CVSS: 9.8EPSS: 0%CPEs: 6EXPL: 0CVE-2022-22997 – Command Injection Vulnerability on My Cloud Home
https://notcve.org/view.php?id=CVE-2022-22997
Addressed a remote code execution vulnerability by resolving a command injection vulnerability and closing an AWS S3 bucket that potentially allowed an attacker to execute unsigned code on My Cloud Home devices. Se ha abordado una vulnerabilidad de ejecución de código remota mediante la resolución de una vulnerabilidad de inyección de comandos y el cierre de un cubo de AWS S3 que potencialmente permitía a un atacante ejecutar código sin firmar en los dispositivos de My Cloud Home • https://www.westerndigital.com/support/product-security/wdc-22009-my-cloud-home-firmware-version-8-7-0-107 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 8.0EPSS: 0%CPEs: 6EXPL: 0CVE-2022-22998 – Protecting AWS credentials stored in plaintext on My Cloud Home
https://notcve.org/view.php?id=CVE-2022-22998
Implemented protections on AWS credentials that were not properly protected. Se han implementado protecciones en las credenciales de AWS que no estaban debidamente protegidas • https://www.westerndigital.com/support/product-security/wdc-22009-my-cloud-home-firmware-version-8-7-0-107 • CWE-522: Insufficiently Protected Credentials •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2022-22996 – SanDisk Professional G-RAID 4/8 Software Utility, Privilege Escalation
https://notcve.org/view.php?id=CVE-2022-22996
The G-RAID 4/8 Software Utility setups for Windows were affected by a DLL hijacking vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the system user. Las configuraciones de la utilidad de software G-RAID 4/8 para Windows estuvieron afectadas por una vulnerabilidad de secuestro de DLL. Una explotación con éxito podría conllevar a una ejecución de código arbitrario en el contexto del usuario del sistema • https://www.westerndigital.com/support/product-security/wdc-22007-sandisk-professional-g-raid-4-8-software-utility-setup-for-windows-privilege-escalation • CWE-427: Uncontrolled Search Path Element •
CVSS: 10.0EPSS: 0%CPEs: 26EXPL: 0CVE-2022-22995 – Western Digital My Cloud OS 5 and My Cloud Home Unauthenticated Arbitrary File Write Vulnerability in Netatalk
https://notcve.org/view.php?id=CVE-2022-22995
The combination of primitives offered by SMB and AFP in their default configuration allows the arbitrary writing of files. By exploiting these combination of primitives, an attacker can execute arbitrary code. La combinación de primitivas que ofrecen SMB y AFP en su configuración por defecto permite la escritura arbitraria de archivos. Al explotar esta combinación de primitivas, un atacante puede ejecutar código arbitrario • https://lists.debian.org/debian-lts-announce/2024/01/msg00000.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/55ROUJI22SHZX5EM23QAILZHI67EZQKW https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T5CZZLFOTUP3QYHGHSDUNENGSLPJ6KGO https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XO34FWOIJI6V6PH2XY52WNBBARVWPJG2 https://security.gentoo.org/glsa/202311-02 https://www.westerndigital.com/support/product-security/wdc& • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 9.8EPSS: 5%CPEs: 11EXPL: 0CVE-2022-22994 – Insufficient Verification of Data Authenticity Remote Code Execution Vulnerability on Western Digital My Cloud devices.
https://notcve.org/view.php?id=CVE-2022-22994
A remote code execution vulnerability was discovered on Western Digital My Cloud devices where an attacker could trick a NAS device into loading through an unsecured HTTP call. This was a result insufficient verification of calls to the device. The vulnerability was addressed by disabling checks for internet connectivity using HTTP. Se ha detectado una vulnerabilidad de ejecución de código remota en los dispositivos My Cloud de Western Digital donde un atacante podía engañar a un dispositivo NAS para cargar mediante una llamada HTTP no segura. Esto era el resultado de una verificación insuficiente de las llamadas al dispositivo. • https://www.westerndigital.com/support/product-security/wdc-22002-my-cloud-os5-firmware-5-19-117 https://www.zerodayinitiative.com/advisories/ZDI-22-349 • CWE-345: Insufficient Verification of Data Authenticity •