GCVE - cpe:2.3:a:synology:synology_calendar:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:synology:synology_calendar:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Synology (`65464e9b-7339-559d-9719-837f074e0220`)
Product	Synology Calendar (`d676c1ab-5754-55b8-909b-79c8006d7f76`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2022-27617`	vulnerable	2026-06-08 05:42:42.485457	Details available MEDIUM (5) Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology Calendar before 2.3.4-0631 allows remote authenticated users to download arbitrary files via unspecified vectors. Published: 2022-08-03T02:15:14.592Z Updated: 2024-09-16T22:55:31.383Z Open on db.gcve.eu Reference links https://www.synology.com/security/advisory/Synology_SA_20_07	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-22686`	vulnerable	2026-06-08 05:40:54.896179	Details available MEDIUM (6.5) Cross-Site Request Forgery (CSRF) vulnerability in webapi component in Synology Calendar before 2.3.4-0631 allows remote authenticated users to hijack the authentication of administrators via unspecified vectors. Published: 2022-07-26T01:30:14.703Z Updated: 2024-09-16T19:14:33.307Z Open on db.gcve.eu Reference links https://www.synology.com/security/advisory/Synology_SA_20_07	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-22682`	vulnerable	2026-06-08 05:40:54.888442	Details available MEDIUM (6.5) Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Event Management in Synology Calendar before 2.4.5-10930 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. Published: 2022-07-12T06:20:10.512Z Updated: 2024-09-17T00:20:46.045Z Open on db.gcve.eu Reference links https://www.synology.com/security/advisory/Synology_SA_22_07	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-34812`	vulnerable	2026-06-08 05:32:17.012946	Details available MEDIUM (5.8) Use of hard-coded credentials vulnerability in php component in Synology Calendar before 2.4.0-0761 allows remote attackers to obtain sensitive information via unspecified vectors. Published: 2021-06-18T03:00:12.747Z Updated: 2024-09-17T01:31:29.491Z Open on db.gcve.eu Reference links https://www.synology.com/security/advisory/Synology_SA_21_12	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-15891`	vulnerable	2026-06-08 05:08:59.678508	Details available Improper access control vulnerability in SYNO.Cal.EventBase in Synology Calendar before 2.0.1-0242 allows remote authenticated users to modify calendar event via unspecified vectors. Published: 2017-12-08T16:00:00.000Z Updated: 2024-09-16T20:46:59.679Z Open on db.gcve.eu Reference links https://www.synology.com/en-global/support/security/Synology_SA_17_68_Calendar	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.