8695 matches found
CVE-2022-36331 Impersonation attack causing an Authentication Bypass on Western Digital devices
Western Digital My Cloud, My Cloud Home, My Cloud Home Duo, and SanDisk ibi devices were vulnerable to an impersonation attack that could allow an unauthenticated attacker to gain access to user data. This issue affects My Cloud OS 5 devices: before 5.25.132; My Cloud Home and My Cloud Home Duo:...
Multiple Western Digital products and SanDisk iBI have security vulnerabilities
Western Digital My Cloud and others are products of Western Digital, Inc.Western Digital My Cloud is a personal cloud storage device.Western Digital My Cloud Home is an easy-to-use personal cloud storage device.Western Digital My Cloud Home Duo is an easy-to-use personal cloud storage...
CVE-2022-36331: Authentication Bypass by Spoofing
Western Digital My Cloud, My Cloud Home, My Cloud Home Duo, and SanDisk ibi devices were vulnerable to an impersonation attack that could allow an unauthenticated attacker to gain access to user data. This issue affects My Cloud OS 5 devices: before 5.25.132; My Cloud Home and My Cloud Home Duo:...
home-immo.ch Cross Site Scripting vulnerability OBB-3414341
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Tenda G103 Command Injection Vulnerability
Tenda G103 is a GPON fiber optic access device designed for home and SOHO users from Tenda, China. The Tenda G103 version 1.0.0.5 suffers from a command injection vulnerability that stems from the application's failure to properly filter constructed command special characters, commands, etc. An...
curl: SFTP path ~ resolving discrepancy
A path traversal vulnerability exists in curl 8.0.0 SFTP implementation causes the tilde character to be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as the first element to indicate a path relative to the user's home directory. Attackers can...
D-Link DIR-846 security vulnerabilities
The D-Link DIR-846 is a wireless router from China-based AUO D-Link. A security vulnerability exists in the D-Link DIR-846 v1.00A52, which originates from allowing malicious commands to be injected via the tomographypingaddress parameter in the HNAP1 interface...
CVE-2023-33193 Emby Server Proxy Header Spoofing Vulnerability
Emby Server is a user-installable home media server which stores and organizes a user's media files of virtually any format and makes them available for viewing at home and abroad on a broad range of client devices. This vulnerability may allow administrative access to an Emby Server system,...
CVE-2023-33193
Emby Server is vulnerable to an authentication bypass due to a proxy header spoofing flaw. By spoofing headers intended for reverse proxy interoperation, an attacker can manipulate the local/non-local network determination . This may allow logging in without a password or viewing a list of user a...
HNAP1 Protocol Buffer Overflow
The vulnerability of the HNAP1 protocol implementation in D-Link DIR-878 microprogrammed router software is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of the protecte...
Matrix Resource Management Error Vulnerability
Matrix Synapse is a Matrix Management Server implementation from the Matrix Foundation in the UK. Matrix Synapse suffers from a security vulnerability that stems from the fact that if both Synapse and a malicious home server join the same room, the malicious home server can trick Synapse into...
VulnCheck KEV: CVE-2023-33193
Emby Server is a user-installable home media server which stores and organizes a user's media files of virtually any format and makes them available for viewing at home and abroad on a broad range of client devices. This vulnerability may allow administrative access to an Emby Server system,...
CVE-2022-30025
SQL injection in "/Framewrk/Home.jsp" file POST method in tCredence Analytics iDEAL Wealth and Funds - 1.0 iallows authenticated remote attackers to inject payload via "v" parameter...
CVE-2022-30025
SQL injection in "/Framewrk/Home.jsp" file POST method in tCredence Analytics iDEAL Wealth and Funds - 1.0 iallows authenticated remote attackers to inject payload via "v" parameter...
CVE-2023-25598
A vulnerability in the conferencing component of Mitel MiVoice Connect through 19.3 SP2 and 20.x, 21.x, and 22.x through 22.24.1500.0 could allow an unauthenticated attacker to conduct a reflected cross-site scripting XSS attack due to insufficient validation for the home.php page. A successful...
Synapse Denial of service due to incorrect application of event authorization rules during state resolution
Impact If Synapse and a malicious homeserver are both joined to the same room, the malicious homeserver can trick Synapse into accepting previously rejected events into its view of the current state of that room. This can be exploited in a way that causes all further messages and state changes se...
CVE-2023-31762
Weak security in the transmitter of Digoo DG-HAMB Smart Home Security System v1.0 allows attackers to gain full access to the system via a code replay attack...
CVE-2023-31762
Weak security in the transmitter of Digoo DG-HAMB Smart Home Security System v1.0 allows attackers to gain full access to the system via a code replay attack...
