CVE-2024-22168

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

A Cross-Site Scripting (XSS) vulnerability on the My Cloud, My Cloud Home, SanDisk ibi, and WD Cloud web apps was found which could allow an attacker to redirect the user to a crafted domain and reset their credentials, or to execute arbitrary client-side code in the user’s browser session to carry out malicious activities.The web apps for these devices have been automatically updated to resolve this vulnerability and improve the security of your devices and data.

Metrics

CVSS 4.0 5.9/10

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jun 24, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-221697.1WD Discovery versions prior to 5.0.589 contain a misconfiguration in the Node.js environment settings that could allow code execution by uti CVE-2024-22177.5gaizhenbiao/chuanhuchatgpt is vulnerable to improper access control, allowing unauthorized access to the `config.json` file. This vulnerabil CVE-2024-221709.2Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Western Digital My Cloud ddns-start on Linux allows CVE-2024-221775.5in OpenHarmony v3.2.4 and prior versions allow a local attacker cause apps crash through get permission.CVE-2024-221784.9A file write vulnerability exists in the OAS Engine Save Security Configuration functionality of Open Automation Software OAS Platform V19.0 CVE-2024-221797.5The application is vulnerable to an unauthenticated parameter manipulation that allows an attacker to set the credentials to blank giving CVE-2024-22184.6The LuckyWP Table of Contents WordPress plugin through 2.1.4 does not sanitise and escape some of its settings, which could allow high privi CVE-2024-221805.5in OpenHarmony v4.0.0 and prior versions allow a local attacker cause DOS through use after free.CVE-2024-221817.8An out-of-bounds write vulnerability exists in the readNODE functionality of libigl v2.5.0. A specially crafted .node file can lead to an ou CVE-2024-221828.6A remote, unauthenticated attacker may be able to send crafted messages to the web server of the Commend WS203VICM causing the system to r CVE-2024-221847.8Uncontrolled search path for some Intel(R) Quartus(R) Prime Pro Edition Design Software before version 24.1 may allow an authenticated user CVE-2024-221857.2Time-of-check Time-of-use Race Condition in some Intel(R) processors with Intel(R) ACTM may allow a privileged user to potentially enable es