CVE-2022-27884

Maccms v10 was discovered to contain a reflected cross-site scripting XSS vulnerability in /admin.php/admin/plog/index.html via the wd parameter...

Maccms 跨站脚本漏洞

Maccms is a PHP-based film and television content management system CMS. maccms v10 version of the cross-site scripting vulnerability, the vulnerability stems from the wd parameter in /admin.php/admin/ulog/index.html lack of user-supplied data and output data validation filter, an attacker can us...

Maccms 跨站脚本漏洞

Maccms is a PHP-based content management system CMS for film and television. v10 version of Maccms contains a cross-site scripting vulnerability, which originates from the lack of user-supplied data and output data validation filtering in the wd parameter in /admin.php/admin/plog/index.html, whic...

WordPress Event Calendar WD plugin <= 1.1.50 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Krzysztof Zając in WordPress Event Calendar WD plugin versions = 1.1.50. Solution Update the WordPress Event Calendar WD plugin to the latest available version at least 1.1.51...

WordPress Event Calendar WD plugin <= 1.1.50 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability discovered by Krzysztof Zając in WordPress Event Calendar WD plugin versions = 1.1.50. Solution Update the WordPress Event Calendar WD plugin to the latest available version at least 1.1.51...

CVE-2020-21362

A cross site scripting XSS vulnerability in the background search function of Maccms10 allows attackers to execute arbitrary web scripts or HTML via the 'wd' parameter...

Cross site scripting

A cross site scripting XSS vulnerability in the background search function of Maccms10 allows attackers to execute arbitrary web scripts or HTML via the 'wd' parameter...

Maccms 跨站脚本漏洞

Maccms 10 is a PHP-based film and television content management system CMS. Maccms 10 is vulnerable to a cross-site scripting vulnerability, which originates from the ""wd"" parameter in the software's background search function that is not effectively restricted and checked, and can be exploited...

My Book Live Users Wake Up to Wiped Devices

If you haven’t already, stop reading and go yank your My Book Live storage device offline, lest you join the ranks of those who woke up on Thursday to find that years of data had been wiped clean on devices around the world. Western Digital’s My Book storage device is designed for consumers and...

Event Calendar WD < 1.1.46 - Cross-Site Scripting (XSS)

The plugin was affected by a Cross-Site Scripting issue...

WordPress Event Calendar WD plugin <= 1.1.44 - Cross-Site Scripting (XSS) vulnerability

Cross-Site Scripting XSS vulnerability discovered in WordPress Event Calendar WD plugin versions = 1.1.44. Solution Update the WordPress Event Calendar WD plugin to the latest available version at least 1.1.45...

CVE-2020-29563

An issue was discovered on Western Digital My Cloud OS 5 devices before 5.07.118. A NAS Admin authentication bypass vulnerability could allow an unauthenticated user to gain access to the device...

CVE-2020-12830

Addressed multiple stack buffer overflow vulnerabilities that could allow an attacker to carry out escalation of privileges through unauthorized remote code execution in Western Digital My Cloud devices before 5.04.114...

CVE-2020-27158

The CVE-2020-27158 entry affects Western Digital My Cloud NAS devices. A remote code execution flaw in cgi_api.php could allow privilege escalation, with impact on devices running firmware before 5.04.114. The vulnerability is described as enabling arbitrary code execution on the affected system,...

Bypassing MassLogger Anti-Analysis — a Man-in-the-Middle Approach

The FireEye Front Line Applied Research & Expertise FLARE Team attempts to always stay on top of the most current and emerging threats. As a member of the FLARE Reverse Engineer team, I recently received a request to analyze a fairly new credential stealer identified as MassLogger. Despite the la...

CVE-2020-15816

CVE-2020-15816 affects Western Digital WD Discovery prior to version 4.0.251.0 . A malicious application running with standard user permissions could execute code within the WD Discovery process via library injection using DYLD environment variables . The vulnerability allows code execution in th...

Western Digital WD Discovery Cross-Site Request Forgery Vulnerability

Western Digital MyCloud Home is a personal storage device from Western Digital.Western Digital WD Discovery is a remote connectivity management tool for Western Digital personal storage devices. A cross-site request forgery vulnerability exists in Western Digital WD Discovery versions prior to...

CVE-2020-12427

The Western Digital WD Discovery application before 3.8.229 for MyCloud Home on Windows and macOS is vulnerable to CSRF, with impacts such as stealing data, modifying disk contents, or exhausting disk space...

Cross site request forgery (csrf)

The Western Digital WD Discovery application before 3.8.229 for MyCloud Home on Windows and macOS is vulnerable to CSRF, with impacts such as stealing data, modifying disk contents, or exhausting disk space...

CVE-2020-12427

CVE-2020-12427 affects Western Digital WD Discovery for MyCloud Home (Windows/macOS). The vulnerability is a Cross-Site Request Forgery (CSRF) in WD Discovery applications prior to version 3.8.229, enabling an attacker to steal data, modify disk contents, or exhaust disk space. The root cause is ...