S_N_T

An uncontrolled resource consumption issue could arise by sending crafted requests to a service, consuming a large amount of memory and eventually resulting in the service being stopped and restarted. This issue requires the attacker to already have root privileges in order to exploit it. The issue may allow remote attackers to create a denial-of-service condition.

The issue is related to a server-side request forgery (SSRF) vulnerability. It could allow a rogue server on the local network to modify its URL using another DNS address to point back to the loopback adapter, potentially exploiting other vulnerabilities on the local server. This vulnerability is associated with insufficient validation of incoming requests.

An uncontrolled resource consumption issue could arise by sending crafted requests to a service, consuming a large amount of memory and eventually resulting in the service being stopped and restarted. This issue requires the attacker to already have root privileges in order to exploit it.

An issue was discovered in Western Digital My Cloud OS 5 devices, allowing an attacker to execute code in the context of the root user on a vulnerable CGI file due to improper neutralization of special elements used in a command. This issue could lead to remote code execution.

A Server-Side Request Forgery (SSRF) issue was identified, which could allow a rogue server on the local network to modify its URL to point back to the loopback adapter. This could potentially exploit other vulnerabilities on the local server.

This issue allows remote attackers to execute arbitrary code on affected installations. Although authentication is required to exploit this issue, the existing authentication mechanism can be bypassed. The specific flaw exists within com.inductiveautomation.metro.impl, resulting from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this issue to execute code in the context of SYSTEM.

This issue allows remote attackers to bypass authentication on affected installations. The flaw exists within com.inductiveautomation.ignition.gateway.web.pages due to the lack of proper authentication prior to access to functionality. An attacker can leverage this to bypass authentication on the system.

This issue allows local attackers to execute arbitrary code on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this issue. The specific flaw exists within the handling of redirections. An attacker can force a redirection to a site that serves malicious content. This can be leveraged in conjunction with other issues to escalate privileges and execute arbitrary code in the context of the current user.

A limited Server-Side Request Forgery (SSRF) issue was discovered, allowing an attacker to impersonate a server, bypass access controls, and reach any page on the server. The vulnerability was addressed by creating a whitelist for valid parameters.

A limited authentication bypass issue was discovered, allowing an attacker to achieve remote code execution and escalate privileges on the My Cloud devices. The issue was addressed by changing access token validation logic and rewriting rule logic on PHP scripts.

An issue was discovered that could allow an unauthenticated user to execute privileged commands on the device via a cookie, effectively bypassing NAS Admin authentication. This could be further exploited by an authenticated administrator using an upload endpoint to upload executable PHP scripts.