CVE-2020-28940

On Western Digital My Cloud OS 5 devices before 5.06.115, the NAS Admin dashboard has an authentication bypass vulnerability that could allow an unauthenticated user to execute privileged commands on the device...

CVE-2020-28940

The CVE concerns Western Digital My Cloud PR4100 NAS running My Cloud OS 5 prior to 5.06.115. The nasAdmin service (listening on TCP ports 80/443) contains an incorrect string-matching flaw that allows an unauthenticated user to bypass authentication and execute commands with root privileges. Imp...

CVE-2020-28971

Summary : Western Digital My Cloud OS 5 devices prior to 5.06.115 are affected by a NAS Admin authentication bypass in the nasAdmin service due to insufficient URI-path validation. This enables unauthenticated attackers to execute privileged commands on the device, with ZDI noting potential arbit...

CVE-2020-28971

An issue was discovered on Western Digital My Cloud OS 5 devices before 5.06.115. A NAS Admin authentication bypass vulnerability could allow an unauthenticated user to execute privileged commands on the device via a cookie, because of insufficient validation of URI paths...

Manipulating Systems Using Remote Lasers

Many systems are vulnerable: Researchers at the time said that they were able to launch inaudible commands by shining lasers -- from as far as 360 feet -- at the microphones on various popular voice assistants, including Amazon Alexa, Apple Siri, Facebook Portal, and Google Assistant. … They...

Western Digital My Cloud OS devices Authorization Issues Vulnerability

Western Digital My Cloud is a personal cloud storage device from Western Digital. A security vulnerability exists in Western Digital My Cloud OS 5 devices prior to version 5.06.115, which stems from an authentication bypass vulnerability in the NAS management dashboard that could allow an...

CVE-2020-28970: Improper Authentication

An issue was discovered on Western Digital My Cloud OS 5 devices before 5.06.115. A NAS Admin authentication bypass vulnerability could allow an unauthenticated user to execute privileged commands on the device via a cookie. In addition, an upload endpoint could then be used by an authenticated...

Western Digital Western Digital My Cloud Authorization Issues Vulnerability

Western Digital My Cloud is a personal cloud storage device from Western Digital. An authorization issue vulnerability exists in Western Digital My Cloud OS 5 devices prior to version 5.06.115, where due to insufficient validation of URI paths, a NAS management authentication bypass vulnerability...

CVE-2020-28940: Improper Authentication

On Western Digital My Cloud OS 5 devices before 5.06.115, the NAS Admin dashboard has an authentication bypass vulnerability that could allow an unauthenticated user to execute privileged commands on the device...

PT-2020-17072

Name of the Vulnerable Software and Affected Versions Western Digital My Cloud OS 5 versions prior to 5.06.115 Description An issue was discovered that could allow an unauthenticated user to execute privileged commands on the device via a cookie, effectively bypassing NAS Admin authentication. Th...

PT-2020-17066

Name of the Vulnerable Software and Affected Versions Western Digital My Cloud OS 5 versions prior to 5.06.115 Description The NAS Admin dashboard has an authentication bypass issue that could allow an unauthenticated user to execute privileged commands on the device. This could potentially lead ...

Western Digital My Cloud OS Authorization Issues Vulnerability

Western Digital My Cloud is a personal cloud storage device from Western Digital. A security vulnerability exists in Western Digital My Cloud OS 5 devices prior to version 5.06.115, which stems from a NAS management authentication bypass vulnerability that could allow an unauthenticated user to...

CVE-2020-28971: Improper Authentication

An issue was discovered on Western Digital My Cloud OS 5 devices before 5.06.115. A NAS Admin authentication bypass vulnerability could allow an unauthenticated user to execute privileged commands on the device via a cookie, because of insufficient validation of URI paths...

PT-2020-17073

Name of the Vulnerable Software and Affected Versions Western Digital My Cloud OS 5 versions prior to 5.06.115 Description An issue was discovered that could allow an unauthenticated user to execute privileged commands on the device via a cookie, because of insufficient validation of URI paths...

Western Digital MyCloud NAS cgi_api.php Code Execution

The vulnerability of the cgiapi.php component in the Western Digital MyCloud NAS network storage software is related to insecure privilege management. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

AvailableApps.php Component Code Execution

The vulnerability of the AvailableApps.php component in the microprogramming software of Western Digital’s MyCloud NAS storage system is related to insecure privilege management. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Western Digital MyCloud NAS DsdkProxy.php Code Execution

The vulnerability of the DsdkProxy.php component of the Western Digital MyCloud NAS network storage software exists due to insufficient validation of input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Western Digital MyCloud NAS Buffer Overflow Privilege Escalation

The vulnerability of Western Digital MyCloud NAS’ network storage software relates to writing beyond the buffer limits of memory. Exploiting this vulnerability can allow a remote attacker to gain elevated privileges...

Digitally Signed Bandook Trojan Reemerges in Global Spy Campaign

A wave of targeted cyberattack campaigns bent on espionage is cresting around the globe, using a strain of a 13-year old backdoor trojan named Bandook. According to Check Point Research, Bandook was last spotted being used in 2015 and 2017/2018, in the “Operation Manul” and “Dark Caracal”...

Shopify: Removing parts of URL from jQuery request exposes links for download of Paid Digital Assets of the most recent Order placed by anyone on the store!

Please Note: I found this bug on a website made using Shopify I tried doing the same with my Shopify store but I was not able to buy anything as it was required to add credit card details which I don't have : THE LINKS GIVEN AS THE EXAMPLE ARE NOT VALID LINKS BUT THE BUG WORKS ON EVERY SHOPIFY...