.7.0-3221 allows adjacent man-in-the-middle attackers to obtain user credential via unspecified vectors. |
| CVE-2023-52949 | Medium | 2024-09-26 | Not applicable | No public exploit | Missing authentication for critical function vulnerability in proxy settings functionality in Synology Active Backup for Business Agent before 2.7.0-3221 allows local users to obtain user credential via unspecified vectors. |
| CVE-2023-52948 | Medium | 2024-09-26 | Not applicable | No public exploit | Missing encryption of sensitive data vulnerability in settings functionality in Synology Active Backup for Business Agent before 2.7.0-3221 allows local users to obtain user credential via unspecified vectors. |
| CVE-2023-52947 | Medium | 2024-09-26 | Not applicable | No public exploit | Missing authentication for critical function vulnerability in logout functionality in Synology Active Backup for Business Agent before 2.6.3-3101 allows local users to logout the client via unspecified vectors. The backup functionality will continue to operate and will not be affected by the logout. |
| CVE-2023-52946 | High | 2024-09-26 | Not applicable | No public exploit | Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in vss service component in Synology Drive Client before 3.5.0-16084 allows remote attackers to overwrite trivial buffers and crash the client via unspecified vectors. |
| CVE-2022-49041 | Medium | 2024-09-26 | Not applicable | No public exploit | Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in backup task management functionality in Synology Drive Client before 3.4.0-15721 allows local users with administrator privileges to crash the client via unspecified vectors. |
| CVE-2022-49040 | Medium | 2024-09-26 | Not applicable | No public exploit | Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in connection management functionality in Synology Drive Client before 3.4.0-15721 allows local users with administrator privileges to crash the client via unspecified vectors. |
| CVE-2022-49039 | Medium | 2024-09-26 | Not applicable | No public exploit | Out-of-bounds write vulnerability in backup task management functionality in Synology Drive Client before 3.4.0-15721 allows local users with administrator privileges to execute arbitrary commands via unspecified vectors. |
| CVE-2022-49038 | High | 2024-09-26 | Not applicable | No public exploit | Inclusion of functionality from untrusted control sphere vulnerability in OpenSSL DLL component in Synology Drive Client before 3.3.0-15082 allows local users to execute arbitrary code via unspecified vectors. |
| CVE-2022-49037 | Medium | 2024-09-26 | Not applicable | No public exploit | Insertion of sensitive information into log file vulnerability in proxy settings component in Synology Drive Client before 3.3.0-15082 allows remote authenticated users to obtain sensitive information via unspecified vectors. |
| CVE-2024-39352 | Medium | 2024-06-28 | Not applicable | No public exploit | A vulnerability regarding incorrect authorization is found in the firmware upgrade functionality. This allows remote authenticated users with administrator privileges to bypass firmware integrity check via unspecified vectors. The following models with Synology Camera Firmware versions before 1.0.7-0298 may be affected: BC500 and TC500. |
| CVE-2024-39351 | High | 2024-06-28 | Not applicable | No public exploit | A vulnerability regarding improper neutralization of special elements used in an OS command ('OS Command Injection') is found in the NTP configuration. This allows remote authenticated users with administrator privileges to execute arbitrary commands via unspecified vectors. The following models with Synology Camera Firmware versions before 1.0.7-0298 may be affected: BC500 and TC500. |
| CVE-2024-39350 | High | 2024-06-28 | Not applicable | No public exploit | A vulnerability regarding authentication bypass by spoofing is found in the RTSP functionality. This allows man-in-the-middle attackers to obtain privileges without consent via unspecified vectors. The following models with Synology Camera Firmware versions before 1.0.7-0298 may be affected: BC500 and TC500. |
| CVE-2024-39349 | Critical | 2024-06-28 | Not applicable | No public exploit | A vulnerability regarding buffer copy without checking size of input ('Classic Buffer Overflow') is found in the libjansson component and it does not affect the upstream library. This allows remote attackers to execute arbitrary code via unspecified vectors. The following models with Synology Camera Firmware versions before 1.0.7-0298 may be affected: BC500 and TC500. |
| CVE-2024-39348 | High | 2024-06-28 | Not applicable | No public exploit | Download of code without integrity check vulnerability in AirPrint functionality in Synology Router Manager (SRM) before 1.2.5-8227-11 and 1.3.1-9346-8 allows man-in-the-middle attackers to execute arbitrary code via unspecified vectors. |
| CVE-2024-39347 | Medium | 2024-06-28 | Not applicable | No public exploit | Incorrect default permissions vulnerability in firewall functionality in Synology Router Manager (SRM) before 1.2.5-8227-11 and 1.3.1-9346-8 allows man-in-the-middle attackers to access highly sensitive intranet resources via unspecified vectors. |
| CVE-2023-47803 | Medium | 2024-06-28 | Not applicable | No public exploit | A vulnerability regarding improper limitation of a pathname to a restricted directory ('Path Traversal') is found in the Language Settings functionality. This allows remote attackers to read specific files containing non-sensitive information via unspecified vectors. The following models with Synology Camera Firmware versions before 1.0.7-0298 may be affected: BC500 and TC500. |
| CVE-2023-47802 | High | 2024-06-28 | Not applicable | No public exploit | A vulnerability regarding improper neutralization of special elements used in an OS command ('OS Command Injection') is found in the IP block functionality. This allows remote authenticated users with administrator privileges to execute arbitrary commands via unspecified vectors. The following models with Synology Camera Firmware versions before 1.0.7-0298 may be affected: BC500 and TC500. |
| CVE-2024-5463 | Medium | 2024-06-04 | Not applicable | No public exploit | A vulnerability regarding buffer copy without checking the size of input ('Classic Buffer Overflow') has been found in the login component. This allows remote attackers to write specific files containing non-sensitive information and conduct limited denial-of-service attacks via unspecified vectors. This attack only affects the login service which will automatically restart. The following models with Synology Camera Firmware versions before 1.1.1-0383 may be affected: BC500 and TC500. |
| CVE-2024-29241 | Critical | 2024-03-28 | Not applicable | No public exploit | Missing authorization vulnerability in System webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remote authenticated users to obtain non-sensitive information, write sensitive configurations in DSM, and reboot or shutdown NAS via unspecified vectors. |
| CVE-2024-29240 | Medium | 2024-03-28 | Not applicable | No public exploit | Missing authorization vulnerability in LayoutSave webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allows remote authenticated users to conduct limited denial-of-service attacks via unspecified vectors. |
| CVE-2024-29239 | Medium | 2024-03-28 | Not applicable | No public exploit | Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Recording.CountByCategory webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allows remote authenticated users to read database containing non-sensitive information and conduct limited denial-of-service attacks via unspecified vectors. |
| CVE-2024-29238 | Medium | 2024-03-28 | Not applicable | No public exploit | Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Log.CountByCategory webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remote authenticated users to read database containing non-sensitive information and conduct limited denial-of-service attacks via unspecified vectors. |
| CVE-2024-29237 | Medium | 2024-03-28 | Not applicable | No public exploit | Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in ActionRule.Delete webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allows remote authenticated users to read database containing non-sensitive information and conduct limited denial-of-service attacks via unspecified vectors. |
| CVE-2024-29236 | Medium | 2024-03-28 | Not applicable | No public exploit | Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in AudioPattern.Delete webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remote authenticated users to read database containing non-sensitive information and conduct limited denial-of-service attacks via unspecified vectors. |
| CVE-2024-29235 | Medium | 2024-03-28 | Not applicable | No public exploit | Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in IOModule.EnumLog webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allows remote authenticated users to read database containing non-sensitive information and conduct limited denial-of-service attacks via unspecified vectors. |
| CVE-2024-29234 | Medium | 2024-03-28 | Not applicable | No public exploit | Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Group.Save webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allows remote authenticated users to read database containing non-sensitive information and conduct limited denial-of-service attacks via unspecified vectors. |
| CVE-2024-29233 | Medium | 2024-03-28 | Not applicable | No public exploit | Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Emap.Delete webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remote authenticated users to read database containing non-sensitive information and conduct limited denial-of-service attacks via unspecified vectors. |
| CVE-2024-29232 | Medium | 2024-03-28 | Not applicable | No public exploit | Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Alert.Enum webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allows remote authenticated users to read database containing non-sensitive information and conduct limited denial-of-service attacks via unspecified vectors. |
| CVE-2024-29231 | Medium | 2024-03-28 | Not applicable | No public exploit | Improper validation of array index vulnerability in UserPrivilege.Enum webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remote authenticated users to obtain non-sensitive information and conduct limited denial-of-service attacks via unspecified vectors. |
| CVE-2024-29230 | Medium | 2024-03-28 | Not applicable | No public exploit | Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in SnapShot.CountByCategory webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remote authenticated users to read database containing non-sensitive information and conduct limited denial-of-service attacks via unspecified vectors. |
| CVE-2024-29229 | High | 2024-03-28 | Not applicable | No public exploit | Missing authorization vulnerability in GetLiveViewPath webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remote authenticated users to obtain sensitive information via unspecified vectors. |
| CVE-2024-29228 | High | 2024-03-28 | Not applicable | No public exploit | Missing authorization vulnerability in GetStmUrlPath webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remote authenticated users to obtain sensitive information via unspecified vectors. |