Vulnerabilidades do Synology DiskStation Manager (DSM)
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Synology DiskStation Manager (DSM): 23 registro(s), com versões afetadas e correções.
CVE-2026-6205
Alta · 8.1
CWE-73 18/09/2026
An external control of file name or path vulnerability in Upload API in Synology…
An external control of file name or path vulnerability in Upload API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users to write arbitrary files and conduct denial-of-service attacks.
CVE-2026-4036
Média · 6.5
CWE-89 18/09/2026
SQL Injection em Synology DiskStation Manager (DSM)
An improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Sharing API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain arbitrary sharing files.
CVE-2026-40539
Alta · 7.1
CWE-295 18/09/2026
Improper Certificate Validation em Synology DiskStation Manager (DSM)
An improper certificate validation vulnerability in Email API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows man-in-the-middle attackers to read or write arbitrary files and conduct denial-of-service attacks.
CVE-2026-40538
Baixa · 3.7
CWE-307 18/09/2026
Improper Restriction of Excessive Authentication Attempts em Synology DiskStation Manager (DSM)
An improper restriction of excessive authentication attempts vulnerability in Auto block in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to read limited files via brute-force attacks.
CVE-2026-40537
Média · 4.3
CWE-918 18/09/2026
Server-Side Request Forgery (SSRF) em Synology DiskStation Manager (DSM)
A server-side request forgery (SSRF) vulnerability in PersonMail API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain non-sensitive information.
CVE-2026-40536
Média · 4.3
CWE-22 18/09/2026
Path Traversal em Synology DiskStation Manager (DSM)
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Audio API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain non-sensitive information.
CVE-2026-40535
Média · 6.5
CWE-22 18/09/2026
Path Traversal em Synology DiskStation Manager (DSM)
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Desktop API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to write limited files and conduct limited denial-of-service attacks.
CVE-2026-40534
Média · 5.4
CWE-79 18/09/2026
Cross-site Scripting (XSS) em Synology DiskStation Manager (DSM)
An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Video API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to read or write limited files when the player is launched.
CVE-2026-40533
Média · 5.3
CWE-202 18/09/2026
An exposure of sensitive information through data queries vulnerability in Desktop API…
An exposure of sensitive information through data queries vulnerability in Desktop API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to obtain non-sensitive information.
CVE-2026-40532
Média · 6.5
CWE-425 18/09/2026
A direct request ('forced browsing') vulnerability in Wallpaper Path in Synology…
A direct request ('forced browsing') vulnerability in Wallpaper Path in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain sensitive information.
CVE-2026-40531
Média · 4.3
CWE-190 18/09/2026
Integer Overflow or Wraparound em Synology DiskStation Manager (DSM)
An integer overflow or wraparound vulnerability in File Operation in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to conduct limited denial-of-service attacks.
CVE-2026-40530
Alta · 8.0
CWE-93 18/09/2026
An improper neutralization of CRLF sequences ('CRLF injection') vulnerability in User…
An improper neutralization of CRLF sequences ('CRLF injection') vulnerability in User API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to read or write arbitrary files and conduct denial-of-service attacks after the system is rebooted.
CVE-2026-13684
Crítica · 9.8
CWE-116 18/09/2026
Improper Encoding or Escaping of Output em Synology DiskStation Manager (DSM)
An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.
CVE-2026-13683
Baixa · 2.7
CWE-89 18/09/2026
SQL Injection em Synology DiskStation Manager (DSM)
An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in EventScheduler API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users with administrator privileges to obtain non-sensitive information.
CVE-2026-13673
Alta · 8.8
CWE-732 18/09/2026
Incorrect Permission Assignment for Critical Resource em Synology DiskStation Manager (DSM)
An incorrect permission assignment for critical resource vulnerability in LDAP API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users to read or write arbitrary files and conduct denial-of-service attacks.
CVE-2026-13666
Baixa · 3.5
CWE-93 18/09/2026
An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability in Sharing…
An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability in Sharing API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users to write limited files when a victim clicks a sharing URL.
CVE-2026-13639
Crítica · 9.8
CWE-331 18/09/2026
An insufficient entropy vulnerability in login logic in Synology DiskStation Manager…
An insufficient entropy vulnerability in login logic in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.
CVE-2026-13635
Média · 5.3
CWE-116 18/09/2026
Improper Encoding or Escaping of Output em Synology DiskStation Manager (DSM)
An improper encoding or escaping of output vulnerability in Auth API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to obtain non-sensitive information.
CVE-2026-13623
Média · 4.8
CWE-79 18/09/2026
Cross-site Scripting (XSS) em Synology DiskStation Manager (DSM)
An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Theme API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users with administrator privileges to read or write limited files.
CVE-2025-13392
Crítica · 9.8
CWE-754 27/05/2026
Improper Check for Unusual or Exceptional Conditions em Synology Diskstation Manager
Improper check for unusual or exceptional conditions vulnerability in SSO in Synology DiskStation Manager (DSM) before 7.2.2-72806-5 and 7.3.1-86003-1 (7.2.1-69057 is not affected) allows remote attackers to bypass authentication with prior knowledge of the distinguished name (DN).
CVE-2024-5401
Alta · 8.8
CWE-913 04/12/2025
Improper Control of Dynamically-Managed Code Resources em Synology Diskstation Manager
Improper control of dynamically-managed code resources vulnerability in WebAPI component in Synology DiskStation Manager (DSM) before 7.1.1-42962-8 and 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote authenticated users to obtain privileges without consent via unspecified vectors.
CVE-2024-45539
Alta · 7.5
CWE-787 04/12/2025
Out-of-bounds Write em Synology Diskstation Manager
Out-of-bounds write vulnerability in cgi components in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote attackers to conduct denial-of-service attacks via unspecified vectors.
CVE-2024-45538
Crítica · 9.6
CWE-352 04/12/2025
Cross-Site Request Forgery (CSRF) em Synology Diskstation Manager
Cross-Site Request Forgery (CSRF) vulnerability in WebAPI Framework in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote attackers to execute arbitrary code via unspecified vectors.