GCVE - cpe:2.3:a:synology:download_station:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:synology:download_station:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Synology (`65464e9b-7339-559d-9719-837f074e0220`)
Product	Download Station (`0de15abb-a25c-5535-9959-9b40c537066f`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2021-34811`	vulnerable	2026-06-08 05:32:17.011296	Details available MEDIUM (5) Server-Side Request Forgery (SSRF) vulnerability in task management component in Synology Download Station before 3.8.16-3566 allows remote authenticated users to access intranet resources via unspecified vectors. Published: 2021-06-18T03:00:18.181Z Updated: 2024-09-16T17:48:15.120Z Open on db.gcve.eu Reference links https://www.synology.com/security/advisory/Synology_SA_21_11	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-34810`	vulnerable	2026-06-08 05:32:17.010885	Details available CRITICAL (9.9) Improper privilege management vulnerability in cgi component in Synology Download Station before 3.8.16-3566 allows remote authenticated users to execute arbitrary code via unspecified vectors. Published: 2021-06-18T03:00:22.755Z Updated: 2024-09-16T16:14:21.210Z Open on db.gcve.eu Reference links https://www.synology.com/security/advisory/Synology_SA_21_11	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-34809`	vulnerable	2026-06-08 05:32:17.010596	Details available CRITICAL (9.9) Improper neutralization of special elements used in a command ('Command Injection') vulnerability in task management component in Synology Download Station before 3.8.16-3566 allows remote authenticated users to execute arbitrary code via unspecified vectors. Published: 2021-06-18T03:00:27.054Z Updated: 2024-09-16T19:56:48.051Z Open on db.gcve.eu Reference links https://www.synology.com/security/advisory/Synology_SA_21_11	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-33184`	vulnerable	2026-06-08 05:32:10.973555	Details available HIGH (7.7) Server-Side request forgery (SSRF) vulnerability in task management component in Synology Download Station before 3.8.15-3563 allows remote authenticated users to read arbitrary files via unspecified vectors. Published: 2021-06-01T09:50:14.363Z Updated: 2024-09-17T04:09:07.776Z Open on db.gcve.eu Reference links https://www.synology.com/security/advisory/Synology_SA_20_23	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-6913`	vulnerable	2026-06-08 05:06:59.855393	Details available Cross-site scripting (XSS) vulnerability in the "Create download task via URL" feature in Synology Download Station before 3.5-2967 allows remote attackers to inject arbitrary web script or HTML via the urls parameter in an add_url_task action to dlm/downloadman.cgi. Published: 2015-09-11T16:00:00.000Z Updated: 2024-08-06T07:36:34.482Z Open on db.gcve.eu Reference links http://www.securityfocus.com/archive/1/536428/100/0/threaded http://packetstormsecurity.com/files/133520/Synology-Download-Station-3.5-2956-3.5-2962-Cross-Site-Scripting.html https://www.synology.com/en-global/releaseNote/DownloadStation?model=DS715 https://www.securify.nl/advisory/SFY20150809/multiple_cross_site_scripting_vulnerabilities_in_synology_download_station.html http://seclists.org/fulldisclosure/2015/Sep/32	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-6909`	vulnerable	2026-06-08 05:06:59.853123	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.