U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

National Vulnerability Database

National Vulnerability Database

NVD

National Vulnerability Database
  1. VulnerabilitiesSearch And Statistics

Search Results (Refine Search)

Search Parameters:
  • Results Type: Overview
  • Keyword (text search): synology
  • Search Type: Search All
There are 232 matching records.
Displaying matches 1 through 20.
Vuln ID Summary CVSS Severity
CVE-2024-29241

Missing authorization vulnerability in System webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remote authenticated users to bypass security constraints via unspecified vectors.

Published: March 28, 2024; 3:16:12 AM -0400 		V3.x:(not available)
 V2.0:(not available)
CVE-2024-29240

Missing authorization vulnerability in LayoutSave webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allows remote authenticated users to conduct denial-of-service attacks via unspecified vectors.

Published: March 28, 2024; 3:16:11 AM -0400 		V3.x:(not available)
 V2.0:(not available)
CVE-2024-29239

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Recording.CountByCategory webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allows remote authenticated users to inject SQL commands via unspecified vectors.

Published: March 28, 2024; 3:16:10 AM -0400 		V3.x:(not available)
 V2.0:(not available)
CVE-2024-29238

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Log.CountByCategory webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remote authenticated users to inject SQL commands via unspecified vectors.

Published: March 28, 2024; 3:16:09 AM -0400 		V3.x:(not available)
 V2.0:(not available)
CVE-2024-29237

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in ActionRule.Delete webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allows remote authenticated users to inject SQL commands via unspecified vectors.

Published: March 28, 2024; 3:16:09 AM -0400 		V3.x:(not available)
 V2.0:(not available)
CVE-2024-29236

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in AudioPattern.Delete webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remote authenticated users to inject SQL commands via unspecified vectors.

Published: March 28, 2024; 3:16:08 AM -0400 		V3.x:(not available)
 V2.0:(not available)
CVE-2024-29235

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in IOModule.EnumLog webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allows remote authenticated users to inject SQL commands via unspecified vectors.

Published: March 28, 2024; 3:16:07 AM -0400 		V3.x:(not available)
 V2.0:(not available)
CVE-2024-29234

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Group.Save webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allows remote authenticated users to inject SQL commands via unspecified vectors.

Published: March 28, 2024; 3:16:06 AM -0400 		V3.x:(not available)
 V2.0:(not available)
CVE-2024-29233

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Emap.Delete webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remote authenticated users to inject SQL commands via unspecified vectors.

Published: March 28, 2024; 3:16:06 AM -0400 		V3.x:(not available)
 V2.0:(not available)
CVE-2024-29232

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Alert.Enum webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allows remote authenticated users to inject SQL commands via unspecified vectors.

Published: March 28, 2024; 3:16:05 AM -0400 		V3.x:(not available)
 V2.0:(not available)
CVE-2024-29231

Improper validation of array index vulnerability in UserPrivilege.Enum webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remote authenticated users to bypass security constraints via unspecified vectors.

Published: March 28, 2024; 3:16:04 AM -0400 		V3.x:(not available)
 V2.0:(not available)
CVE-2024-29230

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in SnapShot.CountByCategory webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remote authenticated users to inject SQL commands via unspecified vectors.

Published: March 28, 2024; 3:16:03 AM -0400 		V3.x:(not available)
 V2.0:(not available)
CVE-2024-29229

Missing authorization vulnerability in GetLiveViewPath webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remote authenticated users to obtain sensitive information via unspecified vectors.

Published: March 28, 2024; 3:16:02 AM -0400 		V3.x:(not available)
 V2.0:(not available)
CVE-2024-29228

Missing authorization vulnerability in GetStmUrlPath webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remote authenticated users to obtain sensitive information via unspecified vectors.

Published: March 28, 2024; 3:16:00 AM -0400 		V3.x:(not available)
 V2.0:(not available)
CVE-2024-29227

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Layout.LayoutSave webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remote authenticated users to inject SQL commands via unspecified vectors.

Published: March 28, 2024; 3:15:59 AM -0400 		V3.x:(not available)
 V2.0:(not available)
CVE-2024-0854

URL redirection to untrusted site ('Open Redirect') vulnerability in file access component in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 allows remote authenticated users to conduct phishing attacks via unspecified vectors.

Published: January 24, 2024; 5:15:09 AM -0500 		V3.1: 5.4 MEDIUM
 V2.0:(not available)
CVE-2023-5748

Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in cgi component in Synology SSL VPN Client before 1.4.7-0687 allows local users to conduct denial-of-service attacks via unspecified vectors.

Published: November 06, 2023; 11:24:19 PM -0500 		V3.1: 5.5 MEDIUM
 V2.0:(not available)
CVE-2023-5746

A vulnerability regarding use of externally-controlled format string is found in the cgi component. This allows remote attackers to execute arbitrary code via unspecified vectors. The following models with Synology Camera Firmware versions before 1.0.5-0185 may be affected: BC500 and TC500.

Published: October 25, 2023; 2:17:44 PM -0400 		V3.1: 9.8 CRITICAL
 V2.0:(not available)
CVE-2023-41741

Exposure of sensitive information to an unauthorized actor vulnerability in cgi component in Synology Router Manager (SRM) before 1.3.1-9346-6 allows remote attackers to obtain sensitive information via unspecified vectors.

Published: August 31, 2023; 6:15:08 AM -0400 		V3.1: 7.5 HIGH
 V2.0:(not available)
CVE-2023-41740

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in cgi component in Synology Router Manager (SRM) before 1.3.1-9346-6 allows remote attackers to read specific files via unspecified vectors.

Published: August 31, 2023; 6:15:08 AM -0400 		V3.1: 5.3 MEDIUM
 V2.0:(not available)