CVE-2022-29835

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

WD Discovery software executable files were signed with an unsafe SHA-1 hashing algorithm. An attacker could use this weakness to create forged certificate signatures due to the use of a hashing algorithm that is not collision-free. This could thereby impact the confidentiality of user content. This issue affects: Western Digital WD Discovery WD Discovery Desktop App versions prior to 4.4.396 on Mac; WD Discovery Desktop App versions prior to 4.4.396 on Windows.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-328 CWE-326

Affected software

No affected versions have been published.

Timeline

Published: Sep 19, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-298364.3Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability was discovered via an HTTP API on Western Digit CVE-2022-298377.8A path traversal vulnerability was addressed in Western Digital My Cloud Home, My Cloud Home Duo and SanDisk ibi which could allow an attack CVE-2022-298384.6Improper Authentication vulnerability in the encrypted volumes and auto mount features of Western Digital My Cloud devices allows insecure d CVE-2022-298395.5Insufficiently Protected Credentials vulnerability in the remote backups application on Western Digital My Cloud devices that could allow an CVE-2022-29845.5In jpg driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in kernel.CVE-2022-298405.5Server-Side Request Forgery (SSRF) vulnerability that could allow a rogue server on the local network to modify its URL to point back to the CVE-2022-298419.8Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that was caused by a command that r CVE-2022-298429.8Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability that could allow an attacker to execute co CVE-2022-298439.8A command injection vulnerability in the DDNS service configuration of Western Digital My Cloud OS 5 devices running firmware versions prior CVE-2022-298449.8A vulnerability in the FTP service of Western Digital My Cloud OS 5 devices running firmware versions prior to 5.26.119 allows an attacker t CVE-2022-298456.5In Progress Ipswitch WhatsUp Gold 21.1.0 through 21.1.1, and 22.0.0, it is possible for an authenticated user to invoke an API transaction t CVE-2022-298465.3In Progress Ipswitch WhatsUp Gold 16.1 through 21.1.1, and 22.0.0, it is possible for an unauthenticated attacker to obtain the WhatsUp Gold