Joe Lovett

A flaw in the API framework allows remote authenticated users to read arbitrary files due to the insertion of sensitive information into sent data.

An external control of system or configuration setting vulnerability in the synomount in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to write specific files.

An improper neutralization of input during web page generation vulnerability in the Notification API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write specific files.

A new issue in the Milesight industrial gateway could potentially impact critical infrastructure. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited.

This issue occurs when user-supplied input is improperly sanitized and then reflected back to the user's browser, allowing an attacker to execute arbitrary JavaScript in the context of the victim's browser session.

Name of the Vulnerable Software and Affected Versions: Software (affected versions not specified) Description: There is a command injection vulnerability that may allow an attacker to inject malicious input on the device's operating system. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.