Cq674350529

The issue is related to improper privilege management in the summary report management of Synology Presto File Server. This allows remote authenticated users to bypass security constraints.

The issue is related to improper limitation of a pathname to a restricted directory, also known as 'Path Traversal', in file operation management. This allows remote attackers to write arbitrary files via unspecified vectors.

The issue concerns a missing authentication mechanism for a critical function in the iSCSI management functionality. This allows remote attackers to read or write arbitrary files via unspecified vectors.

A Server-Side Request Forgery (SSRF) issue in the Package Center functionality allows remote authenticated users to access intranet resources via unspecified vectors. This could potentially lead to unauthorized access to internal resources.

A vulnerability in the Cisco Discovery Protocol implementation could allow an unauthenticated, adjacent attacker to cause the Cisco Discovery Protocol process to reload on an affected device. This issue is due to a heap buffer overflow in certain Cisco Discovery Protocol messages. An attacker could exploit this vulnerability by sending a malicious Cisco Discovery Protocol packet to an affected device, potentially causing a heap overflow and leading to the reload of the Cisco Discovery Protocol process. The bytes that can be written in the buffer overflow are restricted, limiting remote code execution. Note that Cisco Discovery Protocol is a Layer 2 protocol, and to exploit this vulnerability, an attacker must be in the same broadcast domain as the affected device.

The issue is related to improper neutralization of special elements used in an OS command, also known as 'OS Command Injection'. This allows remote authenticated users to execute arbitrary commands via unspecified vectors. The webapi component in Synology DiskStation Manager (DSM) is affected.

The issue is related to an improper limitation of a pathname to a restricted directory, also known as a 'Path Traversal' vulnerability, in the webapi component. This allows remote authenticated users to download arbitrary files via unspecified vectors.

The issue is related to a Path Traversal vulnerability in the webapi component, allowing remote authenticated users to read or write arbitrary files via unspecified vectors.

The issue is related to a Path Traversal vulnerability in the webapi component, allowing remote authenticated users to read arbitrary files via unspecified vectors.

The issue concerns a cleartext transmission of sensitive information vulnerability in authentication management. This allows man-in-the-middle attackers to obtain sensitive information via unspecified vectors.

The issue is related to a Path Traversal vulnerability in the webapi component, allowing remote authenticated users to delete arbitrary files via unspecified vectors.

The issue is related to an improper limitation of a pathname to a restricted directory, also known as a 'Path Traversal' vulnerability, in the webapi component. This allows remote authenticated users to delete arbitrary files via unspecified vectors.

The issue is related to a buffer copy without checking the size of the input, also known as a 'Classic Buffer Overflow' vulnerability, in the cgi component. This allows remote attackers to execute arbitrary code via unspecified vectors.

The issue is related to an improper limitation of a pathname to a restricted directory, also known as a 'Path Traversal' vulnerability, in the webapi component. This allows remote authenticated users to delete arbitrary files via unspecified vectors.

The issue is related to a buffer copy without checking the size of the input, also known as a 'Classic Buffer Overflow' vulnerability, in the cgi component. This allows remote attackers to execute arbitrary commands via unspecified vectors.

The issue is related to improper neutralization of special elements used in an SQL command, allowing remote authenticated users to inject SQL commands via unspecified vectors. This is a SQL Injection vulnerability in the webapi component.

The issue is related to a Path Traversal vulnerability in the cgi component, allowing remote authenticated users to delete arbitrary files.

The issue is related to a Path Traversal vulnerability in the webapi component. This allows remote authenticated users to delete arbitrary files.

A Cross-Site Request Forgery (CSRF) issue in the webapi component allows remote authenticated users to hijack the authentication of administrators via unspecified vectors. This could potentially lead to unauthorized actions being taken on behalf of the administrators.

The issue is a memory corruption vulnerability in the ptp process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference).