ewon_flexy_firmware Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/ewon_flexy_firmware/ Sun, 26 Feb 2023 06:38:10 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png ewon_flexy_firmware Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/ewon_flexy_firmware/ 32 32 CVE-2020-16230 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-16230/ Sun, 26 Feb 2023 06:38:10 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-16230/ All version of Ewon Flexy and Cosy prior to 14.1 use wildcards such as (*) under which domains can request resources. An attacker with local access and high privileges could inject scripts into the Cross-origin Resource Sharing (CORS) configuration that could abuse this vulnerability, allowing the attacker to retrieve limited confidential information through sniffing.

The post CVE-2020-16230 appeared first on CVE Vulnerability.

]]> All version of Ewon Flexy and Cosy prior to 14.1 use wildcards such as (*) under which domains can request resources. An attacker with local access and high privileges could inject scripts into the Cross-origin Resource Sharing (CORS) configuration that could abuse this vulnerability, allowing the attacker to retrieve limited confidential information through sniffing.

The post CVE-2020-16230 appeared first on CVE Vulnerability.

]]> CVE-2020-10633 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-10633/ Sun, 26 Feb 2023 06:35:53 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-10633/ A non-persistent XSS (cross-site scripting) vulnerability exists in eWON Flexy and Cosy (all firmware versions prior to 14.1s0). An attacker could send a specially crafted URL to initiate a password change for the device. The target must introduce the credentials to the gateway before the attack can be successful.

The post CVE-2020-10633 appeared first on CVE Vulnerability.

]]> A non-persistent XSS (cross-site scripting) vulnerability exists in eWON Flexy and Cosy (all firmware versions prior to 14.1s0). An attacker could send a specially crafted URL to initiate a password change for the device. The target must introduce the credentials to the gateway before the attack can be successful.

The post CVE-2020-10633 appeared first on CVE Vulnerability.

]]>