my_cloud_firmware Archives - CVE Vulnerability

CVE-2018-9148

Sun, 26 Feb 2023 06:51:45 +0000

Western Digital WD My Cloud v04.05.00-320 devices embed the session token (aka PHPSESSID) in filenames, which makes it easier for attackers to bypass authentication by listing a directory. NOTE: this can be exploited in conjunction with CVE-2018-7171 for remote authentication bypass within a product that uses My Cloud.

The post CVE-2018-9148 appeared first on CVE Vulnerability.

CVE-2020-27159

Sun, 26 Feb 2023 06:40:16 +0000

Addressed remote code execution vulnerability in DsdkProxy.php due to insufficient sanitization and insufficient validation of user input in Western Digital My Cloud NAS devices prior to 5.04.114

The post CVE-2020-27159 appeared first on CVE Vulnerability.

CVE-2020-27160

Sun, 26 Feb 2023 06:40:16 +0000

Addressed remote code execution vulnerability in AvailableApps.php that allowed escalation of privileges in Western Digital My Cloud NAS devices prior to 5.04.114 (issue 3 of 3).

The post CVE-2020-27160 appeared first on CVE Vulnerability.

CVE-2020-27158

Sun, 26 Feb 2023 06:40:15 +0000

Addressed remote code execution vulnerability in cgi_api.php that allowed escalation of privileges in Western Digital My Cloud NAS devices prior to 5.04.114.

The post CVE-2020-27158 appeared first on CVE Vulnerability.

CVE-2020-25765

Sun, 26 Feb 2023 06:39:49 +0000

Addressed remote code execution vulnerability in reg_device.php due to insufficient validation of user input.in Western Digital My Cloud Devices prior to 5.4.1140.

The post CVE-2020-25765 appeared first on CVE Vulnerability.

CVE-2020-12830

Sun, 26 Feb 2023 06:36:43 +0000

Addressed multiple stack buffer overflow vulnerabilities that could allow an attacker to carry out escalation of privileges through unauthorized remote code execution in Western Digital My Cloud devices before 5.04.114.

The post CVE-2020-12830 appeared first on CVE Vulnerability.