psirt@wdc.com
organization01
roles
Roles this identity holds.
02
references
Other names and identifiers for this entity.
nvdUS psirt@wdc.com
03
assessed vulnerabilities (49)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-30248US | — | — | ||
DLL hijacking in the WD Discovery Installer in Western Digital WD Discovery 5.2.730 on Windows allows a local attacker to execute arbitrary code via placement of a crafted dll in t… | ||||
| CVE-2025-30247US | — | — | ||
An OS command injection vulnerability in user interface in Western Digital My Cloud firmware prior to 5.31.108 on NAS platforms allows remote attackers to execute arbitrary system… | ||||
| CVE-2024-22170US | — | — | ||
Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Western Digital My Cloud ddns-start on Linux allows Overflow Buffers.This issue affects My… | ||||
| CVE-2024-22169US | — | — | ||
WD Discovery
versions prior to 5.0.589 contain a misconfiguration in the Node.js environment
settings that could allow code execution by utilizing the 'ELECTRON_RUN_AS_NODE' enviro… | ||||
| CVE-2024-22168US | — | — | ||
A Cross-Site Scripting (XSS) vulnerability on the My Cloud, My Cloud Home, SanDisk ibi, and WD Cloud web apps was found which could allow an attacker to redirect the user to a craf… | ||||
| CVE-2024-22167US | — | — | ||
A potential DLL hijacking vulnerability in the SanDisk PrivateAccess application for Windows that could lead to arbitrary code execution in the context of the system user. This vul… | ||||
| CVE-2023-22819US | medium4.9 | — | ||
An uncontrolled resource consumption vulnerability issue that could arise by sending crafted requests to a service to consume a large amount of memory, eventually resulting in the… | ||||
| CVE-2023-22817US | medium5.5 | — | ||
Server-side request forgery (SSRF) vulnerability that could allow a rogue server on the local network to modify its URL using another DNS address to point back to the loopback adap… | ||||
| CVE-2023-22818US | high7.8 | — | ||
Multiple DLL Search Order Hijack vulnerabilities were addressed in the SanDisk Security Installer for
Windows that could allow attackers with local access to execute arbitrary code… | ||||
| CVE-2023-22814US | critical9.8 | — | ||
An authentication bypass issue via spoofing was discovered in the token-based authentication mechanism that could allow an attacker to carry out an impersonation attack.
This iss… | ||||
| CVE-2023-22816US | high8.8 | — | ||
A post-authentication remote command injection vulnerability in a CGI file in Western Digital My Cloud OS 5 devices that could allow an attacker to build files with redirects and e… | ||||
| CVE-2023-22815US | medium6.7 | — | ||
Post-authentication remote command injection vulnerability in Western Digital My Cloud OS 5 devices that could allow an attacker to execute code in the context of the root user on… | ||||
| CVE-2022-36331US | high7.5 | — | ||
Western Digital My Cloud, My Cloud Home, My Cloud Home Duo, and SanDisk ibi devices were vulnerable to an impersonation attack that could allow an unauthenticated attacker to gain… | ||||
| CVE-2022-36328US | medium4.9 | — | ||
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could allow an attacker to create arbitrary shares on arbitrary directories and ex… | ||||
| CVE-2022-36327US | critical9.8 | — | ||
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could allow an attacker to write files to locations with certain critical filesyst… | ||||
| CVE-2022-36326US | medium4.9 | — | ||
An uncontrolled resource consumption vulnerability issue that could arise by sending crafted requests to a service to consume a large amount of memory, eventually resulting in the… | ||||
| CVE-2022-29840US | medium5.5 | — | ||
Server-Side Request Forgery (SSRF) vulnerability that could allow a rogue server on the local network to modify its URL to point back to the loopback adapter was addressed in Weste… | ||||
| CVE-2022-29841US | critical9.8 | — | ||
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that was caused by a command that read files from a privileged location and… | ||||
| CVE-2022-29842US | critical9.8 | — | ||
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability that could allow an attacker to execute code in the context of the root user on a… | ||||
| CVE-2022-36329US | high7.5 | — | ||
An improper privilege management issue that could allow an attacker to cause a denial of service over the OTA mechanism was discovered in Western Digital My Cloud Home, My Cloud Ho… | ||||