CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-22169 – Misconfiguration in node.js causing a code execution in WD Discovery
https://notcve.org/view.php?id=CVE-2024-22169
WD Discovery versions prior to 5.0.589 contain a misconfiguration in the Node.js environment settings that could allow code execution by utilizing the 'ELECTRON_RUN_AS_NODE' environment variable. Any malicious application operating with standard user permissions can exploit this vulnerability, enabling code execution within WD Discovery application's context. WD Discovery version 5.0.589 addresses this issue by disabling certain features and fuses in Electron. The attack vector for this issue requires the victim to have the WD Discovery app installed on their device. • https://www.westerndigital.com/support/product-security/wdc-24004-wd-discovery-desktop-app-version-5-0-589 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.1EPSS: 0%CPEs: 2EXPL: 0CVE-2020-8990
https://notcve.org/view.php?id=CVE-2020-8990
Western Digital My Cloud Home before 3.6.0 and ibi before 3.6.0 allow Session Fixation. Western Digital My Cloud Home versiones anteriores a 3.6.0 e ibi versiones anteriores a 3.6.0, permiten una Fijación de Sesión. • https://support.wdc.com/downloads.aspx?g=907&lang=en#downloads https://www.westerndigital.com/support/productsecurity/wdc-19013-my-cloud-home-and-ibi-session-invalidation-vulnerability • CWE-384: Session Fixation •
CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 1CVE-2019-18929
https://notcve.org/view.php?id=CVE-2019-18929
Western Digital My Cloud EX2 Ultra firmware 2.31.183 allows web users (including guest accounts) to remotely execute arbitrary code via a download_mgr.cgi stack-based buffer overflow. El firmware Western Digital My Cloud EX2 Ultra versión 2.31.183, permite a usuarios web (incluidas las cuentas de invitados) ejecutar código arbitrario remotamente por medio de un desbordamiento de búfer en la región heap de la memoria en el archivo download_mgr.cgi. • https://github.com/DelspoN/CVE/blob/master/CVE-2019-18929/description.txt https://github.com/DelspoN/CVE/tree/master/CVE-2019-18929 • CWE-787: Out-of-bounds Write •
CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 1CVE-2019-18930
https://notcve.org/view.php?id=CVE-2019-18930
Western Digital My Cloud EX2 Ultra firmware 2.31.183 allows web users (including guest account) to remotely execute arbitrary code via a stack-based buffer overflow. There is no size verification logic in one of functions in libscheddl.so, and download_mgr.cgi makes it possible to enter large-sized f_idx inputs. El firmware Western Digital My Cloud EX2 Ultra versión 2.31.183, permite a usuarios web (incluida la cuenta de invitado) ejecutar remotamente código arbitrario por medio de un desbordamiento de búfer en la región heap de la memoria. No existe una lógica de comprobación de tamaño en una de las funciones en el archivo libscheddl.so, y download_mgr.cgi hace posible ingresar entradas f_idx de gran tamaño. • https://github.com/DelspoN/CVE/blob/master/CVE-2019-18930/description.txt https://github.com/DelspoN/CVE/tree/master/CVE-2019-18930 • CWE-787: Out-of-bounds Write •
CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 1CVE-2019-18931
https://notcve.org/view.php?id=CVE-2019-18931
Western Digital My Cloud EX2 Ultra firmware 2.31.195 allows a Buffer Overflow with Extended Instruction Pointer (EIP) control via crafted GET/POST parameters. El firmware Western Digital My Cloud EX2 Ultra versión 2.31.195, permite un Desbordamiento de Búfer con control Extended Instruction Pointer (EIP) por medio de parámetros GET/POST especialmente diseñados • https://github.com/DelspoN/CVE/blob/master/CVE-2019-18931/description.txt https://github.com/DelspoN/CVE/tree/master/CVE-2019-18931 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •