EUVD-2019-15745

Malware in sbrugna...

EUVD-2019-15727

Malware in sbrugna...

EUVD-2015-8000

Malware in sbrugna...

CVE-2019-6178: Undefined Security Weakness

An information leakage vulnerability in Iomega and LenovoEMC NAS products could allow disclosure of some device details such as Share names through the device API when Personal Cloud is enabled. This does not allow read, write, delete, or any other access to the underlying file systems and their...

CVE-2019-6160

A vulnerability in various versions of Iomega and LenovoEMC NAS products could allow an unauthenticated user to access files on NAS shares via the API...

PT-2019-17993

Name of the Vulnerable Software and Affected Versions Iomega and LenovoEMC NAS products affected versions not specified Description A vulnerability could allow an unauthenticated user to access files on NAS shares via the API. Recommendations At the moment, there is no information about a newer...

CVE-2019-6160: Undefined Security Weakness

A vulnerability in various versions of Iomega and LenovoEMC NAS products could allow an unauthenticated user to access files on NAS shares via the API...

Session fixation

For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, by setting the Iomega cookie to a known value before logging into the NAS's web application, the NAS will not provide the user a new cookie value. This allows an attacker who knows the cookie's value to compromise...

Command injection

For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, when changing the name of a share, an attacker can craft a command injection payload using backtick "" characters in the share : name parameter. As a result, arbitrary commands may be executed as the root user. The...

Cross site request forgery (csrf)

For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the Content Explorer application grants users the ability to upload files to shares and this image was rendered in the browser in the device's origin instead of prompting to download the asset. The application does...

CVE-2018-9075 Iomega and LenovoEMC NAS Web UI Vulnerabilities

For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, when joining a PersonalCloud setup, an attacker can craft a command injection payload using backtick "" characters in the client:password parameter. As a result, arbitrary commands may be executed as the root user...

CVE-2018-9079 Iomega and LenovoEMC NAS Web UI Vulnerabilities

For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, adversaries can craft URLs to modify the Document Object Model DOM of the page. In addition, adversaries can inject HTML script tags and HTML tags with JavaScript handlers to execute arbitrary JavaScript with the...

CVE-2018-9079: Improper Neutralization of Input During Web Page Generation

For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, adversaries can craft URLs to modify the Document Object Model DOM of the page. In addition, adversaries can inject HTML script tags and HTML tags with JavaScript handlers to execute arbitrary JavaScript with the...

PT-2018-18843

Name of the Vulnerable Software and Affected Versions Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier Description The password changing functionality does not require the user's current password to set a new one, allowing attackers with access to the user's session tokens...

PT-2018-18837

Name of the Vulnerable Software and Affected Versions Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier Description The issue allows an attacker to execute arbitrary commands as the root user by crafting a command injection payload using backtick characters in the name...

PT-2018-18835

Name of the Vulnerable Software and Affected Versions Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier Description The file upload functionality of the Content Explorer application is susceptible to path traversal, allowing users to upload files anywhere on the device's...

PT-2018-18841

Name of the Vulnerable Software and Affected Versions Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier Description The issue allows an attacker to compromise a user's session by setting the Iomega cookie to a known value before logging into the NAS's web application,...

PT-2018-18838

Name of the Vulnerable Software and Affected Versions Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier Description The issue allows an attacker to execute arbitrary commands as the root user by crafting a command injection payload using backtick characters in the share :...

PT-2018-18842

Name of the Vulnerable Software and Affected Versions Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier Description The issue affects the Content Viewer application, where file names used for assets are vulnerable to self cross-site scripting self-XSS. This allows adversari...

PT-2018-18836

Name of the Vulnerable Software and Affected Versions Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier Description The issue allows an attacker to execute arbitrary commands as the root user by crafting a command injection payload using backtick characters in the...