my_cloud_pr4100 Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/my_cloud_pr4100/ Sun, 26 Feb 2023 06:40:58 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png my_cloud_pr4100 Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/my_cloud_pr4100/ 32 32 CVE-2020-29563 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-29563/ Sun, 26 Feb 2023 06:40:58 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-29563/ An issue was discovered on Western Digital My Cloud OS 5 devices before 5.07.118. A NAS Admin authentication bypass vulnerability could allow an unauthenticated user to gain access to the device.

The post CVE-2020-29563 appeared first on CVE Vulnerability.

]]> An issue was discovered on Western Digital My Cloud OS 5 devices before 5.07.118. A NAS Admin authentication bypass vulnerability could allow an unauthenticated user to gain access to the device.

The post CVE-2020-29563 appeared first on CVE Vulnerability.

]]> CVE-2021-36224 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-36224/ Thu, 23 Feb 2023 14:10:39 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-36224/ Western Digital My Cloud devices before OS5 have a nobody account with a blank password.

The post CVE-2021-36224 appeared first on CVE Vulnerability.

]]> Western Digital My Cloud devices before OS5 have a nobody account with a blank password.

The post CVE-2021-36224 appeared first on CVE Vulnerability.

]]> CVE-2021-36225 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-36225/ Thu, 23 Feb 2023 14:10:39 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-36225/ Western Digital My Cloud devices before OS5 allow REST API access by low-privileged accounts, as demonstrated by API commands for firmware uploads and installation.

The post CVE-2021-36225 appeared first on CVE Vulnerability.

]]> Western Digital My Cloud devices before OS5 allow REST API access by low-privileged accounts, as demonstrated by API commands for firmware uploads and installation.

The post CVE-2021-36225 appeared first on CVE Vulnerability.

]]> CVE-2021-36226 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-36226/ Thu, 23 Feb 2023 14:10:39 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-36226/ Western Digital My Cloud devices before OS5 do not use cryptographically signed Firmware upgrade files.

The post CVE-2021-36226 appeared first on CVE Vulnerability.

]]> Western Digital My Cloud devices before OS5 do not use cryptographically signed Firmware upgrade files.

The post CVE-2021-36226 appeared first on CVE Vulnerability.

]]> CVE-2022-29838 https://cvevulnerability.com/cve_vulnerabilities/cve-2022-29838/ Thu, 23 Feb 2023 05:18:31 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2022-29838/ Improper Authentication vulnerability in the encrypted volumes and auto mount features of Western Digital My Cloud devices allows insecure direct access to the drive information in the case of a device reset. This issue affects: Western Digital My Cloud My Cloud versions prior to 5.25.124 on Linux.

The post CVE-2022-29838 appeared first on CVE Vulnerability.

]]> Improper Authentication vulnerability in the encrypted volumes and auto mount features of Western Digital My Cloud devices allows insecure direct access to the drive information in the case of a device reset. This issue affects: Western Digital My Cloud My Cloud versions prior to 5.25.124 on Linux.

The post CVE-2022-29838 appeared first on CVE Vulnerability.

]]> CVE-2022-29839 https://cvevulnerability.com/cve_vulnerabilities/cve-2022-29839/ Thu, 23 Feb 2023 05:18:31 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2022-29839/ Insufficiently Protected Credentials vulnerability in the remote backups application on Western Digital My Cloud devices that could allow an attacker who has gained access to a relevant endpoint to use that information to access protected data. This issue affects: Western Digital My Cloud My Cloud versions prior to 5.25.124 on Linux.

The post CVE-2022-29839 appeared first on CVE Vulnerability.

]]> Insufficiently Protected Credentials vulnerability in the remote backups application on Western Digital My Cloud devices that could allow an attacker who has gained access to a relevant endpoint to use that information to access protected data. This issue affects: Western Digital My Cloud My Cloud versions prior to 5.25.124 on Linux.

The post CVE-2022-29839 appeared first on CVE Vulnerability.

]]> CVE-2022-22990 https://cvevulnerability.com/cve_vulnerabilities/cve-2022-22990/ Thu, 23 Feb 2023 05:02:57 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2022-22990/ A limited authentication bypass vulnerability was discovered that could allow an attacker to achieve remote code execution and escalate privileges on the My Cloud devices. Addressed this vulnerability by changing access token validation logic and rewriting rule logic on PHP scripts.

The post CVE-2022-22990 appeared first on CVE Vulnerability.

]]> A limited authentication bypass vulnerability was discovered that could allow an attacker to achieve remote code execution and escalate privileges on the My Cloud devices. Addressed this vulnerability by changing access token validation logic and rewriting rule logic on PHP scripts.

The post CVE-2022-22990 appeared first on CVE Vulnerability.

]]> CVE-2022-22992 https://cvevulnerability.com/cve_vulnerabilities/cve-2022-22992/ Thu, 23 Feb 2023 05:02:57 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2022-22992/ A command injection remote code execution vulnerability was discovered on Western Digital My Cloud Devices that could allow an attacker to execute arbitrary system commands on the device. The vulnerability was addressed by escaping individual arguments to shell functions coming from user input.

The post CVE-2022-22992 appeared first on CVE Vulnerability.

]]> A command injection remote code execution vulnerability was discovered on Western Digital My Cloud Devices that could allow an attacker to execute arbitrary system commands on the device. The vulnerability was addressed by escaping individual arguments to shell functions coming from user input.

The post CVE-2022-22992 appeared first on CVE Vulnerability.

]]>