246 matches found
Authentication flaw
The Toshiba FlashAir SD-WD/WC series Class 6 model with firmware version 1.00.04 and later, FlashAir SD-WD/WC series Class 10 model W-02 with firmware version 2.00.02 and later, FlashAir SD-WE series Class 10 model W-03, FlashAir Class 6 model with firmware version 1.00.04 and later, FlashAir II...
CVE-2016-4863
CVE-2016-4863 concerns Toshiba FlashAir cards (SD-WD/WC class 6; SD-WD/WC class 10 W-02; WE-class W-03; FlashAir II/III W-02/W-03 series) where enabling Internet pass-thru Mode allows authenticationless connections from the STA LAN. The root cause is that the device does not require authenticatio...
Command Execution Vulnerability in Apple CMS wd Parameter
Apple CMS program is a fast website building system that runs on PHP+MYSQL environment. A command execution vulnerability exists in the wd parameter of the search box of Apple CMS. The vulnerability stems from the failure of the wd parameter to adequately filter user-supplied input, which allows ...
Photo Gallery by WD <= 1.3.35 - Authenticated SQL Injection
http://www.defensecode.com/advisories/DC-2017-02-011WordPressWebDoradoGalleryPluginAdvisory.pdf http://www.vulnerablesite.com/wp-admin/admin-ajax.php?action=addAlbumsGalleries&albumid=0%20AND%20SELECT%20%20FROM%20SELECTSLEEP5VvZV&width=700&height=550&bwgitemsperpage=20&bwgnonce=b939983df9&TBifram...
Calendar by WD <= 1.5.51 - Authenticated SQL injection
http://www.defensecode.com/advisories/DC-2017-01-017WordPressSpiderEventCalendarPluginAdvisory.pdf Vulnerable POST URL: http://www.vulnerablesite.com/wpadmin/admin.php?page=SpiderCalendar&task=showmanageevent&calendarid=1 Vulnerable POST Body:...
Western Digital My Cloud Command Injection / File Upload Vulnerabilities
Exploit for hardware platform in category web applications title: Unauthenticated OS command injection & arbitrary file upload product: Western Digital My Cloud vulnerable version: at least: 2.21.126 My Cloud, 2.11.157My Cloud EX2, 2.21.126 My Cloud EX2 Ultra, 2.11.157 My Cloud EX4, 2.21.126 My...
WD My Cloud Mirror 2.11.153 Remote Command Execution / Authentication Bypass
Exploit Title: WD My Cloud Mirror 2.11.153 RCE and Authentication Bypass Date: 24.01.2017 Software Link: https://www.wdc.com Exploit Author: Kacper Szurek Contact: https://twitter.com/KacperSzurek Website: https://security.szurek.pl/ Category: local 1. Description Itas possible to execute arbitra...
WD My Cloud Mirror 2.11.153 RCE and Authentication Bypass Vulnerabilities
Exploit for hardware platform in category web applications Exploit Title: WD My Cloud Mirror 2.11.153 RCE and Authentication Bypass Date: 24.01.2017 Software Link: https://www.wdc.com Exploit Author: Kacper Szurek Contact: https://twitter.com/KacperSzurek Website: https://security.szurek.pl/...
WD My Cloud Mirror 2.11.153 - Authentication Bypass / Remote Code Execution
Exploit Title: WD My Cloud Mirror 2.11.153 RCE and Authentication Bypass Date: 24.01.2017 Software Link: https://www.wdc.com Exploit Author: Kacper Szurek Contact: https://twitter.com/KacperSzurek Website: https://security.szurek.pl/ Category: local 1. Description It’s possible to execute arbitra...
Western Digital My Cloud / WD Cloud Products Detection (HTTP)
HTTP based detection of Western Digital My Cloud products Called SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Hdcms framework foreground wd parameter has SQL injection vulnerability
HDCMS is a content management system package written in PHP. A SQL injection vulnerability exists in the frontend wd parameter of the hdcms framework, due to the program failing to adequately filter the wd parameter and only doing the corresponding code audit on the source code. An attacker is...
WordPress FAQ WD Plugin Cross-Site Scripting
A cross-site scripting vulnerability exists in WordPress FAQ WD Plugin. Successful exploitation of this vulnerability would allow remote attackers to inject an arbitrary web script into the affected system...
WordPress FAQ WD Plugin <= 1.0.14 - Cross Site Scripting
This WordPress plugin is prone to a cross-site scripting XSS vulnerability. It allows remote attackers to inject arbitrary script or HTML. Solution Update the plugin...
WD Photos - Customized SSL, Dynamic Code Loading, Exported components vulnerabilities
HackApp vulnerability scanner discovered that application WD Photos published at the 'play' market has multiple vulnerabilities...
joomla 插件ECommerce-WD V1.2.5 参数filter_manufacturer_ids SQL注入漏洞
No description provided by source...
Joomla 组件Gallery WD SQL注入漏洞
0x01 漏洞简介 Joomla 组件Gallery WD存在多处SQL注入漏洞。远程攻击者可以利用该漏洞执行任意SQL指令。该插件的下载地址是： http://extensions.joomla.org/extensions/extension/photos-a-images/galleries/gallery-wd 0x02漏洞说明 2.1参数themeid存在GET型SQL注入漏洞 该漏洞利用的POC格式如下： index.php?option=comgallerywd&view=gallerybox&imageid=19&galleryid=2&themeid=1 AND...
Western Digital My Cloud Command Injection
Exploit Title: Western Digital My Cloud Command Injection Vendor Homepage: http://www.wdc.com Firmware tested: 04.01.03-421 and 04.01.04-422 for the Personal Cloud devices Firmware link: http://download.wdc.com/nas/sq-040104-422-20150423.deb.zip Exploit Author: James Sibley absane ; twitter =...
Western Digital My Cloud 04.01.03-421/04.01.04-422 - Command Injection
Exploit Title: Western Digital My Cloud Command Injection Vendor Homepage: http://www.wdc.com Firmware tested: 04.01.03-421 and 04.01.04-422 for the Personal Cloud devices Firmware link: http://download.wdc.com/nas/sq-040104-422-20150423.deb.zip Exploit Author: James Sibley absane ; twitter =...
wd-deo.gc.ca XSS vulnerability
Vulnerable URL: http://www.wd-deo.gc.ca/eng/42.asp Details: Description| Value ---|--- Patched:| Yes, at 25.07.2017 Latest check for patch:| 25.07.2017 16:51 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 750602 Google Pagerank| 7 VIP website status:| Yes Check...