15040 matches found
CVE-2022-22994 Insufficient Verification of Data Authenticity Remote Code Execution Vulnerability on Western Digital My Cloud devices.
A remote code execution vulnerability was discovered on Western Digital My Cloud devices where an attacker could trick a NAS device into loading through an unsecured HTTP call. This was a result insufficient verification of calls to the device. The vulnerability was addressed by disabling checks...
CVE-2022-22994
CVE-2022-22994 is a remote code execution in Western Digital My Cloud devices resulting from insufficient verification of data received via HTTP by the ConnectivityService. This allows a network-adjacent attacker to load and execute arbitrary code on affected NAS devices. The vulnerability is add...
CVE-2022-22992
CVE-2022-22992 describes a command-injection remote code execution on Western Digital My Cloud devices. The vulnerability arises from improper handling of user-provided input that is used in shell calls, with the fix noted as escaping individual arguments to shell functions. Reported impacts incl...
CVE-2022-22992 Command Injection Remote Code Execution vulnerability on Western Digital My Cloud devices.
A command injection remote code execution vulnerability was discovered on Western Digital My Cloud Devices that could allow an attacker to execute arbitrary system commands on the device. The vulnerability was addressed by escaping individual arguments to shell functions coming from user input...
CVE-2022-22993 Limited Server-Side Request Forgery vulnerability on Western Digital My Cloud devices.
A limited SSRF vulnerability was discovered on Western Digital My Cloud devices that could allow an attacker to impersonate a server and reach any page on the server by bypassing access controls. The vulnerability was addressed by creating a whitelist for valid parameters...
CVE-2022-22993
CVE-2022-22993 affects Western Digital My Cloud devices (notably PR4100) with a limited SSRF vulnerability that lets an attacker impersonate a server and access pages by bypassing access controls. Connected sources tie the issue to the cgi_api endpoint and URI validation flaws, enabling network-a...
Big Mother is watching: What parents REALLY think about tracking their kids
Every year on Data Privacy Day, we’re greeted with countless arguments about the absolute merits of data privacy protections good, invasions bad, but we rarely see a faithful, factual accounting for the biggest data privacy conundrum facing billions of people every single day: Should parents inva...
Western Digital My Cloud 代码问题漏洞
Western Digital My Cloud is a personal cloud storage device from Western Digital. A security vulnerability exists in Western Digital My Cloud that could allow an attacker to impersonate the server and access any page on the server by bypassing access control...
CVE-2022-22993: Server-Side Request Forgery (SSRF)
A limited SSRF vulnerability was discovered on Western Digital My Cloud devices that could allow an attacker to impersonate a server and reach any page on the server by bypassing access controls. The vulnerability was addressed by creating a whitelist for valid parameters...
Western Digital My Cloud 数据伪造问题漏洞
Western Digital My Cloud is a personal cloud storage device from Western Digital. Western Digital My Cloud has a security vulnerability that could allow an attacker to trick a NAS device into loading via an insecure HTTP call. This is the result of insufficient authentication of device calls...
Western Digital My Cloud 命令注入漏洞
Western Digital My Cloud is a personal cloud storage device from Western Digital. A security vulnerability exists in Western Digital My Cloud that could allow an attacker to execute arbitrary system commands on the device...
PT-2022-15764
Name of the Vulnerable Software and Affected Versions Western Digital My Cloud devices affected versions not specified Description A remote code execution issue was discovered, allowing an attacker to trick a NAS device into loading through an unsecured HTTP call due to insufficient verification ...
CVE-2022-22992: Improper Encoding or Escaping of Output
A command injection remote code execution vulnerability was discovered on Western Digital My Cloud Devices that could allow an attacker to execute arbitrary system commands on the device. The vulnerability was addressed by escaping individual arguments to shell functions coming from user input...
CVE-2022-22994: Insufficient Verification of Data Authenticity
A remote code execution vulnerability was discovered on Western Digital My Cloud devices where an attacker could trick a NAS device into loading through an unsecured HTTP call. This was a result insufficient verification of calls to the device. The vulnerability was addressed by disabling checks...
Mageia: Security Advisory (MGASA-2021-0471)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
PT-2022-15763
Name of the Vulnerable Software and Affected Versions Western Digital My Cloud devices affected versions not specified Description A limited Server-Side Request Forgery SSRF issue was discovered, allowing an attacker to impersonate a server, bypass access controls, and reach any page on the serve...
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Vuln : Stored XSS Description The pimcore/pimcore package is an open source platform that provides PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce services. stored xss vulnerability occurs when you change the value of name at "Setinngs" = "Website Settings" in the pimcore service. Proof of Concept...
How CISOs are preparing to tackle 2022
Looking back over the last year, the security landscape has continued to experience significant change and escalation. Every day, we see the toll this is taking on organizations of all sizes as they navigate the enduring challenges of the pandemic, the expansion of the digital estate, and the...
How CISOs are preparing to tackle 2022
Looking back over the last year, the security landscape has continued to experience significant change and escalation. Every day, we see the toll this is taking on organizations of all sizes as they navigate the enduring challenges of the pandemic, the expansion of the digital estate, and the...
