Login Request a demo
DS
Product
Download Station
by Synology · last CVE Jun 18, 2021
8
CVEs
0
On KEV
8.8
Max CVSS
0
New 30D
Vulnerabilities8In the news0Timeline
Severity mix
Critical 0High 4Medium 2Low 0
Severity
All severities8Critical0High4Medium2Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Download Station to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2021-34810
8.8
1%
Jun 18
Improper privilege management vulnerability in cgi component in Synology Download Station before 3.8.16-3566 allows remote authenticated users to execute arbitrary code via…
Affected: before 3.8.16-3566
CVE-2021-34809
8.8
2%
Jun 18
Improper neutralization of special elements used in a command ('Command Injection') vulnerability in task management component in Synology Download Station before 3.8.16-3566…
Affected: before 3.8.16-3566
CVE-2017-11156
7.8
2%
Aug 14
Synology Download Station 3.8.x before 3.8.5-3475 and 3.x before 3.5-2984 uses weak permissions (0777) for ui/dlm/btsearch directory, which allows remote authenticated users to…
Affected: 3.2-2295; 3.3-2382; 3.3-2383; 3.3-2386; 3.4-2477; 3.4-2478; +27 more
CVE-2021-33184
7.7
1%
Jun 1
Server-Side request forgery (SSRF) vulnerability in task management component in Synology Download Station before 3.8.15-3563 allows remote authenticated users to read arbitrary…
Affected: before 3.8.15-3563
CVE-2017-11149
6.5
2%
Aug 14
Server-side request forgery (SSRF) vulnerability in Downloader in Synology Download Station 3.8.x before 3.8.5-3475 and 3.x before 3.5-2984 allows remote authenticated users to…
Affected: 3.2-2295; 3.3-2382; 3.3-2383; 3.3-2386; 3.4-2477; 3.4-2478; +27 more
CVE-2021-34811
4.3
1%
Jun 18
Server-Side Request Forgery (SSRF) vulnerability in task management component in Synology Download Station before 3.8.16-3566 allows remote authenticated users to access intranet…
Affected: before 3.8.16-3566
CVE-2015-6913
–
2%
Sep 11
Cross-site scripting (XSS) vulnerability in the "Create download task via URL" feature in Synology Download Station before 3.5-2967 allows remote attackers to inject arbitrary web…
Affected: through 3.5-2963
CVE-2015-6909
–
2%
Sep 11
Cross-site scripting (XSS) vulnerability in the "Create download task via file upload" feature in Synology Download Station before 3.5-2962 allows remote attackers to inject…
Affected: through 3.5-2956
Showing 8