CVE-2017-9553
published 2017-07-24CVE-2017-9553: A design flaw in SYNO.API.Encryption in Synology DiskStation Manager (DSM) before 6.1.3-15152 allows remote attackers to bypass the encryption protection…
PriorityP346high7.5CVSS 3.0
AVNACLPRNUINSUCHINAN
EPSS
1.43%
69.6th percentile
A design flaw in SYNO.API.Encryption in Synology DiskStation Manager (DSM) before 6.1.3-15152 allows remote attackers to bypass the encryption protection mechanism via the crafted version parameter.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| synology | diskstation_manager | <= 6.1.1-15101-4 | — |
CVSS provenance
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
ghsa5.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Bolt Cross-site Scripting via the slug, teaser or title parameters
ghsa·2022-05-24·CVSS 5.4
CVE-2019-9553 [MEDIUM] CWE-79 Bolt Cross-site Scripting via the slug, teaser or title parameters
Bolt Cross-site Scripting via the slug, teaser or title parameters
Bolt 3.6.4 has XSS via the slug, teaser, or title parameter to `editcontent/pages`, a related issue to CVE-2017-11128 and CVE-2018-19933.
GHSA
GHSA-mjrv-32hr-4pv5: A design flaw in SYNO
ghsa_unreviewed·2022-05-13
CVE-2017-9553 [HIGH] GHSA-mjrv-32hr-4pv5: A design flaw in SYNO
A design flaw in SYNO.API.Encryption in Synology DiskStation Manager (DSM) before 6.1.3-15152 allows remote attackers to bypass the encryption protection mechanism via the crafted version parameter.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://www.2-sec.com/2017/06/2-secs-expert-team-uncovers-new-vulnerability-popular-synology-nas-device/https://www.synology.com/en-global/support/security/Synology_SA_17_29_DSMhttps://www.2-sec.com/2017/06/2-secs-expert-team-uncovers-new-vulnerability-popular-synology-nas-device/https://www.synology.com/en-global/support/security/Synology_SA_17_29_DSM
2017-07-24
Published