VARIoT IoT vulnerabilities database

An issue was discovered on AudioCodes 450HD IP Phone devices with firmware 3.0.0.535.106. The traceroute and ping functionality, which uses a parameter in a request to command.cgi from the Monitoring page in the web UI, unsafely puts user-alterable data directly into an OS command, leading to Remote Code Execution via shell metacharacters in the query string. AudioCodes 450HD IP Phone Device firmware includes OS A command injection vulnerability exists.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. The vulnerability stems from the fact that the network system or product does not correctly filter special characters, commands, etc. in the process of constructing executable commands of the operating system from external input data. Attackers can exploit this vulnerability to execute illegal operating system commands

While updating blacklisting region shared buffered memory region is not validated against newly updated black list, causing boot-up to be compromised in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9206, MDM9607, MDM9650, MDM9655, QCS605, SD 210/SD 212/SD 205, SD 410/12, SD 615/16/SD 415, SD 712 / SD 710 / SD 670, SD 835, SD 845 / SD 850, SD 8CX, SXR1130. plural Snapdragon The product contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Qualcomm Closed-Source Components are prone to multiple unspecified vulnerabilities. An attacker can exploit these issues to perform unauthorized actions. This may aid in further attacks. These issues are being tracked by Android Bug IDs A-120487384, A-117119000, A-117118976, A-117118295, A-117119172, A-122473270, A-109678120, A-111093019, A-111092813, A-111089816, A-111092945, A-111092919, A-111091938, A-111093762, A-111093242, A-111090373, A-111092814, A-111093763, A-111093243, A-111089817, A-111092400, A-111090534, A-111091378, A-111092946, A-111093022, A-111093244, A-111092888, A-111093280, A-111092401, A-111093259, A-111090535, A-112279580, A-112279127, A-119049704, A-119052960, A-114042276, A-117118499, A-117119174, A-117119152, A-117118789, A-122472377, A-120483842, A-122472139 and A-122473145. Qualcomm MDM9206 is a central processing unit (CPU) product of Qualcomm (Qualcomm). Security flaws exist in several Qualcomm products. The following products and versions are affected: Qualcomm MDM9206; MDM9607; MDM9650; MDM9655; QCS605; SD 210; SD 212; SD 205; SD 410; 835; SD 845; SD 850; SD 8CX; SXR1130

Data length received from firmware is not validated against the max allowed size which can result in buffer overflow. in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in IPQ4019, IPQ8064, IPQ8074, MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, QCS605, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 636, SD 712 / SD 710 / SD 670, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM630, SDM660, SDX20, SDX24. plural Snapdragon The product contains an integer overflow vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Google Android is prone to the following security vulnerabilities: 1. Multiple buffer-overflow vulnerabilities 2. Multiple information-disclosure vulnerabilities 3. Multiple security-bypass vulnerabilities 4. Multiple security vulnerabilities 5. Multiple integer overflow vulnerabilities An attacker can exploit these issues to bypass certain security restrictions and to perform unauthorized actions, gain elevated privileges, obtain sensitive information or execute arbitrary code. Failed exploits may result in a denial-of-service condition. These issues are being tracked by Android Bug IDs A-79377832, A-72957385, A-109741680, A-77527719, A-109741946, A-111127853, A-111128575, A-111126050, A-111125792, A-111128301, A-111128420, A-111128838, A-111128797, A-111128421, A-111128578, A-111127989, A-111128877, A-111128841, A-111126532, A-112277221, A-112276863, A-112278150, A-112277910, A-112277186, A-112278861, A-112277891, A-112278405, A-112277852, A-120487136*. Qualcomm MDM9206 and others are products of Qualcomm (Qualcomm). MDM9206 is a central processing unit (CPU) product. MDM9607 is a central processing unit (CPU) product. MDM9640 is a central processing unit (CPU) product. An input validation error vulnerability exists in several Qualcomm products. The vulnerability stems from the failure of the network system or product to properly validate the input data

Improper buffer length validation in WLAN function can lead to a potential integer oveflow issue in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, QCS605, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 636, SD 675, SD 712 / SD 710 / SD 670, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM630, SDM660, SDX20, SDX24, SM7150. plural Snapdragon The product contains an integer overflow vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Google Android is prone to the following security vulnerabilities: 1. Multiple buffer-overflow vulnerabilities 2. Multiple information-disclosure vulnerabilities 3. Multiple security-bypass vulnerabilities 4. Multiple security vulnerabilities 5. Multiple integer overflow vulnerabilities An attacker can exploit these issues to bypass certain security restrictions and to perform unauthorized actions, gain elevated privileges, obtain sensitive information or execute arbitrary code. Failed exploits may result in a denial-of-service condition. These issues are being tracked by Android Bug IDs A-79377832, A-72957385, A-109741680, A-77527719, A-109741946, A-111127853, A-111128575, A-111126050, A-111125792, A-111128301, A-111128420, A-111128838, A-111128797, A-111128421, A-111128578, A-111127989, A-111128877, A-111128841, A-111126532, A-112277221, A-112276863, A-112278150, A-112277910, A-112277186, A-112278861, A-112277891, A-112278405, A-112277852, A-120487136*. Qualcomm MDM9206 and others are products of Qualcomm (Qualcomm). MDM9206 is a central processing unit (CPU) product. MDM9607 is a central processing unit (CPU) product. MDM9640 is a central processing unit (CPU) product. An input validation error vulnerability exists in several Qualcomm products. The vulnerability stems from the failure of the network system or product to properly validate the input data. The following products and versions are affected: Qualcomm MDM9150; MDM9206; MDM9607; MDM9640; MDM9650; MSM8996AU; QCA6174A; QCA6574AU; QCA9377; QCA9379; SD 450; SD 625; SD 636; SD 675; SD 712; SD 710; SD 670; SD 820A; SD 835; SD 845; SD 850; SD 855; SDA660;

Improper buffer length check before copying can lead to integer overflow and then a buffer overflow in WMA event handler in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCA6574AU, QCS605, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 636, SD 712 / SD 710 / SD 670, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM630, SDM660, SDX20, SDX24. plural Snapdragon The product contains a buffer error vulnerability and an integer overflow vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Google Android is prone to the following security vulnerabilities: 1. Multiple buffer-overflow vulnerabilities 2. Multiple information-disclosure vulnerabilities 3. Multiple security-bypass vulnerabilities 4. Multiple security vulnerabilities 5. Multiple integer overflow vulnerabilities An attacker can exploit these issues to bypass certain security restrictions and to perform unauthorized actions, gain elevated privileges, obtain sensitive information or execute arbitrary code. Failed exploits may result in a denial-of-service condition. These issues are being tracked by Android Bug IDs A-79377832, A-72957385, A-109741680, A-77527719, A-109741946, A-111127853, A-111128575, A-111126050, A-111125792, A-111128301, A-111128420, A-111128838, A-111128797, A-111128421, A-111128578, A-111127989, A-111128877, A-111128841, A-111126532, A-112277221, A-112276863, A-112278150, A-112277910, A-112277186, A-112278861, A-112277891, A-112278405, A-112277852, A-120487136*. Qualcomm MDM9206 and others are products of Qualcomm (Qualcomm). MDM9206 is a central processing unit (CPU) product. MDM9607 is a central processing unit (CPU) product. MDM9640 is a central processing unit (CPU) product. A buffer error vulnerability exists in several Qualcomm products. This vulnerability stems from the incorrect verification of data boundaries when the network system or product performs operations on the memory, resulting in incorrect read and write operations to other associated memory locations. Attackers can exploit this vulnerability to cause buffer overflow or heap overflow, etc

Failure to initialize the extra buffer can lead to an out of buffer access in WLAN function in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCS605, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 636, SD 712 / SD 710 / SD 670, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM630, SDM660, SDX20, SDX24. plural Snapdragon The product contains an initialization vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Google Android is prone to the following security vulnerabilities: 1. Multiple buffer-overflow vulnerabilities 2. Multiple information-disclosure vulnerabilities 3. Multiple security-bypass vulnerabilities 4. Multiple security vulnerabilities 5. Multiple integer overflow vulnerabilities An attacker can exploit these issues to bypass certain security restrictions and to perform unauthorized actions, gain elevated privileges, obtain sensitive information or execute arbitrary code. Failed exploits may result in a denial-of-service condition. These issues are being tracked by Android Bug IDs A-79377832, A-72957385, A-109741680, A-77527719, A-109741946, A-111127853, A-111128575, A-111126050, A-111125792, A-111128301, A-111128420, A-111128838, A-111128797, A-111128421, A-111128578, A-111127989, A-111128877, A-111128841, A-111126532, A-112277221, A-112276863, A-112278150, A-112277910, A-112277186, A-112278861, A-112277891, A-112278405, A-112277852, A-120487136*. Qualcomm MDM9206 and others are products of Qualcomm (Qualcomm). MDM9206 is a central processing unit (CPU) product. MDM9607 is a central processing unit (CPU) product. MDM9640 is a central processing unit (CPU) product. WLAN is one of the wireless local area network components. A buffer error vulnerability exists in the WLAN component of several Qualcomm products. This vulnerability stems from the incorrect verification of data boundaries when the network system or product performs operations on the memory, resulting in incorrect read and write operations to other associated memory locations. Attackers can exploit this vulnerability to cause buffer overflow or heap overflow, etc

While processing ssid IE length from remote AP, possible out-of-bounds access may occur due to crafted ssid IE length in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 650/52, SD 820, SD 820A, SDM439, SDX20. plural Snapdragon The product contains an out-of-bounds vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Google Android is prone to the following security vulnerabilities: 1. Multiple buffer-overflow vulnerabilities 2. Multiple information-disclosure vulnerabilities 3. Multiple security-bypass vulnerabilities 4. Multiple security vulnerabilities 5. Multiple integer overflow vulnerabilities An attacker can exploit these issues to bypass certain security restrictions and to perform unauthorized actions, gain elevated privileges, obtain sensitive information or execute arbitrary code. Failed exploits may result in a denial-of-service condition. These issues are being tracked by Android Bug IDs A-79377832, A-72957385, A-109741680, A-77527719, A-109741946, A-111127853, A-111128575, A-111126050, A-111125792, A-111128301, A-111128420, A-111128838, A-111128797, A-111128421, A-111128578, A-111127989, A-111128877, A-111128841, A-111126532, A-112277221, A-112276863, A-112278150, A-112277910, A-112277186, A-112278861, A-112277891, A-112278405, A-112277852, A-120487136*

Use-after-free condition due to Improper handling of hrtimers when the PMU driver tries to access its events in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in MDM9206, MDM9607, MDM9650, MSM8909W, QCS605, Qualcomm 215, SD 425, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 712 / SD 710 / SD 670, SD 820A, SD 845 / SD 850, SD 855, SDM439, SDM630, SDM660, SDX24. plural Snapdragon The product contains a vulnerability related to the use of released memory.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Google Android is prone to the following security vulnerabilities: 1. Multiple buffer-overflow vulnerabilities 2. Multiple information-disclosure vulnerabilities 3. Multiple security-bypass vulnerabilities 4. Multiple security vulnerabilities 5. Multiple integer overflow vulnerabilities An attacker can exploit these issues to bypass certain security restrictions and to perform unauthorized actions, gain elevated privileges, obtain sensitive information or execute arbitrary code. Failed exploits may result in a denial-of-service condition. These issues are being tracked by Android Bug IDs A-79377832, A-72957385, A-109741680, A-77527719, A-109741946, A-111127853, A-111128575, A-111126050, A-111125792, A-111128301, A-111128420, A-111128838, A-111128797, A-111128421, A-111128578, A-111127989, A-111128877, A-111128841, A-111126532, A-112277221, A-112276863, A-112278150, A-112277910, A-112277186, A-112278861, A-112277891, A-112278405, A-112277852, A-120487136*. Qualcomm MDM9206 and others are products of Qualcomm (Qualcomm). MDM9206 is a central processing unit (CPU) product. MDM9607 is a central processing unit (CPU) product. MDM9650 is a central processing unit (CPU) product. A resource management error vulnerability exists in several Qualcomm products. This vulnerability stems from improper management of system resources (such as memory, disk space, files, etc.) by network systems or products

Shell Metacharacter Injection in the SSH configuration interface on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to execute arbitrary system commands and gain a root shell. Grandstream GXP16xx VoIP phone Contains a command injection vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Grandstream GXP16xx VoIP is a 16XX series IP phone of Grandstream. The SSH configuration page in Grandstream GXP16xx VoIP version 1.0.4.128 has an operating system command injection vulnerability. The vulnerability stems from the fact that the network system or product does not correctly filter special characters, commands, etc. in the process of constructing executable commands of the operating system from external input data. Attackers can exploit this vulnerability to execute illegal operating system commands

Signature verification of the skel library could potentially be disabled as the memory region on the remote subsystem in which the library is loaded is allocated from userspace currently in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS605, Qualcomm 215, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 650/52, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24. plural Snapdragon The product contains vulnerabilities related to authorization, permissions, and access control.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Qualcomm Closed-Source Components are prone to multiple unspecified vulnerabilities. An attacker can exploit these issues to perform unauthorized actions. This may aid in further attacks. These issues are being tracked by Android Bug IDs A-120487384, A-117119000, A-117118976, A-117118295, A-117119172, A-122473270, A-109678120, A-111093019, A-111092813, A-111089816, A-111092945, A-111092919, A-111091938, A-111093762, A-111093242, A-111090373, A-111092814, A-111093763, A-111093243, A-111089817, A-111092400, A-111090534, A-111091378, A-111092946, A-111093022, A-111093244, A-111092888, A-111093280, A-111092401, A-111093259, A-111090535, A-112279580, A-112279127, A-119049704, A-119052960, A-114042276, A-117118499, A-117119174, A-117119152, A-117118789, A-122472377, A-120483842, A-122472139 and A-122473145

Improper input validation on input which is used as an array index will lead to an out of bounds issue while processing AP find event from firmware in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, SD 210/SD 212/SD 205, SD 625, SD 675, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 845 / SD 850, SD 855, SDX20, SDX24, SM7150. plural Snapdragon The product contains a vulnerability related to array index validation.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Google Android is prone to the following security vulnerabilities: 1. Multiple buffer-overflow vulnerabilities 2. Multiple information-disclosure vulnerabilities 3. Multiple security-bypass vulnerabilities 4. Multiple security vulnerabilities 5. Multiple integer overflow vulnerabilities An attacker can exploit these issues to bypass certain security restrictions and to perform unauthorized actions, gain elevated privileges, obtain sensitive information or execute arbitrary code. Failed exploits may result in a denial-of-service condition. These issues are being tracked by Android Bug IDs A-79377832, A-72957385, A-109741680, A-77527719, A-109741946, A-111127853, A-111128575, A-111126050, A-111125792, A-111128301, A-111128420, A-111128838, A-111128797, A-111128421, A-111128578, A-111127989, A-111128877, A-111128841, A-111126532, A-112277221, A-112276863, A-112278150, A-112277910, A-112277186, A-112278861, A-112277891, A-112278405, A-112277852, A-120487136*. Qualcomm MDM9206 and others are products of Qualcomm (Qualcomm). MDM9206 is a central processing unit (CPU) product. MDM9607 is a central processing unit (CPU) product. MDM9640 is a central processing unit (CPU) product. An input validation error vulnerability exists in several Qualcomm products. The vulnerability stems from the failure of the network system or product to properly validate the input data. The following products and versions are affected: Qualcomm MDM9150; MDM9206; MDM9607; MDM9640; MDM9650; MSM8996AU; QCA6174A; QCA6574AU; 670; SD 820; SD 820A; SD 845; SD 850; SD 855; SDX20; SDX24; SM7150

Kernel can write to arbitrary memory address passed by user while freeing/stopping a thread in Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in QCS605, SD 675, SD 712 / SD 710 / SD 670, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SM7150, SXR1130. plural Snapdragon The product contains an input validation vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Qualcomm Closed-Source Components are prone to multiple unspecified vulnerabilities. An attacker can exploit these issues to perform unauthorized actions. This may aid in further attacks. These issues are being tracked by Android Bug IDs A-120487384, A-117119000, A-117118976, A-117118295, A-117119172, A-122473270, A-109678120, A-111093019, A-111092813, A-111089816, A-111092945, A-111092919, A-111091938, A-111093762, A-111093242, A-111090373, A-111092814, A-111093763, A-111093243, A-111089817, A-111092400, A-111090534, A-111091378, A-111092946, A-111093022, A-111093244, A-111092888, A-111093280, A-111092401, A-111093259, A-111090535, A-112279580, A-112279127, A-119049704, A-119052960, A-114042276, A-117118499, A-117119174, A-117119152, A-117118789, A-122472377, A-120483842, A-122472139 and A-122473145. Qualcomm SD 712 and others are a central processing unit (CPU) product of Qualcomm (Qualcomm). An access control error vulnerability exists in kernel components in several Qualcomm products. This vulnerability stems from network systems or products not properly restricting access to resources from unauthorized roles. The following products and versions are affected: Qualcomm QCS605; SD 675; SD 712; SD 710; SD 670; SD 835; SD 845; SD 850; SD 855; SD 8CX; SM7150; SXR1130

Missing custom error page vulnerability in Synology Web Station before 2.1.3-0139 allows remote attackers to conduct phishing attacks via a crafted URL. Synology Web Station Contains an open redirect vulnerability.Information may be obtained and information may be altered. Synology Web Station is an application from Synology, a Taiwan-based company that supports the creation of personal websites. A security vulnerability exists in Synology Web Station versions earlier than 2.1.3-0139

Relative path traversal vulnerability in Attachment Uploader in Synology Calendar before 2.2.2-0532 allows remote authenticated users to upload arbitrary files via the filename parameter. Synology Calendar Contains a path traversal vulnerability.Information may be tampered with. Synology Calendar is a file protection program run on Synology NAS (Network Storage Server) devices by Synology, a Taiwan-based company. An attacker could exploit this vulnerability to access locations outside of restricted directories

Channel accessible by non-endpoint vulnerability in privacy page in Synology Android Moments before 1.2.3-199 allows man-in-the-middle attackers to execute arbitrary code via unspecified vectors. Synology Android Moments Contains vulnerabilities related to authorization, permissions, and access control.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Synology Android Moments is an Android-based application developed by Synology Corporation of Taiwan, China, for viewing various documents stored in Synology Drive. The privacy page in versions prior to Synology Android Moments 1.2.3-199 is vulnerable to permissions and access control issues

Information exposure vulnerability in SYNO.SynologyDrive.Files in Synology Drive before 1.1.2-10562 allows remote attackers to obtain sensitive system information via the dsm_path parameter. Synology Drive is a collaborative office suite developed by Synology, a Taiwan-based company. The product includes functions such as document management, collaborative office and file synchronization backup. This vulnerability is caused by errors in network system or product configuration during operation

Uncontrolled resource consumption vulnerability in TLS configuration in Synology MailPlus Server before 2.0.5-0606 allows remote attackers to conduct denial-of-service attacks via client-initiated renegotiation. Synology MailPlus Server Contains a resource exhaustion vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. Synology MailPlus Server is an email service suite provided by Synology, Taiwan, China. The product supports the management of user accounts, mail records, etc. There is a security vulnerability in the TLS configuration in Synology MailPlus Server versions earlier than 2.0.5-0606. An attacker could exploit this vulnerability to cause a denial of service

Information exposure vulnerability in SYNO.Personal.Profile in Synology Application Service before 1.5.4-0320 allows remote authenticated users to obtain sensitive system information via the uid parameter. Synology Application Service is a Synology NAS (Network Storage Server) function extension framework developed by China Taiwan Synology Corporation

Cross-site scripting (XSS) vulnerability in Control Panel SSO Settings in Synology DiskStation Manager (DSM) before 6.2.1-23824 allows remote authenticated users to inject arbitrary web script or HTML via the URL parameter. Synology DiskStation Manager (DSM) Contains a cross-site scripting vulnerability.Information may be obtained and information may be altered. Synology DiskStation Manager (DSM) is an operating system for network storage servers (NAS) developed by Synology, Taiwan. The operating system can manage data, documents, photos, music and other information. An attacker could exploit this vulnerability to execute client code

Information exposure vulnerability in /usr/syno/etc/mount.conf in Synology DiskStation Manager (DSM) before 6.2.1-23824 allows remote authenticated users to obtain sensitive information via the world readable configuration. Synology DiskStation Manager (DSM) Contains an information disclosure vulnerability.Information may be obtained. Synology DiskStation Manager (DSM) is an operating system for network storage servers (NAS) developed by Synology, Taiwan. The operating system can manage data, documents, photos, music and other information. The vulnerability is caused by errors in network system or product configuration during operation