Sam Thomas

**Name of the Vulnerable Software and Affected Versions** My Cloud OS versions prior to 5.27.161 My Cloud Home version prior to 9.5.1-104 My Cloud Home Duo version prior to 9.5.1-104 SanDisk ibi version prior to 9.5.1-104 **Description** The issue is related to a server-side request forgery (SSRF) vulnerability. It could allow a rogue server on the local network to modify its URL using another DNS address to point back to the loopback adapter, potentially exploiting other vulnerabilities on the local server. This vulnerability is associated with insufficient validation of incoming requests. **Recommendations** For My Cloud OS versions prior to 5.27.161, update to version 5.27.161 or later. For My Cloud Home, My Cloud Home Duo, and SanDisk ibi versions prior to 9.5.1-104, update to version 9.5.1-104 or later. As a temporary workaround, consider restricting access to the DNS addresses that refer to the loopback adapter to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Western Digital My Cloud Home versions before 9.5.1-104 Western Digital My Cloud Home Duo versions before 9.5.1-104 SanDisk ibi versions before 9.5.1-104 Western Digital My Cloud OS 5 versions before 5.27.161 **Description** An uncontrolled resource consumption issue could arise by sending crafted requests to a service, consuming a large amount of memory and eventually resulting in the service being stopped and restarted. This issue requires the attacker to already have root privileges in order to exploit it. The issue may allow remote attackers to create a denial-of-service condition. **Recommendations** For Western Digital My Cloud Home versions before 9.5.1-104, update to version 9.5.1-104 or later. For Western Digital My Cloud Home Duo versions before 9.5.1-104, update to version 9.5.1-104 or later. For SanDisk ibi versions before 9.5.1-104, update to version 9.5.1-104 or later. For Western Digital My Cloud OS 5 versions before 5.27.161, update to version 5.27.161 or later. As a temporary workaround, consider restricting access to the vulnerable service to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Western Digital My Cloud Home versions before 9.4.0-191 Western Digital My Cloud Home Duo versions before 9.4.0-191 SanDisk ibi versions before 9.4.0-191 Western Digital My Cloud OS 5 versions before 5.26.202 **Description** An uncontrolled resource consumption issue could arise by sending crafted requests to a service, consuming a large amount of memory and eventually resulting in the service being stopped and restarted. This issue requires the attacker to already have root privileges in order to exploit it. **Recommendations** For Western Digital My Cloud Home versions before 9.4.0-191, update to version 9.4.0-191 or later. For Western Digital My Cloud Home Duo versions before 9.4.0-191, update to version 9.4.0-191 or later. For SanDisk ibi versions before 9.4.0-191, update to version 9.4.0-191 or later. For Western Digital My Cloud OS 5 versions before 5.26.202, update to version 5.26.202 or later.

**Name of the Vulnerable Software and Affected Versions** Western Digital My Cloud OS 5 versions prior to 5.26.119 **Description** An issue was discovered in Western Digital My Cloud OS 5 devices, allowing an attacker to execute code in the context of the root user on a vulnerable CGI file due to improper neutralization of special elements used in a command. This issue could lead to remote code execution. **Recommendations** For versions prior to 5.26.119, update to version 5.26.119 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable CGI file until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Western Digital My Cloud OS 5 versions prior to 5.26.202 **Description** A Server-Side Request Forgery (SSRF) issue was identified, which could allow a rogue server on the local network to modify its URL to point back to the loopback adapter. This could potentially exploit other vulnerabilities on the local server. **Recommendations** For Western Digital My Cloud OS 5 versions prior to 5.26.202, update to version 5.26.202 or later to resolve the issue. As a temporary workaround, consider restricting access to the local server to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Samsung Galaxy S21 versions prior to 4.5.40.5 **Description** This issue allows local attackers to execute arbitrary code on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this issue. The specific flaw exists within the handling of redirections. An attacker can force a redirection to a site that serves malicious content. This can be leveraged in conjunction with other issues to escalate privileges and execute arbitrary code in the context of the current user. **Recommendations** For versions prior to 4.5.40.5, update to version 4.5.40.5 or later to resolve the issue. As a temporary workaround, consider restricting access to sites that may serve malicious content to minimize the risk of exploitation. Avoid using the loadUrl function until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Occlum versions prior to 0.26.0 **Description** The issue concerns the pointer-validation logic in Occlum for Intel SGX, which can act as a confused deputy. This allows a local attacker to access unauthorized information via side-channel analysis. **Recommendations** For versions prior to 0.26.0, update to version 0.26.0 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive information to minimize the risk of exploitation via side-channel analysis.

**Name of the Vulnerable Software and Affected Versions** Western Digital My Cloud devices (affected versions not specified) **Description** A limited Server-Side Request Forgery (SSRF) issue was discovered, allowing an attacker to impersonate a server, bypass access controls, and reach any page on the server. The vulnerability was addressed by creating a whitelist for valid parameters. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Western Digital My Cloud (affected versions not specified) **Description** A limited authentication bypass issue was discovered, allowing an attacker to achieve remote code execution and escalate privileges on the My Cloud devices. The issue was addressed by changing access token validation logic and rewriting rule logic on PHP scripts. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Western Digital My Cloud OS 5 versions prior to 5.06.115 **Description** An issue was discovered that could allow an unauthenticated user to execute privileged commands on the device via a cookie, effectively bypassing NAS Admin authentication. This could be further exploited by an authenticated administrator using an upload endpoint to upload executable PHP scripts. **Recommendations** For Western Digital My Cloud OS 5 versions prior to 5.06.115, update to version 5.06.115 or later to resolve the issue. As a temporary workaround, consider restricting access to the upload endpoint and limiting the execution of privileged commands until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** WordPress versions prior to 5.4.2 **Description** In WordPress, comments from a post or page could sometimes be seen in the latest comments even if the post or page was not public. This issue is related to the comment-template.php file in the wp-includes directory. **Recommendations** For versions prior to 5.4.2, update to version 5.4.2 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Drupal Core versions prior to 8.8.8 Drupal Core versions prior to 8.9.1 Drupal Core version 9.0.1 Description: The issue is related to an arbitrary PHP code execution vulnerability under certain circumstances. An attacker could trick an administrator into visiting a malicious site, resulting in the creation of a carefully named directory on the file system. With this directory in place, an attacker could attempt to brute force a remote code execution vulnerability. This issue is most likely to affect Windows servers. The vulnerability is associated with insufficient authentication of executed requests, which could allow a remote attacker to execute arbitrary code. Recommendations: For Drupal Core versions prior to 8.8.8, update to version 8.8.8 or later. For Drupal Core versions prior to 8.9.1, update to version 8.9.1 or later. For Drupal Core version 9.0.1, update to a version later than 9.0.1. As a temporary workaround, consider restricting access to the file system to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** WordPress versions prior to 5.4.2 WordPress versions 5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34 **Description** The issue is related to the embed block in the WordPress block editor, which allows users with low privileges to inject unfiltered HTML. When affected posts are viewed by a higher privileged user, this could lead to script execution in the editor/wp-admin. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited. **Recommendations** For WordPress versions prior to 5.4.2, update to version 5.4.2 or later to resolve the issue. For WordPress versions 5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34, update to the corresponding minor release or later to resolve the issue. As a temporary workaround, consider restricting the use of the embed block in the block editor to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** WordPress versions prior to 5.4.2 WordPress versions 5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34 **Description** The issue is related to the injection of JavaScript into media file attachment pages by authenticated users with upload permissions, such as authors. This can lead to script execution in the context of a higher privileged user when the file is viewed by them. **Recommendations** For WordPress versions prior to 5.4.2, update to version 5.4.2 or later to resolve the issue. For WordPress versions 5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34, update to the respective minor release or later to resolve the issue. As a temporary workaround, consider restricting upload permissions for users to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** WordPress versions prior to 5.4.2 WordPress versions 5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34 **Description** The issue is related to an unintended/open redirect when an arbitrary external link is crafted due to a problem in `wp validate redirect()` and URL sanitization. This could allow a remote attacker to access and compromise confidential data. **Recommendations** For WordPress versions prior to 5.4.2, update to version 5.4.2 or later to resolve the issue. As a temporary workaround, consider restricting access to external links until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Joomla! versions prior to 3.9.16 **Description** The issue is related to a SQL injection vulnerability due to the lack of type casting of a variable in a SQL statement. This vulnerability affects the Featured Articles frontend menutype. **Recommendations** For versions prior to 3.9.16, update to version 3.9.16 or later to resolve the issue. As a temporary workaround, consider restricting access to the Featured Articles frontend menutype until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Drupal versions prior to 7.65 Drupal 8.6 versions prior to 8.6.13 Drupal 8.5 versions prior to 8.5.14 **Description** The issue allows a malicious user to upload a file that can trigger a cross-site scripting (XSS) vulnerability under certain circumstances. This is related to the File module/subsystem. **Recommendations** For Drupal 7 versions prior to 7.65, update to version 7.65 or later. For Drupal 8.6 versions prior to 8.6.13, update to version 8.6.13 or later. For Drupal 8.5 versions prior to 8.5.14, update to version 8.5.14 or later. As a temporary workaround, consider restricting file uploads to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Drupal versions prior to 7.62 Drupal versions 8.5.x prior to 8.5.9 Drupal versions 8.6.x prior to 8.6.6 **Description** The issue is related to insufficient validation of user input, which can lead to remote code execution when performing file operations on an untrusted phar:// URI. This vulnerability exists in PHP's built-in phar stream wrapper and may affect some Drupal code, including core, contrib, and custom code, that performs file operations on user input without proper validation. The vulnerability is mitigated by the fact that exploiting it typically requires access to administrative permissions or an atypical configuration. **Recommendations** For versions prior to 7.62, update to version 7.62 or later. For versions 8.5.x prior to 8.5.9, update to version 8.5.9 or later. For versions 8.6.x prior to 8.6.6, update to version 8.6.6 or later.

**Name of the Vulnerable Software and Affected Versions** WordPress versions prior to 4.9.9 WordPress versions 5.x prior to 5.0.1 **Description** The issue arises from the mishandling of serialized data at phar:// URLs in the wp get attachment thumb file function, located in wp-includes/post.php. This allows contributors to conduct PHP object injection attacks via crafted metadata in a "wp.getMediaItem" XMLRPC call. **Recommendations** For WordPress versions prior to 4.9.9, update to version 4.9.9 or later. For WordPress versions 5.x prior to 5.0.1, update to version 5.0.1 or later.

**Name of the Vulnerable Software and Affected Versions** WordPress versions prior to 4.9.9 WordPress versions 5.x prior to 5.0.1 **Description** The issue allows authors to modify metadata, bypassing intended restrictions on deleting files. **Recommendations** For WordPress versions prior to 4.9.9, update to version 4.9.9 or later. For WordPress versions 5.x prior to 5.0.1, update to version 5.0.1 or later.