Sandisk
23 CVEs across 11 Sandisk products. Browse Sandisk vulnerabilities, severities, and proof-of-concept exploits.
Sandisk products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-22168 | | 2024-06-24 | A Cross-Site Scripting (XSS) vulnerability on the My Cloud, My Cloud Home, SanDisk ibi, and WD Cloud web apps was found which could allow an attacker to redire… | |
CVE-2024-22167 | High | 7.9 | 2024-03-13 | A potential DLL hijacking vulnerability in the SanDisk PrivateAccess application for Windows that could lead to arbitrary code execution in the context of the… |
CVE-2023-22819 | Medium | 4.9 | 2024-02-05 | An uncontrolled resource consumption vulnerability issue that could arise by sending crafted requests to a service to consume a large amount of memory, eventua… |
CVE-2023-22817 | Medium | 5.5 | 2024-02-05 | Server-side request forgery (SSRF) vulnerability that could allow a rogue server on the local network to modify its URL using another DNS address to point back… |
CVE-2023-22818 | High | 7.3 | 2023-11-15 | Multiple DLL Search Order Hijack vulnerabilities were addressed in the SanDisk Security Installer for Windows that could allow attackers with local access to e… |
CVE-2022-36331 | Critical | 10.0 | 2023-06-12 | Western Digital My Cloud, My Cloud Home, My Cloud Home Duo, and SanDisk ibi devices were vulnerable to an impersonation attack that could allow an unauthentica… |
CVE-2022-36328 | Medium | 5.8 | 2023-05-18 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could allow an attacker to create arbitrary shares on arbitra… |
CVE-2022-36327 | Medium | 5.8 | 2023-05-18 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could allow an attacker to write files to locations with cert… |
CVE-2022-36326 | Medium | 4.4 | 2023-05-18 | An uncontrolled resource consumption vulnerability issue that could arise by sending crafted requests to a service to consume a large amount of memory, eventua… |
CVE-2022-36329 | Medium | 4.4 | 2023-05-10 | An improper privilege management issue that could allow an attacker to cause a denial of service over the OTA mechanism was discovered in Western Digital My Cl… |
CVE-2022-36330 | Low | 1.9 | 2023-05-10 | A buffer overflow vulnerability was discovered on firmware version validation that could lead to an unauthenticated remote code execution in Western Digital My… |
CVE-2023-22813 | Low | 3.3 | 2023-05-08 | A device API endpoint was missing access controls on Western Digital My Cloud OS 5 iOS and Anroid Mobile Apps, My Cloud Home iOS and Android Mobile A… |
CVE-2023-22812 | High | 7.4 | 2023-03-24 | SanDisk PrivateAccess versions prior to 6.4.9 support insecure TLS 1.0 and TLS 1.1 protocols which are susceptible to man-in-the-middle attacks thereby comprom… |
CVE-2022-29837 | Medium | 4.7 | 2022-12-01 | A path traversal vulnerability was addressed in Western Digital My Cloud Home, My Cloud Home Duo and SanDisk ibi which could allow an attacker to initiate inst… |
CVE-2022-29836 | Low | 1.9 | 2022-11-09 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability was discovered via an HTTP API on Western Digital My Cloud Home; M… |
CVE-2022-23006 | Low | 1.8 | 2022-09-27 | A stack-based buffer overflow vulnerability was found on Western Digital My Cloud Home, My Cloud Home Duo, and SanDisk ibi that could allow an attacker accessi… |
CVE-2021-36750 | High | 8.1 | 2021-12-22 | ENC DataVault before 7.2 and VaultAPI v67 mishandle key derivation, making it easier for attackers to determine the passwords of all DataVault users (across US… |
CVE-2019-13467 | Medium | 5.9 | 2019-09-30 | Description: Western Digital SSD Dashboard before 2.5.1.0 and SanDisk SSD Dashboard before 2.5.1.0 applications are potentially vulnerable to man-in-the-middle… |
CVE-2019-13466 | High | 7.5 | 2019-09-30 | Western Digital SSD Dashboard before 2.5.1.0 and SanDisk SSD Dashboard before 2.5.1.0 have Incorrect Access Control. The “generate reports” archive is protecte… |
CVE-2017-16560 | Medium | 4.3 | 2017-11-16 | SanDisk Secure Access 3.01 vault decrypts and copies encrypted files to a temporary folder, where they can remain indefinitely in certain situations, such as i… |
CVE-2010-0226 | | 2010-01-07 | SanDisk Cruzer Enterprise USB flash drives do not prevent password replay attacks, which allows physically proximate attackers to access the cleartext drive co… | |
CVE-2010-0225 | | 2010-01-07 | SanDisk Cruzer Enterprise USB flash drives use a fixed 256-bit key for obtaining access to the cleartext drive contents, which makes it easier for physically p… | |
CVE-2010-0224 | | 2010-01-07 | SanDisk Cruzer Enterprise USB flash drives validate passwords with a program running on the host computer rather than the device hardware, which allows physica… |