CVE-2020-12427

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The Western Digital WD Discovery application before 3.8.229 for MyCloud Home on Windows and macOS is vulnerable to CSRF, with impacts such as stealing data, modifying disk contents, or exhausting disk space.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
May 13, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-124299.8Online Course Registration 2.0 has multiple SQL injections that would can lead to a complete database compromise and authentication bypass iCVE-2020-12437.8<p>A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate specific malicious data from CVE-2020-124306.5An issue was discovered in qemuDomainGetStatsIOThread in qemu/qemu_driver.c in libvirt 4.10.0 though 6.x before 6.1.0. A memory leak was fouCVE-2020-124316.6A Windows privilege change issue was discovered in Splashtop Software Updater before 1.5.6.16. Insecure permissions on the configuration filCVE-2020-124326.1The WOPI API integration for Vereign Collabora CODE through 4.2.2 does not properly restrict delivery of JavaScript to a victim's browser, aCVE-2020-124385.4An XSS vulnerability exists in the banners.php page of PHP-Fusion 9.03.50. This can be exploited because the only security measure used agaiCVE-2020-124395.3Grin before 3.1.0 allows attackers to adversely affect availability of data on a Mimblewimble blockchain.CVE-2020-12447.1A denial of service vulnerability exists when Connected User Experiences and Telemetry Service improperly handles file operations, aka 'ConnCVE-2020-124419.8Denial-of-Service (DoS) in Ivanti Service Manager HEAT Remote Control 7.4 due to a buffer overflow in the protocol parser of the ‘HEATRemoteCVE-2020-124429.8Ivanti Avalanche 6.3 allows a SQL injection that is vaguely associated with the Apache HTTP Server, aka Bug 683250.CVE-2020-124439.8BigBlueButton before 2.2.6 allows remote attackers to read arbitrary files because the presfilename (lowercase) value can be a .pdf filenameCVE-2020-124467.8The ene.sys driver in G.SKILL Trident Z Lighting Control through 1.00.08 exposes mapping and un-mapping of physical memory, reading and writ
CVE-2020-12427: High severity, CVSS 8.8 | Vulnix