Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-22780 State: PUBLISHED Published: 2023-05-08T14:03:38.356Z Last Updated: 2025-01-29T15:32:34.957Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: Aruba Access Points running InstantOS and ArubaOS 10 Problem Types: n/a Description: There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the
CVE ID: CVE-2023-22781 State: PUBLISHED Published: 2023-05-08T14:03:42.187Z Last Updated: 2025-01-31T18:12:49.754Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: Aruba Access Points running InstantOS and ArubaOS 10 Problem Types: n/a Description: There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the
CVE ID: CVE-2023-22782 State: PUBLISHED Published: 2023-05-08T14:03:45.533Z Last Updated: 2025-01-31T18:11:51.624Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: Aruba Access Points running InstantOS and ArubaOS 10 Problem Types: n/a Description: There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the
CVE ID: CVE-2023-22783 State: PUBLISHED Published: 2023-05-08T14:03:47.963Z Last Updated: 2025-01-31T18:10:52.350Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: Aruba Access Points running InstantOS and ArubaOS 10 Problem Types: n/a Description: There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the
CVE ID: CVE-2023-22784 State: PUBLISHED Published: 2023-05-08T14:03:51.253Z Last Updated: 2025-01-31T18:09:21.664Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: Aruba Access Points running InstantOS and ArubaOS 10 Problem Types: n/a Description: There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the
CVE ID: CVE-2023-22785 State: PUBLISHED Published: 2023-05-08T14:03:55.974Z Last Updated: 2025-01-31T18:08:15.889Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: Aruba Access Points running InstantOS and ArubaOS 10 Problem Types: n/a Description: There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the
CVE ID: CVE-2023-22786 State: PUBLISHED Published: 2023-05-08T14:03:58.355Z Last Updated: 2025-01-31T18:07:01.792Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: Aruba Access Points running InstantOS and ArubaOS 10 Problem Types: n/a Description: There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the
CVE ID: CVE-2023-22787 State: PUBLISHED Published: 2023-05-08T14:07:00.289Z Last Updated: 2025-01-31T18:05:29.573Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: Aruba Access Points running InstantOS and ArubaOS 10 Problem Types: n/a Description: An unauthenticated Denial of Service (DoS) vulnerability exists in a service accessed via the PAPI protocol provided by Aruba InstantOS and ArubaOS 10. Successful exploitation of this vulnerability results in the ability to interrupt the normal operation of the affected access point. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - ht
the affected access point. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-006.txt
CVE ID: CVE-2023-22788 State: PUBLISHED Published: 2023-05-08T14:08:35.055Z Last Updated: 2025-01-28T20:09:44.673Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: Aruba Access Points running InstantOS and ArubaOS 10 Problem Types: n/a Description: Multiple authenticated command injection vulnerabilities exist in the Aruba InstantOS and ArubaOS 10 command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http
erlying operating system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-006.txt
CVE ID: CVE-2023-22789 State: PUBLISHED Published: 2023-05-08T14:08:39.438Z Last Updated: 2025-01-31T18:04:29.605Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: Aruba Access Points running InstantOS and ArubaOS 10 Problem Types: n/a Description: Multiple authenticated command injection vulnerabilities exist in the Aruba InstantOS and ArubaOS 10 command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http
CVE ID: CVE-2023-22790 State: PUBLISHED Published: 2023-05-08T14:08:43.190Z Last Updated: 2025-01-31T18:03:17.879Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: Aruba Access Points running InstantOS and ArubaOS 10 Problem Types: n/a Description: Multiple authenticated command injection vulnerabilities exist in the Aruba InstantOS and ArubaOS 10 command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http
CVE ID: CVE-2023-22791 State: PUBLISHED Published: 2023-05-08T14:10:03.684Z Last Updated: 2025-01-31T18:01:49.709Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: Hewlett Packard Enterprise (HPE) Products: Aruba Access Points running InstantOS and ArubaOS 10 Problem Types: n/a Description: A vulnerability exists in Aruba InstantOS and ArubaOS 10 where an edge-case combination of network configuration, a specific WLAN environment and an attacker already possessing valid user credentials on that WLAN can lead to sensitive information being disclosed via the WLAN. The scenarios in which this disclosure of potentially sensitive information can occur are complex
sclosed via the WLAN. The scenarios in which this disclosure of potentially sensitive information can occur are complex and depend on factors that are beyond the control of the attacker. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-006.txt
CVE ID: CVE-2023-22792 State: PUBLISHED Published: 2023-02-09T00:00:00.000Z Last Updated: 2025-03-24T20:30:41.601Z Vendors: n/a Products: https://github.com/rails/rails Problem Types: CWE-400 Description: A regular expression based DoS vulnerability in Action Dispatch <6.0.6.1,< 6.1.7.1, and <7.0.4.1. Specially crafted cookies, in combination with a specially crafted X_FORWARDED_HOST header can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability All users running an affected release should either upgrade or use one of the workarounds immediately. Additiona
ability All users running an affected release should either upgrade or use one of the workarounds immediately. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://discuss.rubyonrails.org/t/cve-2023-22792-possible-redos-based-dos-vulnerability-in-action-dispatch/82115 - https://www.debian.org/security/2023/dsa-5372 - https://security.netapp.com/advisory/ntap-20240202-0007/
CVE ID: CVE-2023-22794 State: PUBLISHED Published: 2023-02-09T00:00:00 Last Updated: 2024-08-02T10:20:30.748Z Vendors: n/a Products: https://github.com/rails/rails Problem Types: CWE-89 Description: A vulnerability in ActiveRecord <6.0.6.1, v6.1.7.1 and v7.0.4.1 related to the sanitization of comments. If malicious user input is passed to either the `annotate` query method, the `optimizer_hints` query method, or through the QueryLogs interface which automatically adds annotations, it may be sent to the database withinsufficient sanitization and be able to inject SQL outside of the comment. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.rubyonrails.org/t/cve-
of the comment. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.rubyonrails.org/t/cve-2023-22794-sql-injection-vulnerability-via-activerecord-comments/82117 - https://www.debian.org/security/2023/dsa-5372 - https://security.netapp.com/advisory/ntap-20240202-0008/
CVE ID: CVE-2023-22795 State: PUBLISHED Published: 2023-02-09T00:00:00 Last Updated: 2024-08-02T10:20:30.901Z Vendors: n/a Products: https://github.com/rails/rails Problem Types: CWE-400 Description: A regular expression based DoS vulnerability in Action Dispatch <6.1.7.1 and <7.0.4.1 related to the If-None-Match header. A specially crafted HTTP If-None-Match header can cause the regular expression engine to enter a state of catastrophic backtracking, when on a version of Ruby below 3.2.0. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability All users running an affected release should either upgrade or use one of the workarounds immediat
ble DoS vulnerability All users running an affected release should either upgrade or use one of the workarounds immediately. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.rubyonrails.org/t/cve-2023-22795-possible-redos-based-dos-vulnerability-in-action-dispatch/82118 - https://www.debian.org/security/2023/dsa-5372 - https://security.netapp.com/advisory/ntap-20240202-0010/
CVE ID: CVE-2023-22796 State: PUBLISHED Published: 2023-02-09T00:00:00 Last Updated: 2024-11-27T15:16:00.509Z Vendors: n/a Products: https://github.com/rails/rails Problem Types: CWE-400 Description: A regular expression based DoS vulnerability in Active Support <6.1.7.1 and <7.0.4.1. A specially crafted string passed to the underscore method can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://discuss.rubyonrails.org/t/cve-2023-22796-possible-redos-based-
Container: - CISA ADP Vulnrichment: References: - https://discuss.rubyonrails.org/t/cve-2023-22796-possible-redos-based-dos-vulnerability-in-active-supports-underscore/82116 - https://www.debian.org/security/2023/dsa-5372 - https://security.netapp.com/advisory/ntap-20240202-0009/
CVE ID: CVE-2023-22797 State: PUBLISHED Published: 2023-02-09T00:00:00.000Z Last Updated: 2025-03-24T20:07:28.983Z Vendors: n/a Products: https://github.com/rails/rails Problem Types: CWE-601 Description: An open redirect vulnerability is fixed in Rails 7.0.4.1 with the new protection against open redirects from calling redirect_to with untrusted user input. In prior versions the developer was fully responsible for only providing trusted input. However the check introduced could allow an attacker to bypass with a carefully crafted URL resulting in an open redirect vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://discuss.rubyonra
lity. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://discuss.rubyonrails.org/t/cve-2023-22799-possible-redos-based-dos-vulnerability-in-globalid/82127
CVE ID: CVE-2023-22798 State: PUBLISHED Published: 2023-02-09T00:00:00.000Z Last Updated: 2025-03-25T13:48:20.987Z Vendors: n/a Products: https://github.com/brave/adblock-lists Problem Types: CWE-601 Description: Prior to commit 51867e0d15a6d7f80d5b714fd0e9976b9c160bb0, https://github.com/brave/adblock-lists removed redirect interceptors on some websites like Facebook in which the redirect interceptor may have been there for security purposes. This could potentially cause open redirects on these websites. Brave's redirect interceptor removal feature is known as "debouncing" and is intended to remove unnecessary redirects that track users across the web. Additional Analyst Notes: - CVE Progra
and is intended to remove unnecessary redirects that track users across the web. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/1579374
CVE ID: CVE-2023-22799 State: PUBLISHED Published: 2023-02-09T00:00:00 Last Updated: 2024-08-02T10:20:30.834Z Vendors: n/a Products: https://github.com/rails/globalid Problem Types: CWE-400 Description: A ReDoS based DoS vulnerability in the GlobalID <1.0.1 which could allow an attacker supplying a carefully crafted input can cause the regular expression engine to take an unexpected amount of time. All users running an affected release should either upgrade or use one of the workarounds immediately. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.rubyonrails.org/t/cve-2023-22799-possible-redos-based-dos-vulnerability-in-globalid/82127
CVE ID: CVE-2023-22803 State: PUBLISHED Published: 2023-02-15T17:23:46.060Z Last Updated: 2025-01-16T21:56:53.061Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: LS Electric Products: XBC-DN32U Problem Types: CWE-306 Description: LS ELECTRIC XBC-DN32U with operating system version 01.80 is missing authentication to perform critical functions to the PLC. This could allow an attacker to change the PLC's mode arbitrarily. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-23-040-02
CVE ID: CVE-2023-22804 State: PUBLISHED Published: 2023-02-15T17:25:56.279Z Last Updated: 2025-01-16T21:56:46.846Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: LS Electric Products: XBC-DN32U Problem Types: CWE-306 Description: LS ELECTRIC XBC-DN32U with operating system version 01.80 is missing authentication to create users on the PLC. This could allow an attacker to create and use an account with elevated privileges and take control of the device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-23-040-02
CVE ID: CVE-2023-22805 State: PUBLISHED Published: 2023-02-15T17:27:50.026Z Last Updated: 2025-01-16T21:56:38.793Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: LS Electric Products: XBC-DN32U Problem Types: CWE-284 Description: LS ELECTRIC XBC-DN32U with operating system version 01.80 has improper access control to its read prohibition feature. This could allow a remote attacker to remotely set the feature to lock users out of reading data from the device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-23-040-02
CVE ID: CVE-2023-22806 State: PUBLISHED Published: 2023-02-15T17:28:53.471Z Last Updated: 2025-01-16T21:56:27.143Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: LS Electric Products: XBC-DN32U Problem Types: CWE-319 Description: LS ELECTRIC XBC-DN32U with operating system version 01.80 transmits sensitive information in cleartext when communicating over its XGT protocol. This could allow an attacker to gain sensitive information such as user credentials. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-23-040-02
CVE ID: CVE-2023-22807 State: PUBLISHED Published: 2023-02-15T17:29:47.415Z Last Updated: 2025-01-16T21:56:14.871Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: LS Electric Products: XBC-DN32U Problem Types: CWE-284 Description: LS ELECTRIC XBC-DN32U with operating system version 01.80 does not properly control access to the PLC over its internal XGT protocol. An attacker could control and tamper with the PLC by sending the packets to the PLC over its XGT protocol. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-23-040-02
CVE ID: CVE-2023-22808 State: PUBLISHED Published: 2023-04-11T00:00:00.000Z Last Updated: 2025-02-11T20:12:38.614Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Arm Android Gralloc Module. A non-privileged user can read a small portion of the allocator process memory. This affects Bifrost r24p0 through r41p0 before r42p0, Valhall r24p0 through r41p0 before r42p0, and Avalon r41p0 before r42p0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities
CVE ID: CVE-2023-22809 State: PUBLISHED Published: 2023-01-18T00:00:00.000Z Last Updated: 2025-04-04T15:45:24.835Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to append arbitrary entries to the list of files to process. This can lead to privilege escalation. Affected versions are 1.8.0 through 1.9.12.p1. The problem exists because a user-specified editor may contain a "--" argument that defeats a protection mechanism, e.g., an EDITOR='vim -- /path/to/extra/file' value. Additional Analyst
--" argument that defeats a protection mechanism, e.g., an EDITOR='vim -- /path/to/extra/file' value. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.synacktiv.com/sites/default/files/2023-01/sudo-CVE-2023-22809.pdf - https://www.sudo.ws/security/advisories/sudoedit_any/ - https://lists.debian.org/debian-lts-announce/2023/01/msg00012.html - https://www.debian.org/security/2023/dsa-5321 - http://www.openwall.com/lists/oss-security/2023/01/19/1 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2QDGFCGAV5QRJCE6IXRXIS4XJHS57DDH/ - https://security.netapp.com/advisory/ntap-20230127-0015/ - https
project.org/message/2QDGFCGAV5QRJCE6IXRXIS4XJHS57DDH/ - https://security.netapp.com/advisory/ntap-20230127-0015/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G4YNBTTKTRT2ME3NTSXAPTOKYUE47XHZ/ - http://packetstormsecurity.com/files/171644/sudo-1.9.12p1-Privilege-Escalation.html - https://security.gentoo.org/glsa/202305-12 - https://support.apple.com/kb/HT213758 - http://packetstormsecurity.com/files/172509/Sudoedit-Extra-Arguments-Privilege-Escalation.html - http://seclists.org/fulldisclosure/2023/Aug/21 - http://packetstormsecurity.com/files/174234/Cisco-ThousandEyes-Enterprise-Agent-Virtual-Appliance-Arbitrary-File-Modification.html
CVE ID: CVE-2023-22812 State: PUBLISHED Published: 2023-03-24T00:00:00.000Z Last Updated: 2025-02-19T20:27:51.000Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: SanDisk Products: PrivateAccess Problem Types: CWE-327 Description: SanDisk PrivateAccess versions prior to 6.4.9 support insecure TLS 1.0 and TLS 1.1 protocols which are susceptible to man-in-the-middle attacks thereby compromising confidentiality and integrity of data. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.westerndigital.com/support/product-security/wdc-23005-sandisk-privateaccess-software-update
CVE ID: CVE-2023-22813 State: PUBLISHED Published: 2023-05-08T22:56:49.389Z Last Updated: 2025-01-29T14:52:23.130Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Western Digital, SanDisk Products: My Cloud OS 5 Mobile App, My Cloud Home Mobile App, ibi Mobile App, My Cloud OS 5 Web App, My Cloud Home Web App, ibi Web App Problem Types: CWE-200 Description: A device API endpoint was missing access controls on Western Digital My Cloud OS 5 iOS and Anroid Mobile Apps, My Cloud Home iOS and Android Mobile Apps, SanDisk ibi iOS and Android Mobile Apps, My Cloud OS 5 Web App, My Cloud Home Web App and the SanDisk ibi Web App. Due to a permissive CORS policy and miss
Apps, My Cloud OS 5 Web App, My Cloud Home Web App and the SanDisk ibi Web App. Due to a permissive CORS policy and missing authentication requirement for private IPs, a remote attacker on the same network as the device could obtain device information by convincing a victim user to visit an attacker-controlled server and issue a cross-site request. This issue affects My Cloud OS 5 Mobile App: before 4.21.0; My Cloud Home Mobile App: before 4.21.0; ibi Mobile App: before 4.21.0; My Cloud OS 5 Web App: before 4.26.0-6126; My Cloud Home Web App: before 4.26.0-6126; ibi Web App: before 4.26.0-6126. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://
: before 4.26.0-6126. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.westerndigital.com/support/product-security/wdc-23004-western-digital-my-cloud-os-5-my-cloud-home-sandisk-ibi-and-wd-cloud-mobile-and-web-app-update