Synology Dsm vulnerabilities

2 CVEs affecting Synology Dsm, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2010-3684, published 2010-09-29.

More from Synology.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2010-2453, published 2010-09-29. Medium severity, CVSS 4.3. EPSS: 0.9% chance of exploitation in the next 30 days. Multiple cross-site scripting (XSS) vulnerabilities in Synology Disk Station 2.x before DSM3.0-1337 allow remote attackers to inject arbitrary web script or HTML by connecting to the FTP server and…
• CVE-2010-3684, published 2010-09-29. Low severity, CVSS 2.1. EPSS: 0.3% chance of exploitation in the next 30 days. The FTP authentication module in Synology Disk Station 2.x logs passwords to the web application interface in cases of incorrect login attempts, which allows local users to obtain sensitive…