DiskStation Manager (DSM) vulnerabilities
35 known vulnerabilities in DiskStation Manager (DSM) from Synology. 35 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.6 High severity
DiskStation Manager (DSM): Authentication Bypass Using an Alternate Path or Channel
An authentication bypass using an alternate path or channel vulnerability in the rsync in Synology DiskStation Manager (DSM) before 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4.1-90080-1 allows remote attackers to read specific files, write arbitrary
- 8.1 High severity
DiskStation Manager (DSM): Improper Neutralization of Special Elements used in an SQL Command
An improper neutralization of special elements used in an SQL command vulnerability in the User API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote attackers with control over a compromised LDAP or Active Directory se
- 9.8 Critical severity
DiskStation Manager (DSM): Improper Neutralization of Special Elements used in an SQL Command
An improper neutralization of special elements used in an SQL command vulnerability in the Auth API in Synology DiskStation Manager (DSM) before 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4.1-90080-1 allows remote attackers to read or write arbitrary
- 7.2 High severity
DiskStation Manager (DSM): Improper Neutralization of Special Elements used in an OS Command
An improper neutralization of special elements used in an OS command vulnerability in the VPN API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users with administrator privileges to read or write arbi
- 8.8 High severity
DiskStation Manager (DSM): Missing Critical Step in Authentication
A missing critical step in authentication vulnerability in the Auth API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write arbitrary files and conduct denial-of-service attacks.
- 8.1 High severity
DiskStation Manager (DSM): Improper Link Resolution Before File Access
An improper link resolution before file access vulnerability in the thumb in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to write arbitrary files and conduct denial-of-service attacks.
- 8.8 High severity
DiskStation Manager (DSM): Improper Limitation of a Pathname to a Restricted Directory
An improper limitation of a pathname to a restricted directory vulnerability in the Sharing API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write arbitrary files and conduct denial-o
- 7.5 High severity
DiskStation Manager (DSM): Access of Uninitialized Pointer
An access of uninitialized pointer vulnerability in the nfsd in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote attackers to conduct denial-of-service attacks.
- 8.1 High severity
DiskStation Manager (DSM): Authentication Bypass Using an Alternate Path or Channel
An authentication bypass using an alternate path or channel vulnerability in the OTP in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote attackers with valid user credentials to read or write arbitrary files and conduct d
- 8.8 High severity
DiskStation Manager (DSM): Authorization Bypass Through User-Controlled Key
An authorization bypass through user-controlled key vulnerability in the SSOAuth in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write arbitrary files and conduct denial-of-service attac
- 8.1 High severity
DiskStation Manager (DSM): External Control of File Name or Path
An external control of file name or path vulnerability in Upload API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users to write arbitrary files and conduct denial-of-servic
- 7.1 High severity
DiskStation Manager (DSM): Improper Certificate Validation
An improper certificate validation vulnerability in Email API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows man-in-the-middle attackers to read or write arbitrary files and conduct denial-of-service attacks
- 8.0 High severity
DiskStation Manager (DSM): Improper Neutralization of CRLF Sequences
An improper neutralization of CRLF sequences ('CRLF injection') vulnerability in User API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to read or write arbitrary files and conduc
- 9.8 Critical severity
DiskStation Manager (DSM): Improper Encoding or Escaping of Output
An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service atta
- 8.8 High severity
DiskStation Manager (DSM): Incorrect Permission Assignment for Critical Resource
An incorrect permission assignment for critical resource vulnerability in LDAP API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users to read or write arbitrary files and co
- 9.8 Critical severity
DiskStation Manager (DSM): Insufficient Entropy
An insufficient entropy vulnerability in login logic in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.
- 9.8 Critical severity
DiskStation Manager (DSM): Improper Check for Unusual or Exceptional Conditions
Improper check for unusual or exceptional conditions vulnerability in SSO in Synology DiskStation Manager (DSM) before 7.2.2-72806-5 and 7.3.1-86003-1 (7.2.1-69057 is not affected) allows remote attackers to bypass authentication with prior knowledge of the di
- 8.8 High severity
DiskStation Manager (DSM): Improper Control of Dynamically-Managed Code Resources
Improper control of dynamically-managed code resources vulnerability in WebAPI component in Synology DiskStation Manager (DSM) before 7.1.1-42962-8 and 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote authe
- 7.5 High severity
DiskStation Manager (DSM): Out-of-bounds Write
Out-of-bounds write vulnerability in cgi components in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote attackers to conduct denial-of-service attacks via unspecifi
- 9.6 Critical severity
DiskStation Manager (DSM): Cross-Site Request Forgery
Cross-Site Request Forgery (CSRF) vulnerability in WebAPI Framework in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote attackers to execute arbitrary code via unsp
- 7.5 High severity
DiskStation Manager (DSM): Missing Authorization
Missing authorization vulnerability in synocopy in Synology DiskStation Manager (DSM) before 7.1.1-42962-8, 7.2.1-69057-7 and 7.2.2-72806-3 allows remote attackers to read arbitrary files via unspecified vectors.
- 7.5 High severity
DiskStation Manager (DSM): Improper Certificate Validation
Improper certificate validation vulnerability in the LDAP utilities in Synology DiskStation Manager (DSM) before 7.1.1-42962-8, 7.2.1-69057-7 and 7.2.2-72806-3 allows man-in-the-middle attackers to hijack the authentication of administrators via unspecified ve
- 9.8 Critical severity
DiskStation Manager (DSM): Improper Encoding or Escaping of Output
Improper encoding or escaping of output vulnerability in the system plugin daemon in Synology BeeStation OS (BSM) before 1.1-65374 and Synology DiskStation Manager (DSM) before 7.2-64570-4, 7.2.1-69057-6 and 7.2.2-72806-1 allows remote attackers to execute arb
- 8.1 High severity
DiskStation Manager (DSM): Uncontrolled Search Path Element
Uncontrolled search path element vulnerability in Backup Management functionality in Synology DiskStation Manager (DSM) before 6.2.4-25556-8, 7.0.1-42218-7 and 7.1-42661 allows remote authenticated users with administrator privileges to read or write arbitrary
- 9.1 Critical severity
DiskStation Manager (DSM): Missing Authentication for Critical Functionality
Missing authentication for critical function vulnerability in iSCSI management functionality in Synology DiskStation Manager (DSM) before 7.1-42661 allows remote attackers to read or write arbitrary files via unspecified vectors.
- 7.5 High severity
DiskStation Manager (DSM): Out-of-bounds Read
A vulnerability regarding out-of-bounds read is found in the session processing functionality of Out-of-Band (OOB) Management. This allows remote attackers to obtain sensitive information via unspecified vectors. The following models with Synology DiskStation
- 8.1 High severity
DiskStation Manager (DSM): Concurrent Execution using Shared Resource with Improper Synchronization
A vulnerability regarding concurrent execution using shared resource with improper synchronization ('Race Condition') is found in the session processing functionality of Out-of-Band (OOB) Management. This allows remote attackers to execute arbitrary commands v
- 9.8 Critical severity
DiskStation Manager (DSM): Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the message processing functionality of Out-of-Band (OOB) Management. This allows remote attackers to execute arbitrary commands via unspecified vecto
- 9.8 Critical severity
DiskStation Manager (DSM): Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the packet decryption functionality of Out-of-Band (OOB) Management. This allows remote attackers to execute arbitrary commands via unspecified vector
- 7.2 High severity
DiskStation Manager (DSM): Improper Neutralization of Special Elements used in an OS Command
Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in webapi component in Synology DiskStation Manager (DSM) before 7.0.1-42218-3 allows remote authenticated users to execute arbitrary commands via unspecif
- 8.8 High severity
DiskStation Manager (DSM): Improper Neutralization of Special Elements used in an OS Command
Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in task management component in Synology DiskStation Manager (DSM) before 6.2.4-25553 allows remote authenticated users to execute arbitrary commands via u
- 8.1 High severity
DiskStation Manager (DSM): Improper Limitation of a Pathname to a Restricted Directory
Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology DiskStation Manager (DSM) before 6.2.3-25423 allows remote authenticated users to delete arbitrary files via unspecified vectors.
- 8.8 High severity
DiskStation Manager (DSM): Improper Neutralization of Special Elements used in a Command
Improper neutralization of special elements used in a command ('Command Injection') vulnerability in File service functionality in Synology DiskStation Manager (DSM) before 6.2.4-25556-2 allows remote authenticated users to execute arbitrary commands via unspe
- 9.8 Critical severity
DiskStation Manager (DSM): Buffer Copy without Checking Size of Input
Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in Authentication functionality in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via unspecified vectors.
- 7.5 High severity
DiskStation Manager (DSM): Exposure of Sensitive Information to an Unauthorized Actor
Exposure of sensitive information to an unauthorized actor vulnerability in Web Server in Synology DiskStation Manager (DSM) before 7.0.1-42218-2 allows remote attackers to obtain sensitive information via unspecified vectors.