Approved changes feed: RSS · Atom

cpe:2.3:a:synology:dns_server:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorSynology (65464e9b-7339-559d-9719-837f074e0220)
ProductDns Server (b69379e9-317f-525e-b5e2-610427393f4c)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from gcve-enriched-dumps CVE data

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2022-27615 vulnerable 2026-06-08 05:42:42.482585 Details available
HIGH (7.7)
Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in cgi component in Synology DNS Server before 2.2.2-5027 allows remote authenticated users to delete arbitrary files via unspecified vectors.
Published: 2022-07-28T04:00:16.877Z
Updated: 2024-09-16T23:16:05.261Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-8623 vulnerable 2026-06-08 05:27:17.077804 A flaw in native PKCS#11 code can lead to a remotely triggerable assertion failure in pk11.c
HIGH (7.5)
In BIND 9.10.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.10.5-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker that can reach a vulnerable system with a specially crafted query packet can trigger a crash. To be vulnerable, the system must: * be running BIND that was built with "--enable-native-pkcs11" * be signing one or more zones with an RSA key * be able to receive queries from a possible attacker
Published: 2020-08-21T20:50:19.797Z
Updated: 2024-09-17T03:19:11.433Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-8622 vulnerable 2026-06-08 05:27:17.076381 A truncated TSIG response can lead to an assertion failure
MEDIUM (6.5)
In BIND 9.0.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker on the network path for a TSIG-signed request, or operating the server receiving the TSIG-signed request, could send a truncated response to that request, triggering an assertion failure, causing the server to exit. Alternately, an off-path attacker would have to correctly guess when a TSIG-signed request was sent, along with other characteristics of the packet and message, and spoof a truncated response to trigger an assertion failure, causing the server to exit.
Published: 2020-08-21T20:50:19.383Z
Updated: 2024-09-16T17:14:14.760Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-8621 vulnerable 2026-06-08 05:27:17.074531 Attempting QNAME minimization after forwarding can lead to an assertion failure in resolver.c
HIGH (7.5)
In BIND 9.14.0 -> 9.16.5, 9.17.0 -> 9.17.3, If a server is configured with both QNAME minimization and 'forward first' then an attacker who can send queries to it may be able to trigger the condition that will cause the server to crash. Servers that 'forward only' are not affected.
Published: 2020-08-21T20:50:18.959Z
Updated: 2024-09-16T16:18:00.777Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2017-12074 vulnerable 2026-06-08 05:08:38.700164 Details available
Directory traversal vulnerability in the SYNO.DNSServer.Zone.MasterZoneConf in Synology DNS Server before 2.2.1-3042 allows remote authenticated attackers to write arbitrary files via the domain_name parameter.
Published: 2017-08-24T18:00:00.000Z
Updated: 2024-09-16T17:14:47.030Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.