Approved changes feed: RSS · Atom
cpe:2.3:a:synology:calendar:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Synology (65464e9b-7339-559d-9719-837f074e0220) |
|---|---|
| Product | Calendar (64698f8e-ed92-5b44-87ae-684b774aedbf) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2022-27617 |
vulnerable | 2026-06-08 05:42:42.486373 |
Details available
MEDIUM (5)
Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology Calendar before 2.3.4-0631 allows remote authenticated users to download arbitrary files via unspecified vectors.
Published: 2022-08-03T02:15:14.592Z
Updated: 2024-09-16T22:55:31.383Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-22686 |
vulnerable | 2026-06-08 05:40:54.896225 |
Details available
MEDIUM (6.5)
Cross-Site Request Forgery (CSRF) vulnerability in webapi component in Synology Calendar before 2.3.4-0631 allows remote authenticated users to hijack the authentication of administrators via unspecified vectors.
Published: 2022-07-26T01:30:14.703Z
Updated: 2024-09-16T19:14:33.307Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-22682 |
vulnerable | 2026-06-08 05:40:54.889250 |
Details available
MEDIUM (6.5)
Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Event Management in Synology Calendar before 2.4.5-10930 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Published: 2022-07-12T06:20:10.512Z
Updated: 2024-09-17T00:20:46.045Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-34812 |
vulnerable | 2026-06-08 05:32:17.013800 |
Details available
MEDIUM (5.8)
Use of hard-coded credentials vulnerability in php component in Synology Calendar before 2.4.0-0761 allows remote attackers to obtain sensitive information via unspecified vectors.
Published: 2021-06-18T03:00:12.747Z
Updated: 2024-09-17T01:31:29.491Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-11829 |
vulnerable | 2026-06-08 05:12:38.152769 |
Details available
HIGH (7.3)
OS command injection vulnerability in drivers_syno_import_user.php in Synology Calendar before 2.3.1-0617 allows remote attackers to execute arbitrary commands via the crafted 'X-Real-IP' header.
Published: 2019-06-30T15:05:12.214Z
Updated: 2024-09-16T18:04:00.490Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-11825 |
vulnerable | 2026-06-08 05:12:38.148381 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-11820 |
vulnerable | 2026-06-08 05:12:38.144306 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-8927 |
vulnerable | 2026-06-08 05:12:06.712468 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-8915 |
vulnerable | 2026-06-08 05:12:06.699530 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-13299 |
vulnerable | 2026-06-08 05:10:51.133616 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-15891 |
vulnerable | 2026-06-08 05:08:59.679264 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.