Page 4 of 28 results (0.004 seconds)

CVSS: 9.8EPSS: 0%CPEs: 6EXPL: 0

CVE-2022-22997 – Command Injection Vulnerability on My Cloud Home

https://notcve.org/view.php?id=CVE-2022-22997

Addressed a remote code execution vulnerability by resolving a command injection vulnerability and closing an AWS S3 bucket that potentially allowed an attacker to execute unsigned code on My Cloud Home devices. Se ha abordado una vulnerabilidad de ejecución de código remota mediante la resolución de una vulnerabilidad de inyección de comandos y el cierre de un cubo de AWS S3 que potencialmente permitía a un atacante ejecutar código sin firmar en los dispositivos de My Cloud Home • https://www.westerndigital.com/support/product-security/wdc-22009-my-cloud-home-firmware-version-8-7-0-107 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •

CVSS: 8.0EPSS: 0%CPEs: 6EXPL: 0

CVE-2022-22998 – Protecting AWS credentials stored in plaintext on My Cloud Home

https://notcve.org/view.php?id=CVE-2022-22998

Implemented protections on AWS credentials that were not properly protected. Se han implementado protecciones en las credenciales de AWS que no estaban debidamente protegidas • https://www.westerndigital.com/support/product-security/wdc-22009-my-cloud-home-firmware-version-8-7-0-107 • CWE-522: Insufficiently Protected Credentials •

CVSS: 10.0EPSS: 0%CPEs: 26EXPL: 0

CVE-2022-22995 – Western Digital My Cloud OS 5 and My Cloud Home Unauthenticated Arbitrary File Write Vulnerability in Netatalk

https://notcve.org/view.php?id=CVE-2022-22995

The combination of primitives offered by SMB and AFP in their default configuration allows the arbitrary writing of files. By exploiting these combination of primitives, an attacker can execute arbitrary code. La combinación de primitivas que ofrecen SMB y AFP en su configuración por defecto permite la escritura arbitraria de archivos. Al explotar esta combinación de primitivas, un atacante puede ejecutar código arbitrario • https://lists.debian.org/debian-lts-announce/2024/01/msg00000.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/55ROUJI22SHZX5EM23QAILZHI67EZQKW https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T5CZZLFOTUP3QYHGHSDUNENGSLPJ6KGO https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XO34FWOIJI6V6PH2XY52WNBBARVWPJG2 https://security.gentoo.org/glsa/202311-02 https://www.westerndigital.com/support/product-security/wdc& • CWE-59: Improper Link Resolution Before File Access ('Link Following') •

CVSS: 10.0EPSS: 2%CPEs: 6EXPL: 1

CVE-2020-27744

https://notcve.org/view.php?id=CVE-2020-27744

An issue was discovered on Western Digital My Cloud NAS devices before 5.04.114. They allow remote code execution with resultant escalation of privileges. Se detectó un problema en los dispositivos NAS de Western Digital My Cloud versiones anteriores a 5.04.114. Permiten una ejecución de código remota con una escalada de privilegios resultante • https://www.comparitech.com/blog/information-security/security-vulnerabilities-80000-devices-update-now https://www.westerndigital.com/support/productsecurity/wdc-20007-my-cloud-firmware-version-5-04-114 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •

CVSS: 10.0EPSS: 3%CPEs: 6EXPL: 1

CVE-2020-25765

https://notcve.org/view.php?id=CVE-2020-25765

Addressed remote code execution vulnerability in reg_device.php due to insufficient validation of user input.in Western Digital My Cloud Devices prior to 5.4.1140. Se abordó una vulnerabilidad de ejecución de código remota en el archivo reg_device.php debido a una comprobación insuficiente de entrada del usuario en los dispositivos Western Digital My Cloud versiones anteriores a 5.4.1140 • https://www.comparitech.com/blog/information-security/security-vulnerabilities-80000-devices-update-now https://www.westerndigital.com/support/productsecurity https://www.westerndigital.com/support/productsecurity/wdc-20007-my-cloud-firmware-version-5-04-114 • CWE-20: Improper Input Validation CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •