synology Archives - CVE Vulnerability

CVE-2018-8928

Sun, 26 Feb 2023 06:51:40 +0000

Cross-site scripting (XSS) vulnerability in Address Book Editor in Synology CardDAV Server before 6.0.8-0086 allows remote authenticated users to inject arbitrary web script or HTML via the (1) family_name, (2) given_name, or (3) additional_name parameter.

The post CVE-2018-8928 appeared first on CVE Vulnerability.

CVE-2018-8927

Sun, 26 Feb 2023 06:51:40 +0000

Improper authorization vulnerability in SYNO.Cal.Event in Calendar before 2.1.2-0511 allows remote authenticated users to create arbitrary events via the (1) cal_id or (2) original_cal_id parameter.

The post CVE-2018-8927 appeared first on CVE Vulnerability.

CVE-2018-8915

Sun, 26 Feb 2023 06:51:39 +0000

Cross-site scripting (XSS) vulnerability in Notification Center in Synology Calendar before 2.1.1-0502 allows remote authenticated users to inject arbitrary web script or HTML via title parameter.

The post CVE-2018-8915 appeared first on CVE Vulnerability.

CVE-2018-7184

Sun, 26 Feb 2023 06:50:58 +0000

ntpd in ntp 4.2.8p4 before 4.2.8p11 drops bad packets before updating the “received” timestamp, which allows remote attackers to cause a denial of service (disruption) by sending a packet with a zero-origin timestamp causing the association to reset and setting the contents of the packet as the most recent timestamp. This issue is a result of an incomplete fix for CVE-2015-7704.

The post CVE-2018-7184 appeared first on CVE Vulnerability.

CVE-2018-7170

Sun, 26 Feb 2023 06:50:57 +0000

ntpd in ntp 4.2.x before 4.2.8p7 and 4.3.x before 4.3.92 allows authenticated users that know the private symmetric key to create arbitrarily-many ephemeral associations in order to win the clock selection of ntpd and modify a victim’s clock via a Sybil attack. This issue exists because of an incomplete fix for CVE-2016-1549.

The post CVE-2018-7170 appeared first on CVE Vulnerability.

CVE-2018-13299

Sun, 26 Feb 2023 06:45:57 +0000

Relative path traversal vulnerability in Attachment Uploader in Synology Calendar before 2.2.2-0532 allows remote authenticated users to upload arbitrary files via the filename parameter.

The post CVE-2018-13299 appeared first on CVE Vulnerability.

CVE-2018-13295

Sun, 26 Feb 2023 06:45:57 +0000

Information exposure vulnerability in SYNO.Personal.Application.Info in Synology Application Service before 1.5.4-0320 allows remote authenticated users to obtain sensitive system information via the version parameter.

The post CVE-2018-13295 appeared first on CVE Vulnerability.

CVE-2018-13294

Sun, 26 Feb 2023 06:45:57 +0000

Information exposure vulnerability in SYNO.Personal.Profile in Synology Application Service before 1.5.4-0320 allows remote authenticated users to obtain sensitive system information via the uid parameter.

The post CVE-2018-13294 appeared first on CVE Vulnerability.

CVE-2018-1160

Sun, 26 Feb 2023 06:45:19 +0000

Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsi_opensess.c. This is due to lack of bounds checking on attacker controlled data. A remote unauthenticated attacker can leverage this vulnerability to achieve arbitrary code execution.

The post CVE-2018-1160 appeared first on CVE Vulnerability.

CVE-2020-27650

Sun, 26 Feb 2023 06:40:24 +0000

Synology DiskStation Manager (DSM) before 6.2.3-25426-2 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session.

The post CVE-2020-27650 appeared first on CVE Vulnerability.