(Pwn2Own) Western Digital MyCloud PR4100 nasAdmin Authentication Bypass Vulnerability

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Western Digital MyCloud PR4100. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...

The vulnerability of the AvailableApps.php component in the microprogramming software for the Western Digital MyCloud NAS allows a intruder to execute arbitrary code.

The vulnerability of the AvailableApps.php component in the microprogramming software of Western Digital’s MyCloud NAS storage system is related to insecure privilege management. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the DsdkProxy.php component of the Western Digital MyCloud NAS network storage software allows a hacker to execute arbitrary code.

The vulnerability of the DsdkProxy.php component of the Western Digital MyCloud NAS network storage software exists due to insufficient validation of input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the cgi_api.php component in the network storage software from Western Digital’s MyCloud NAS allows a perpetrator to execute arbitrary code.

The vulnerability of the cgiapi.php component in the Western Digital MyCloud NAS network storage software is related to insecure privilege management. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of Western Digital MyCloud NAS’ network storage software relates to writing beyond the buffer memory limit, allowing attackers to escalate their privileges.

The vulnerability of Western Digital MyCloud NAS’ network storage software relates to writing beyond the buffer limits of memory. Exploiting this vulnerability can allow a remote attacker to gain elevated privileges...

Western Digital WD Discovery Cross-Site Request Forgery Vulnerability

Western Digital MyCloud Home is a personal storage device from Western Digital.Western Digital WD Discovery is a remote connectivity management tool for Western Digital personal storage devices. A cross-site request forgery vulnerability exists in Western Digital WD Discovery versions prior to...

CVE-2020-12427

The Western Digital WD Discovery application before 3.8.229 for MyCloud Home on Windows and macOS is vulnerable to CSRF, with impacts such as stealing data, modifying disk contents, or exhausting disk space...

CVE-2020-12427

The Western Digital WD Discovery application before 3.8.229 for MyCloud Home on Windows and macOS is vulnerable to CSRF, with impacts such as stealing data, modifying disk contents, or exhausting disk space...

Cross site request forgery (csrf)

The Western Digital WD Discovery application before 3.8.229 for MyCloud Home on Windows and macOS is vulnerable to CSRF, with impacts such as stealing data, modifying disk contents, or exhausting disk space...

CVE-2020-12427

CVE-2020-12427 affects Western Digital WD Discovery for MyCloud Home (Windows/macOS). The vulnerability is a Cross-Site Request Forgery (CSRF) in WD Discovery applications prior to version 3.8.229, enabling an attacker to steal data, modify disk contents, or exhaust disk space. The root cause is ...

Design/Logic Flaw

There is a security vulnerability which could lead to Factory Reset Protection FRP bypass in the MyCloud APP with the versions before 8.1.2.303 installed on some Huawei smart phones. When re-configuring the mobile phone using the FRP function, an attacker can replace the old account with a new on...

CVE-2018-7928

There is a security vulnerability which could lead to Factory Reset Protection FRP bypass in the MyCloud APP with the versions before 8.1.2.303 installed on some Huawei smart phones. When re-configuring the mobile phone using the FRP function, an attacker can replace the old account with a new on...

CVE-2018-7928

There is a security vulnerability which could lead to Factory Reset Protection FRP bypass in the MyCloud APP with the versions before 8.1.2.303 installed on some Huawei smart phones. When re-configuring the mobile phone using the FRP function, an attacker can replace the old account with a new on...

CVE-2018-7928

The CVE-2018-7928 entry describes a FRP bypass vulnerability in Huawei’s MyCloud APP on some Huawei smartphones, affecting versions before 8.1.2.303. According to the Huawei PSIRT advisory (HWPSIRT-2018-04129), when re-configuring the device via FRP, an attacker can swap the existing account with...

CVE-2018-7928

There is a security vulnerability which could lead to Factory Reset Protection FRP bypass in the MyCloud APP with the versions before 8.1.2.303 installed on some Huawei smart phones. When re-configuring the mobile phone using the FRP function, an attacker can replace the old account with a new on...

Security Advisory - FRP Bypass Vulnerability in MyCloud APP of Huawei Smart Phones

There is a security vulnerability which could lead to Factory Reset Protection FRP bypass in the MyCloud APP installed on some Huawei smart phones. When re-configuring the mobile phone using the FRP function, an attacker can replace the old account with a new one through special steps by exploit...

files.mycloud.com XSS vulnerability

Open Bug Bounty ID: OBB-571030 Description| Value ---|--- Affected Website:| files.mycloud.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

The vulnerability of the multiuploadify.php script (located in the administrative web interface of the network storage software, Western Digital MyCloud PR4100), allows a malicious user to execute arbitrary code with root privileges.

The vulnerability of the multiuploadify.php script located in the administrative web interface of the network storage software, Western Digital MyCloud PR4100, relates to deficiencies in authentication procedures. Exploiting this vulnerability allows an attacker to download the PHP script onto a...

Western Digital MyCloud Unauthenticated File Upload

The remote WD MyCloud device is affected by a file upload vulnerability that allows a remote attacker to upload and execute files. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid105732; scriptversion"1.6"; scriptsetattributeattribute:"pluginmodificationdate",...

Western Digital MyCloud Remote Code Execution (CVE-2017-17560)

A remote code execution vulnerability exists within Western Digital MyCloud servers. This is due to the way the MyCloud servers handle file uploads to specific directories. A successful attack could lead to a remote code execution and stolen information...