CVE-2016-10108

Unauthenticated Remote Command injection as root occurs in the Western Digital MyCloud NAS 2.11.142 /web/googleanalytics.php URL via a modified arg parameter in the POST data...

CVE-2016-10107

CVE-2016-10107 is an unauthenticated remote command‑injection vulnerability in Western Digital My Cloud NAS, affecting at least version 2.11.142 where an attacker can exploit a modified cookie header in index.php to execute arbitrary commands as root. Multiple sources corroborate the issue as a r...

CVE-2016-10107

Unauthenticated Remote Command injection as root occurs in the Western Digital MyCloud NAS 2.11.142 index.php page via a modified Cookie header...

CVE-2016-10108: Improper Neutralization of Special Elements used in a Command

Unauthenticated Remote Command injection as root occurs in the Western Digital MyCloud NAS 2.11.142 /web/googleanalytics.php URL via a modified arg parameter in the POST data...

CVE-2016-10108

CVE-2016-10108 : Western Digital MyCloud NAS (around version 2.11.142) is vulnerable to an unauthenticated remote command injection via the POST parameter arg in the /web/google_analytics.php endpoint, enabling potential root access. The CVSS metrics listed (3.0: 9.8, CRITICAL; 2.0: 10.0) reflect...

QNAP NAS Devices Heap Overflow Vulnerability (NAS-201701-06)

QNAP NAS devices are prone to a heap overflow vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPEPREFIX = "cpe:/h:qnap"; if...

QNAP NAS Devices - Heap Overflow

================== 1 Heap overflow ================== Path: /home/httpd/cgi-bin/cgi.cgi u = valid user guest|admin 1.1 / Remote / Remote host echo -en "GET /cgi-bin/cgi.cgi?u=admin&p=fori=0;i263;i++;do echo -en "A";done HTTP/1.0\nHost: QNAP\n\n" | ncat --ssl 192.168.5.7 443 HTTP/1.1 200 OK Date:...

QNAP NAS Heap Overflow

Greetings, Twice I tried to use the QNAP Web page https://aid.qnap.com/event/module/nas/safereport/ for reporting vulnerability, and twice I got mailer-daemon back. So, Iall post my vulnerabilities here instead Was not meant to be 0-daya| whatever. Have a nice day and happy new year /bashis...

PT-2016-3232

Name of the Vulnerable Software and Affected Versions Western Digital MyCloud NAS version 2.11.142 Description The issue concerns an unauthenticated remote command injection that can be executed as root. This occurs due to a vulnerability in the index.php page of the Western Digital MyCloud NAS,...

Insecure NAS Device Exposes 350 Ameriprise Investment Accounts

A trove of data belonging to Ameriprise Financial was found earlier this month that included Social Security numbers, decryption keys and confidential internal company documents. The breach is related to the use of a network attacked storage device that insecurely backed up data from an internal...

Synology NAS servers contain insecure default credentials

Overview Synology NAS servers DS107, DS116, and DS213, use default credentials. Description CWE-255: Credentials Management - CVE-2016-6554Synology NAS servers DS107, firmware version 3.1-1639 and prior, and DS116, DS213, firmware versions prior to 5.2-5644-1, use non-random default credentials o...

QNAP QTS 'qname' Parameter XSS Vulnerability

QNAP QTS is prone to a cross-site scripting XSS vulnerability. Copyright C 2016 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software...

NASdeluxe NDL-2400r Remote Command Injection Vulnerability

The NASdeluxe NDL-2400r is a NASdeluxe operating system for use in NAS networked storage devices. A remote command injection vulnerability exists in NASdeluxe NDL-2400r, which can be exploited by an attacker to execute arbitrary commands with root privileges...

NUUO 3.0.8 Add Admin Cross Site Request Forgery

i? input type="hidden" name="add...

NUUO Arbitrary File Deletion Vulnerability

Summary NUUO NVRmini 2 is the lightweight, portable NVR solution with NAS functionality. Setup is simple and easy, with automatic port forwarding settings built in. NVRmini 2 supports POS integration, making this the perfect solution for small retail chain stores. NVRmini 2 also comes full equipp...

NUUO Backdoor (strong_user.php) Remote Shell Access

Summary NUUO NVRmini 2 is the lightweight, portable NVR solution with NAS functionality. Setup is simple and easy, with automatic port forwarding settings built in. NVRmini 2 supports POS integration, making this the perfect solution for small retail chain stores. NVRmini 2 also comes full equipp...

NUUO Local File Disclosure Vulnerability

Summary NUUO NVRmini 2 is the lightweight, portable NVR solution with NAS functionality. Setup is simple and easy, with automatic port forwarding settings built in. NVRmini 2 supports POS integration, making this the perfect solution for small retail chain stores. NVRmini 2 also comes full equipp...

NUUO NVRmini 2 3.0.8 - Local File Disclosure

Exploit for php platform in category web applications NUUO Local File Disclosure Vulnerability Vendor: NUUO Inc. Product web page: http://www.nuuo.com Affected version: =3.0.8 NE-4160, NT-4040 Summary: NUUO NVRmini 2 is the lightweight, portable NVR solution with NAS functionality. Setup is simpl...

NUUO NVRmini 2 3.0.8 - 'strong_user.php' Backdoor Remote Shell Access

Exploit for php platform in category web applications NUUO Backdoor stronguser.php Remote Shell Access Vendor: NUUO Inc. Product web page: http://www.nuuo.com Affected version: fileD...

NUUO NVRmini 2 3.0.8 - Remote Root Exploit

Exploit for php platform in category web applications !/usr/bin/env python NUUO Remote Root Exploit Vendor: NUUO Inc. Product web page: http://www.nuuo.com Affected version: =3.0.8 Summary: NUUO NVRmini 2 is the lightweight, portable NVR solution with NAS functionality. Setup is simple and easy,...