Maximilian Tews

**Name of the Vulnerable Software and Affected Versions** Synology File Station versions prior to 1.2.3-0252 Synology File Station versions prior to 1.1.5-0125 **Description** The issue allows remote attackers to obtain sensitive information. This is achieved via the `folder path` or `real path` parameter in the SYNO.FolderSharing.List endpoint. **Recommendations** For versions prior to 1.2.3-0252, update to version 1.2.3-0252 or later. For versions prior to 1.1.5-0125, update to version 1.1.5-0125 or later. As a temporary workaround, consider restricting access to the SYNO.FolderSharing.List endpoint until a patch is available. Avoid using the `folder path` and `real path` parameters in the affected endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Synology Router Manager (SRM) versions prior to 1.1.7-6941-2 **Description** The issue allows remote attackers to obtain sensitive information. This is achieved via the `folder path` or `real path` parameter in the SYNO.FolderSharing.List endpoint. **Recommendations** For versions prior to 1.1.7-6941-2, update to version 1.1.7-6941-2 or later to resolve the issue. As a temporary workaround, consider restricting access to the SYNO.FolderSharing.List endpoint to minimize the risk of exploitation. Avoid using the `folder path` and `real path` parameters in the affected endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Synology Router Manager (SRM) versions prior to 1.1.7-6941-2 **Description** The issue allows remote authenticated users to determine the existence of files or obtain sensitive information of files via the `file path` parameter. **Recommendations** For versions prior to 1.1.7-6941-2, update to version 1.1.7-6941-2 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Synology DiskStation Manager (DSM) versions prior to 6.2.1-23824 **Description** The issue allows remote authenticated users to obtain sensitive information due to an information exposure vulnerability in the /usr/syno/etc/mount.conf configuration file. **Recommendations** For versions prior to 6.2.1-23824, update to version 6.2.1-23824 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Synology Router Manager (SRM) versions prior to 1.1.7-6941-2 **Description** The issue allows remote authenticated users to obtain sensitive information due to an information exposure vulnerability in the /usr/syno/etc/mount.conf configuration file. This is accessible because the configuration file is world-readable. **Recommendations** For versions prior to 1.1.7-6941-2, update to version 1.1.7-6941-2 or later to resolve the issue. As a temporary workaround, consider restricting access to the /usr/syno/etc/mount.conf file to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Synology DiskStation Manager (DSM) versions prior to 6.2.1-23824 **Description** A cross-site scripting (XSS) issue exists in the Control Panel SSO Settings of Synology DiskStation Manager (DSM), allowing remote authenticated users to inject arbitrary web script or HTML via the URL parameter. **Recommendations** For versions prior to 6.2.1-23824, update to version 6.2.1-23824 or later to resolve the issue. As a temporary workaround, consider restricting access to the Control Panel SSO Settings to minimize the risk of exploitation. Avoid using the vulnerable URL parameter in the affected settings until the issue is resolved.