CVE-2022-27886: Improper Neutralization of Input During Web Page Generation

Maccms v10 was discovered to contain a reflected cross-site scripting XSS vulnerability in /admin.php/admin/ulog/index.html via the wd parameter...

CVE-2022-27884: Improper Neutralization of Input During Web Page Generation

Maccms v10 was discovered to contain a reflected cross-site scripting XSS vulnerability in /admin.php/admin/plog/index.html via the wd parameter...

WordPress Event Calendar WD plugin <= 1.1.50 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Krzysztof Zając in WordPress Event Calendar WD plugin versions = 1.1.50. Solution Update the WordPress Event Calendar WD plugin to the latest available version at least 1.1.51...

WordPress Event Calendar WD plugin <= 1.1.50 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability discovered by Krzysztof Zając in WordPress Event Calendar WD plugin versions = 1.1.50. Solution Update the WordPress Event Calendar WD plugin to the latest available version at least 1.1.51...

CVE-2020-21362

A cross site scripting XSS vulnerability in the background search function of Maccms10 allows attackers to execute arbitrary web scripts or HTML via the 'wd' parameter...

Cross site scripting

A cross site scripting XSS vulnerability in the background search function of Maccms10 allows attackers to execute arbitrary web scripts or HTML via the 'wd' parameter...

Maccms 跨站脚本漏洞

Maccms 10 is a PHP-based film and television content management system CMS. Maccms 10 is vulnerable to a cross-site scripting vulnerability, which originates from the ""wd"" parameter in the software's background search function that is not effectively restricted and checked, and can be exploited...

PT-2021-10618

Name of the Vulnerable Software and Affected Versions: Maccms10 affected versions not specified Description: A cross site scripting XSS issue in the background search function allows attackers to execute arbitrary web scripts or HTML via the wd parameter. Recommendations: At the moment, there is ...

CVE-2020-21362: Improper Neutralization of Input During Web Page Generation

A cross site scripting XSS vulnerability in the background search function of Maccms10 allows attackers to execute arbitrary web scripts or HTML via the 'wd' parameter...

PT-2021-3503

Name of the Vulnerable Software and Affected Versions Western Digital WD My Book Live versions 2.x and later Western Digital WD My Book Live Duo all versions Description The issue is related to deficiencies in the authentication procedure of Western Digital's WD My Book Live and WD My Book Live D...

CVE-2021-35941: Missing Authentication for Critical Function

Western Digital WD My Book Live 2.x and later and WD My Book Live Duo all versions have an administrator API that can perform a system factory restore without authentication, as exploited in the wild in June 2021, a different vulnerability than CVE-2018-18472...

My Book Live Users Wake Up to Wiped Devices

If you haven’t already, stop reading and go yank your My Book Live storage device offline, lest you join the ranks of those who woke up on Thursday to find that years of data had been wiped clean on devices around the world. Western Digital’s My Book storage device is designed for consumers and...

Event Calendar WD < 1.1.46 - Cross-Site Scripting (XSS)

The plugin was affected by a Cross-Site Scripting issue...

WordPress Event Calendar WD plugin <= 1.1.44 - Cross-Site Scripting (XSS) vulnerability

Cross-Site Scripting XSS vulnerability discovered in WordPress Event Calendar WD plugin versions = 1.1.44. Solution Update the WordPress Event Calendar WD plugin to the latest available version at least 1.1.45...

CVE-2020-29563

An issue was discovered on Western Digital My Cloud OS 5 devices before 5.07.118. A NAS Admin authentication bypass vulnerability could allow an unauthenticated user to gain access to the device...

CVE-2020-12830

Addressed multiple stack buffer overflow vulnerabilities that could allow an attacker to carry out escalation of privileges through unauthorized remote code execution in Western Digital My Cloud devices before 5.04.114...

CVE-2020-27158

The CVE-2020-27158 entry affects Western Digital My Cloud NAS devices. A remote code execution flaw in cgi_api.php could allow privilege escalation, with impact on devices running firmware before 5.04.114. The vulnerability is described as enabling arbitrary code execution on the affected system,...

Bypassing MassLogger Anti-Analysis — a Man-in-the-Middle Approach

The FireEye Front Line Applied Research & Expertise FLARE Team attempts to always stay on top of the most current and emerging threats. As a member of the FLARE Reverse Engineer team, I recently received a request to analyze a fairly new credential stealer identified as MassLogger. Despite the la...

CVE-2020-15816

CVE-2020-15816 affects Western Digital WD Discovery prior to version 4.0.251.0 . A malicious application running with standard user permissions could execute code within the WD Discovery process via library injection using DYLD environment variables . The vulnerability allows code execution in th...

CVE-2020-15816: Exposure of Resource to Wrong Sphere

In Western Digital WD Discovery before 4.0.251.0, a malicious application running with standard user permissions could potentially execute code in the application's process through library injection by using DYLD environment variables...