CVE
Vendors
Products
Updated
CVSS v2
CVSS v3
Skynas_firmware, Skynas, Vs960hd_firmware, Vs960hd, Active_directory_server, Antivirus_essential, Application_service, Assistant, Audio_station, Calendar
2022-10-24
N/A
9 CRITICAL
Insertion of sensitive information into sent data vulnerability in synorelayd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-middle attackers to execute arbitrary commands via inbound QuickConnect traffic.
Skynas_firmware, Skynas, Vs960hd_firmware, Vs960hd, Active_directory_server, Antivirus_essential, Application_service, Assistant, Audio_station, Calendar
2021-04-22
N/A
5.9 MEDIUM
Cleartext transmission of sensitive information vulnerability in synorelayd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-middle attackers to obtain sensitive information via an HTTP session.
Skynas_firmware, Skynas, Vs960hd_firmware, Vs960hd, Active_directory_server, Antivirus_essential, Application_service, Assistant, Audio_station, Calendar
2022-04-26
N/A
8.7 HIGH
Cleartext transmission of sensitive information vulnerability in synorelayd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-middle attackers to spoof servers via an HTTP session.
Skynas_firmware, Skynas, Vs960hd_firmware, Vs960hd, Active_directory_server, Antivirus_essential, Application_service, Assistant, Audio_station, Calendar
2022-04-26
N/A
6.7 MEDIUM
Incorrect authorization vulnerability in synoagentregisterd in Synology DiskStation Manager (DSM) before 6.2.4-25553 allows local users to execute arbitrary code via unspecified vectors.
Skynas_firmware, Skynas, Vs960hd_firmware, Vs960hd, Active_directory_server, Antivirus_essential, Application_service, Assistant, Audio_station, Calendar
2022-04-26
N/A
8.1 HIGH
Out-of-bounds write vulnerability in synoagentregisterd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-middle attackers to execute arbitrary code via syno_finder_site HTTP header.
Skynas_firmware, Skynas, Vs960hd_firmware, Vs960hd, Active_directory_server, Antivirus_essential, Application_service, Assistant, Audio_station, Calendar
2022-04-26
N/A
8.1 HIGH
Stack-based buffer overflow vulnerability in synoagentregisterd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-middle attackers to execute arbitrary code via syno_finder_site HTTP header.
Skynas_firmware, Skynas, Vs960hd_firmware, Vs960hd, Active_directory_server, Antivirus_essential, Application_service, Assistant, Audio_station, Calendar
2022-04-26
N/A
7.4 HIGH
Cleartext transmission of sensitive information vulnerability in synoagentregisterd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-middle attackers to spoof servers via an HTTP session.
Accumulo, Activemq, Activemq_apollo, Activemq_artemis, Age, Airavata_django_portal, Airflow, Airflow_mysql_provider, Alarm_instance_management, Allura
2022-10-24
N/A
6.5 MEDIUM
Improper Access Control on Configurations Endpoint for the Stable API of Apache Airflow allows users with Viewer or User role to get Airflow Configurations including sensitive information even when `[webserver] expose_config` is set to `False` in `airflow.cfg`. This allowed a privilege escalation attack. This issue affects Apache Airflow 2.0.0.
Deserialization of Untrusted Data vulnerability of Apache ShardingSphere-UI allows an attacker to inject outer link resources. This issue affects Apache ShardingSphere-UI Apache ShardingSphere-UI version 4.1.1 and later versions; Apache ShardingSphere-UI versions prior to 5.0.0.
When Octopus Tentacle is installed using a custom folder location, folder ACLs are not set correctly and could lead to an unprivileged user using DLL side-loading to gain privileged access.