Synology Vulnerabilities and Affected Products
Vulnerabilities associated with Calendar.
Products
Clear product- DiskStation Manager (DSM)53 vulnerabilities
- Synology Router Manager (SRM)43 vulnerabilities
- Surveillance Station25 vulnerabilities
- Synology Photo Station18 vulnerabilities
- Synology DiskStation Manager (DSM)13 vulnerabilities
- Photo Station12 vulnerabilities
- Camera Firmware9 vulnerabilities
- Drive7 vulnerabilities
- BeeDrive for desktop6 vulnerabilities
- Calendar6 vulnerabilities
- camera_firmware6 vulnerabilities
- router_manager6 vulnerabilities
- Synology Drive Client6 vulnerabilities
- Unified Controller (DSMUC)6 vulnerabilities
- Media Server5 vulnerabilities
- Synology Active Backup for Business Agent5 vulnerabilities
- Synology Calendar5 vulnerabilities
- Active Backup for Business4 vulnerabilities
- Note Station4 vulnerabilities
- active_backup_for_business_agent3 vulnerabilities
- Audio Station3 vulnerabilities
- BeeStation OS (BSM)3 vulnerabilities
- Download Station3 vulnerabilities
- Safe Access3 vulnerabilities
- Synology Download Station3 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2019-11829HIGH | synology calendar Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')OS command injection vulnerability in drivers_syno_import_user.php in Synology Calendar before 2.3.1-0617 allows remote attackers to execute arbitrary commands via the crafted 'X-Real-IP' header. CWE-78Jun 30, 2019 | CVSS7.3v3.1 | EPSS2.25% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2019-11825MEDIUM | Cross-site scripting (XSS) vulnerability in Event Editor in Synology Calendar before 2.3.0-0615 allows remote attackers to inject arbitrary web script or HTML via the title parameter. CWE-79Jun 30, 2019 | CVSS6.5v3.1 | EPSS0.803% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2019-11820MEDIUM | Information exposure through process environment vulnerability in Synology Calendar before 2.3.3-0620 allows local users to obtain credentials via cmdline. CWE-522May 9, 2019 | CVSS5.5v3.1 | EPSS0.281% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2018-13299MEDIUM | Relative path traversal vulnerability in Attachment Uploader in Synology Calendar before 2.2.2-0532 allows remote authenticated users to upload arbitrary files via the filename parameter. | CVSS4.3v3.0 | EPSS1.36% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2018-8927MEDIUM | Improper authorization vulnerability in SYNO.Cal.Event in Calendar before 2.1.2-0511 allows remote authenticated users to create arbitrary events via the (1) cal_id or (2) original_cal_id parameter. CWE-863Jun 14, 2018 | CVSS5.4v3.0 | EPSS0.907% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2018-8915MEDIUM | Cross-site scripting (XSS) vulnerability in Notification Center in Synology Calendar before 2.1.1-0502 allows remote authenticated users to inject arbitrary web script or HTML via title parameter. CWE-79May 10, 2018 | CVSS6.5v3.0 | EPSS0.803% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |