Vulnerabilidades de Synology
CVEs publicadas que afetam produtos de Synology: 63 registro(s), com severidade, exploração e correções.
DiskStation Manager (DSM) 23BeeDrive for desktop 6Surveillance Station 6Beedrive 6Diskstation Manager 5Diskstation Manager Unified Controller 4Synology Router Manager (SRM) 4Router Manager 4Synology Chat Server 3Unified Controller (DSMUC) 3Assistant 2Ssl Vpn Client 2Hyper Backup 2Hyper Backup Explorer 1Directory Server 1Skynas Firmware 1Vs960hd Firmware 1Safe Access 1Beestation Os 1Mail Server 1Contacts 1Note Station Client 1Active Backup For Business 1Active Backup For Business Recovery Media Creator 1Storage Manager 1Activeprotect Agent 1C2 Identity Edge Server 1Presto Client 1Active Backup For Business Agent 1
CVE-2025-54160
Alta · 7.8
CWE-22 04/12/2025
Path Traversal em Synology Beedrive
Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.2-13960 allows local users to execute arbitrary code via unspecified vectors.
CVE-2025-54159
Alta · 7.5
CWE-862 04/12/2025
Missing Authorization em Synology Beedrive
Missing authorization vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.2-13960 allows remote attackers to delete arbitrary files via unspecified vectors.
CVE-2025-54158
Alta · 7.8
CWE-306 04/12/2025
Missing Authentication for Critical Function em Synology Beedrive
Missing authentication for critical function vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.2-13960 allows local users to execute arbitrary code via unspecified vectors.
CVE-2025-2848
Média · 6.3
CWE-862 04/12/2025
Missing Authorization em Synology Mail Server
A vulnerability in Synology Mail Server allows remote authenticated attackers to read and write non-sensitive settings, and disable some non-critical functions.
CVE-2025-29846
Alta · 7.2
CWE-22 04/12/2025
Path Traversal em Synology Router Manager
A vulnerability in portenable cgi allows remote authenticated users to get the status of installed packages.
CVE-2025-29845
Média · 4.3
CWE-22 04/12/2025
Path Traversal em Synology Router Manager
A vulnerability in VideoPlayer2 subtitle cgi allows remote authenticated users to read .srt files.
CVE-2025-29844
Média · 4.3
CWE-22 04/12/2025
Path Traversal em Synology Router Manager
A vulnerability in FileStation file cgi allows remote authenticated users to read file metadata and path information.
CVE-2025-29843
Média · 5.4
CWE-22 04/12/2025
Path Traversal em Synology Router Manager
A vulnerability in FileStation thumb cgi allows remote authenticated users to read/write image files.
CVE-2024-5401
Alta · 8.8
CWE-913 04/12/2025
Improper Control of Dynamically-Managed Code Resources em Synology Diskstation Manager
Improper control of dynamically-managed code resources vulnerability in WebAPI component in Synology DiskStation Manager (DSM) before 7.1.1-42962-8 and 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote authenticated users to obtain privileges without consent via unspecified vectors.
CVE-2024-45539
Alta · 7.5
CWE-787 04/12/2025
Out-of-bounds Write em Synology Diskstation Manager
Out-of-bounds write vulnerability in cgi components in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote attackers to conduct denial-of-service attacks via unspecified vectors.
CVE-2024-45538
Crítica · 9.6
CWE-352 04/12/2025
Cross-Site Request Forgery (CSRF) em Synology Diskstation Manager
Cross-Site Request Forgery (CSRF) vulnerability in WebAPI Framework in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote attackers to execute arbitrary code via unspecified vectors.
CVE-2021-3156
Alta · 7.8
KEV Urgente · 76 Exploit público CWE-193 26/01/2021
Sudo Heap-Based Buffer Overflow Vulnerability
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.
CVE-2020-1472
Média · 5.5
KEV Urgente · 96 Exploit público Ransomware 17/08/2020
Microsoft Netlogon Privilege Escalation Vulnerability
An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). An attacker who successfully exploited the vulnerability could run a specially crafted application on a device on the network.
To exploit the vulnerability, an unauthenticated attacker would be required to use MS-NRPC to connect to a domain controller to obtain domain administrator access.
Microsoft is addressing the vulnerability in a phased two-part rollout. These updates address the vulnerability by modifying how Netlogon handles the usage of Netlogon secure channels.
For guidelines on how to manage the changes required for this vulnerability and more information on the phased rollout, see How to manage the changes in Netlogon secure channel connections associated with CVE-2020-1472 (updated September 28, 2020).
When the second phase of Windows updates become available in Q1 2021, customers will be notified via a revision to this security vulnerability. If you wish to be notified when these updates are released, we recommend that you register for the security notifications mailer to be alerted of content changes to this advisory. See Microsoft Technical Security Notifications.