GCVE - cpe:2.3:a:synology:drive_server:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:synology:drive_server:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Synology (`65464e9b-7339-559d-9719-837f074e0220`)
Product	Drive Server (`ec62a69c-21a8-5769-9a32-b3ab24b476e4`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-50631`	vulnerable	2026-06-08 06:52:11.341142	Details available HIGH (7.5) Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in the system syncing daemon in Synology Drive Server before 3.0.4-12699, 3.2.1-23280, 3.5.0-26085 and 3.5.1-26102 allows remote attackers to inject SQL commands, limited to write operations, via unspecified vectors. Published: 2025-03-19T05:50:08.565Z Updated: 2025-03-19T14:37:54.900Z Open on db.gcve.eu Reference links https://www.synology.com/en-global/security/advisory/Synology_SA_24_21	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-50630`	vulnerable	2026-06-08 06:52:11.340621	Details available HIGH (7.5) Missing authentication for critical function vulnerability in the webapi component in Synology Drive Server before 3.0.4-12699, 3.2.1-23280, 3.5.0-26085 and 3.5.1-26102 allows remote attackers to obtain administrator credentials via unspecified vectors. Published: 2025-03-19T05:50:05.059Z Updated: 2025-03-19T14:41:45.451Z Open on db.gcve.eu Reference links https://www.synology.com/en-global/security/advisory/Synology_SA_24_21	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-8921`	vulnerable	2026-06-08 05:12:06.705741	Details available MEDIUM (6.5) Cross-site scripting (XSS) vulnerability in File Sharing Notify Toast in Synology Drive before 1.0.2-10275 allows remote authenticated users to inject arbitrary web script or HTML via the malicious file name. Published: 2018-06-01T13:00:00.000Z Updated: 2024-09-16T23:56:17.996Z Open on db.gcve.eu Reference links https://www.synology.com/en-global/support/security/Synology_SA_18_11	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-8910`	vulnerable	2026-06-08 05:12:06.689995	Details available MEDIUM (6.5) Cross-site scripting (XSS) vulnerability in Attachment Preview in Synology Drive before 1.0.1-10253 allows remote authenticated users to inject arbitrary web script or HTML via malicious attachments. Published: 2018-05-10T13:00:00.000Z Updated: 2024-09-16T23:46:48.184Z Open on db.gcve.eu Reference links https://www.synology.com/en-global/support/security/Synology_SA_18_05	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-13297`	vulnerable	2026-06-08 05:10:51.130629	Details available MEDIUM (5.3) Information exposure vulnerability in SYNO.SynologyDrive.Files in Synology Drive before 1.1.2-10562 allows remote attackers to obtain sensitive system information via the dsm_path parameter. Published: 2019-04-01T14:30:30.257Z Updated: 2024-09-16T22:20:28.678Z Open on db.gcve.eu Reference links https://www.synology.com/security/advisory/Synology_SA_18_50	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.