CVE-2024-51840

CVE-2024-51840 is a DOM-based XSS in the WordPress plugin Wd-image-magnifier-xoss by Rezaul Haque, affecting versions “from n/a through 1.0.” The description cites “Improper Neutralization of Input During Web Page Generation,” indicating that unsafe input handling in page rendering enables cross-...

PT-2024-34968

Name of the Vulnerable Software and Affected Versions Wd-image-magnifier-xoss versions 1.0 and earlier Description The issue is related to an Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting'. This allows for DOM-Based XSS attacks. Recommendations F...

WordPress plugin Wd-image-magnifier-xoss 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2024-51840: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in rezaul Wd-image-magnifier-xoss wd-image-magnifier-xoss allows DOM-Based XSS.This issue affects Wd-image-magnifier-xoss: from n/a through = 1.0...

WordPress Wd-image-magnifier-xoss plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin Wd-image-magnifier-xoss versions = 1.0...

WordPress Wd-image-magnifier-xoss Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)

Software Wd-image-magnifier-xoss Type Plugin Vulnerable versions = 1.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-51840 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID c2adb78229c9 Credits SOPROBRO Required privilege...

Gallery WD For Joomla! Unauthenticated SQL Injection Scanner

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'uri' class MetasploitModule 'Gallery WD for Joomla! Unauthenticated SQL Injection Scanner', 'Description' = %q This module will scan for Joomla! instances...

Node.js Environment Settings Code Execution

The vulnerability of the Node.js software for managing Western Digital WD Discovery products relates to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to execute arbitrary code during the current session...

CVE-2024-22169

WD Discovery versions prior to 5.0.589 contain a misconfiguration in the Node.js environment settings that could allow code execution by utilizing the 'ELECTRONRUNASNODE' environment variable. Any malicious application operating with standard user permissions can exploit this vulnerability,...

CVE-2024-22169

CVE-2024-22169 affects WD Discovery. Versions prior to 5.0.589 contain a misconfiguration in the Node.js environment settings that could enable code execution by abusing the ELECTRON_RUN_AS_NODE environment variable. The attack requires the victim to have the WD Discovery app installed; exploitat...

CVE-2024-22169 Misconfiguration in node.js causing a code execution in WD Discovery

WD Discovery versions prior to 5.0.589 contain a misconfiguration in the Node.js environment settings that could allow code execution by utilizing the 'ELECTRONRUNASNODE' environment variable. Any malicious application operating with standard user permissions can exploit this vulnerability,...

CVE-2024-22169 Misconfiguration in node.js causing a code execution in WD Discovery

WD Discovery versions prior to 5.0.589 contain a misconfiguration in the Node.js environment settings that could allow code execution by utilizing the 'ELECTRONRUNASNODE' environment variable. Any malicious application operating with standard user permissions can exploit this vulnerability,...

PT-2024-5724

Name of the Vulnerable Software and Affected Versions WD Discovery versions prior to 5.0.589 Description The issue is related to a misconfiguration in the Node.js environment settings of WD Discovery, which could allow code execution by utilizing the ELECTRON RUN AS NODE environment variable. Any...

CVE-2024-22169: Improper Control of Generation of Code

WD Discovery versions prior to 5.0.589 contain a misconfiguration in the Node.js environment settings that could allow code execution by utilizing the 'ELECTRONRUNASNODE' environment variable. Any malicious application operating with standard user permissions can exploit this vulnerability,...

CVE-2024-22168

A Cross-Site Scripting XSS vulnerability on the My Cloud, My Cloud Home, SanDisk ibi, and WD Cloud web apps was found which could allow an attacker to redirect the user to a crafted domain and reset their credentials, or to execute arbitrary client-side code in the user’s browser session to carry...

CVE-2024-22168 Cross-Site Scripting (XSS) vulnerability on Western Digital My Cloud and SanDisk ibi Web Apps

A Cross-Site Scripting XSS vulnerability on the My Cloud, My Cloud Home, SanDisk ibi, and WD Cloud web apps was found which could allow an attacker to redirect the user to a crafted domain and reset their credentials, or to execute arbitrary client-side code in the user’s browser session to carry...

Multiple Western Digital Products Cross-Site Scripting Vulnerability

Western Digital My Cloud is a personal cloud storage device from Western Digital. A security vulnerability exists in multiple Western Digital products that stems from the presence of a cross-site scripting XSS vulnerability that could allow an attacker to redirect a user to a crafted domain and...

PT-2024-19254

Name of the Vulnerable Software and Affected Versions My Cloud web app affected versions not specified My Cloud Home web app affected versions not specified SanDisk ibi web app affected versions not specified WD Cloud web app affected versions not specified Description A Cross-Site Scripting XSS...

CVE-2024-22168: Improper Neutralization of Input During Web Page Generation

A Cross-Site Scripting XSS vulnerability on the My Cloud, My Cloud Home, SanDisk ibi, and WD Cloud web apps was found which could allow an attacker to redirect the user to a crafted domain and reset their credentials, or to execute arbitrary client-side code in the user’s browser session to carry...

Western Digital My Cloud Multiple Products 5.x < 5.27.161 Multiple Vulnerabilities (WDC-24001)

Multiple Western Digital My Cloud products are prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...