CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-22169 – Misconfiguration in node.js causing a code execution in WD Discovery
https://notcve.org/view.php?id=CVE-2024-22169
WD Discovery versions prior to 5.0.589 contain a misconfiguration in the Node.js environment settings that could allow code execution by utilizing the 'ELECTRON_RUN_AS_NODE' environment variable. Any malicious application operating with standard user permissions can exploit this vulnerability, enabling code execution within WD Discovery application's context. WD Discovery version 5.0.589 addresses this issue by disabling certain features and fuses in Electron. The attack vector for this issue requires the victim to have the WD Discovery app installed on their device. • https://www.westerndigital.com/support/product-security/wdc-24004-wd-discovery-desktop-app-version-5-0-589 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2022-29835 – WD Discovery's Use of Weak Hashing Algorithm for Code Signing
https://notcve.org/view.php?id=CVE-2022-29835
WD Discovery software executable files were signed with an unsafe SHA-1 hashing algorithm. An attacker could use this weakness to create forged certificate signatures due to the use of a hashing algorithm that is not collision-free. This could thereby impact the confidentiality of user content. This issue affects: Western Digital WD Discovery WD Discovery Desktop App versions prior to 4.4.396 on Mac; WD Discovery Desktop App versions prior to 4.4.396 on Windows. Los archivos ejecutables del software WD Discovery estaban firmados con un algoritmo hash SHA-1 no seguro. • https://www.westerndigital.com/support/product-security/wdc-22014-wd-discovery-desktop-app-version-4-4-396 • CWE-326: Inadequate Encryption Strength CWE-328: Use of Weak Hash •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2020-15816
https://notcve.org/view.php?id=CVE-2020-15816
In Western Digital WD Discovery before 4.0.251.0, a malicious application running with standard user permissions could potentially execute code in the application's process through library injection by using DYLD environment variables. En Western Digital WD Discovery versiones anteriores a 4.0.251.0, una aplicación maliciosa que se ejecuta con permisos de usuario estándar podría ejecutar potencialmente código en el proceso de la aplicación por medio de una inyección de la biblioteca mediante el uso de variables de entorno DYLD • https://www.westerndigital.com/support/productsecurity/wdc-20005-wd-discovery-remote-command-execution-vulnerability • CWE-668: Exposure of Resource to Wrong Sphere •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2020-12427
https://notcve.org/view.php?id=CVE-2020-12427
The Western Digital WD Discovery application before 3.8.229 for MyCloud Home on Windows and macOS is vulnerable to CSRF, with impacts such as stealing data, modifying disk contents, or exhausting disk space. La aplicación Western Digital WD Discovery versiones anteriores a 3.8.229 para MyCloud Home en Windows y macOS, es vulnerable a un ataque de tipo CSRF, con impactos tales como robar datos, modificar el contenido del disco o agotar el espacio del disco. • https://support.wdc.com/downloads.aspx?g=907&lang=en https://www.westerndigital.com/support/productsecurity/wdc-20004-wd-discovery-cross-site-request-forgery-csrf • CWE-352: Cross-Site Request Forgery (CSRF) •