Known vulnerabilities in DiskStation Manager (DSM) - page 2

Software CPE: cpe:2.3:a:synology:diskstation_manager_dsm:*:*:*:*:*:*:*:*
Total vulnerabilities: 39
Public exploits: 1
Known exploited (KEV): 0

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting DiskStation Manager (DSM) DiskStation Manager (DSM) is affected by 39 known vulnerabilities: 10 high, 18 medium, 11 low Critical High Medium Low

Vulnerabilities (39)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU119216 - Improper Check for Unusual or Exceptional Conditions
CVE-2025-13392
CWE-754 High
No
No
7.2.2-72806-5, 7.3.1-86003-1 05.12.2025 SB2025120506
#VU107360 - Improper Certificate Validation
CVE-2024-10445
CWE-295 Medium
No
No
6.2.4-25556-8, 7.1.1-42962-7, 7.2.1-69057-6, 7.2.2-72806-1, 7.2-64570-4 10.04.2025 SB2025041037
SB2025041126
#VU107357 - Improper Encoding or Escaping of Output
CVE-2024-50629
CWE-116 Medium
Available
No
6.2.4-25556-8, 7.1.1-42962-7, 7.2.1-69057-6, 7.2.2-72806-1, 7.2-64570-4 10.04.2025 SB2025041037
SB2025041126
#VU107352 - Improper Certificate Validation
CVE-2024-10444
CWE-295 High
No
No
7.1.1-42962-8, 7.2.1-69057-7, 7.2.2-72806-3 10.04.2025 SB2025041030
#VU107350 - Argument Injection or Modification
CVE-2024-10441
CWE-88 High
No
No
6.2.4-25556-8, 7.1.1-42962-7, 7.2.1-69057-6, 7.2.2-72806-1, 7.2-64570-4 10.04.2025 SB2025041037
SB2025041126
#VU99971 - Channel Accessible by Non-Endpoint ('Man-in-the-Middle')
CWE-300 Medium
No
No
7.2.2-72806-1 06.11.2024 SB2024110660
SB2024110661
#VU99970 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-89 High
No
No
7.2.2-72806-1 06.11.2024 SB2024110660
SB2024110661
SB2024110663
#VU99969 - Channel Accessible by Non-Endpoint ('Man-in-the-Middle')
CWE-300 Medium
No
No
7.2.2-72806-1 06.11.2024 SB2024110660
#VU99968 - Improper input validation
CWE-20 High
No
No
7.2.2-72806-1 06.11.2024 SB2024110660
SB2024110661
#VU52354 - Command injection
CVE-2021-26566
CWE-77 High
No
No
6.2.3-25426-3 20.04.2021 SB2021042002
#VU52353 - Cleartext Transmission of Sensitive Information
CVE-2021-26565
CWE-319 Medium
No
No
6.2.3-25426-3 20.04.2021 SB2021042002
#VU52352 - Cleartext Transmission of Sensitive Information
CVE-2021-26564
CWE-319 Medium
No
No
6.2.3-25426-3 20.04.2021 SB2021042002
#VU52351 - Improper Access Control
CVE-2021-26563
CWE-284 Low
No
No
6.2.3-25426-3 20.04.2021 SB2021042002
#VU52350 - Out-of-bounds write
CVE-2021-26562
CWE-787 High
No
No
6.2.3-25426-3 20.04.2021 SB2021042002
#VU52349 - Stack-based buffer overflow
CVE-2021-26561
CWE-121 High
No
No
6.2.3-25426-3 20.04.2021 SB2021042002
#VU52348 - Cleartext Transmission of Sensitive Information
CVE-2021-26560
CWE-319 Medium
No
No
6.2.3-25426-3 20.04.2021 SB2021042002
#VU30136 - Channel Accessible by Non-Endpoint ('Man-in-the-Middle')
CWE-300 Medium
No
No
6.2.3-25426-2 16.07.2020 SB20200716118
#VU332 - Exposure of sensitive information to an unauthorized actor
CVE-2016-6489
CWE-200 Low
No
No
- 19.08.2016 SB2016081901
SB2017062213
SB2017020601
and 3 more
#VU331 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
- 19.08.2016 SB2016081901


Showing elements 21 - 40 out of 39