Hak-Mz Team

An improper neutralization of input during web page generation vulnerability in the Audio Player in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write specific files.

A path traversal issue allows a remote attacker with a user account to read unexpected files or system data. Path traversal is a flaw that allows an attacker to access files and directories that are stored outside the web root folder.

A stored cross-site scripting (XSS) issue exists in the file upload functionality. A remote attacker with a valid user account can exploit this to inject malicious code into the application.

A cross-site scripting (XSS) issue allows a remote attacker who has obtained a user account to inject malicious code into the application.

A cross-site scripting (XSS) issue allows remote attackers to bypass security mechanisms or read application data. Cross-site scripting is a flaw where malicious scripts are injected into trusted websites.