SmartAsset-CORS-CVE-2020-26527

SmartAsset-CORS-CVE-2020-26527 CVE-2020-26527 Smart Asset - バージョン 2020.7 Damstra Smart Asset 2020.7 の API/api/Version で問題が発見されました。 クロスオリジンリソースシェアリングは、任意の 'Origin: example.com' ヘッダーを受け入れ、200 OK とワイルドカードの 'Access-Control-Allow-Origin: ' ヘッダーで応答することにより、ランダムなオリジンを信頼します。 HTTP リクエスト: GET /API/api/Versi...

SmartAsset-SQLinj-CVE-2020-26525

SmartAsset-SQLinj-CVE-2020-26525 Damstra Smart Asset 2020.7 は、API/api/Asset の originator パラメーターを介した SQL インジェクションの脆弱性があります。 Smart Asset - バージョン 2020.7 CVE-2020-26525 ========================== HTTP リクエスト: GET /API/api/Asset?assetCode=XXX-08-X-01-06-01&...

SmartAsset-UE-CVE-2020-26526

SmartAsset-UE-CVE-2020-26526 可以在登录页面上枚举有效用户名。 CVE-2020-26526 在 Damstra Smart Asset 2020.7 中发现了一个问题。 可以在登录页面上枚举有效用户名。当用户名无效时，应用程序发送的服务器响应与用户名有效时不同（"Unable to find an APIDomain" 与 "Wrong email or password"）。 当用户名无效时，服务器响应： "Unable to find an APIDomain for the email [email protected], please...

EUVD-2020-19071

Malware in sbrugna...

EUVD-2020-19072

Malware in sbrugna...

CVE-2020-26526

An issue was discovered in Damstra Smart Asset 2020.7. It is possible to enumerate valid usernames on the login page. The application sends a different server response when the username is invalid than when the username is valid "Unable to find an APIDomain" versus "Wrong email or password"...

CVE-2020-26527

An issue was discovered in API/api/Version in Damstra Smart Asset 2020.7. Cross-origin resource sharing trusts random origins by accepting the arbitrary 'Origin: example.com' header and responding with 200 OK and a wildcard 'Access-Control-Allow-Origin: ' header...

CVE-2020-26527

An issue was discovered in API/api/Version in Damstra Smart Asset 2020.7. Cross-origin resource sharing trusts random origins by accepting the arbitrary 'Origin: example.com' header and responding with 200 OK and a wildcard 'Access-Control-Allow-Origin: ' header...

Cross site scripting

An issue was discovered in API/api/Version in Damstra Smart Asset 2020.7. Cross-origin resource sharing trusts random origins by accepting the arbitrary 'Origin: example.com' header and responding with 200 OK and a wildcard 'Access-Control-Allow-Origin: ' header...

CVE-2020-26525

Damstra Smart Asset 2020.7 has SQL injection via the API/api/Asset originator parameter. This allows forcing the database and server to initiate remote connections to third party DNS servers...

CVE-2020-26526

An issue was discovered in Damstra Smart Asset 2020.7. It is possible to enumerate valid usernames on the login page. The application sends a different server response when the username is invalid than when the username is valid "Unable to find an APIDomain" versus "Wrong email or password"...

CVE-2020-26525

Damstra Smart Asset 2020.7 has SQL injection via the API/api/Asset originator parameter. This allows forcing the database and server to initiate remote connections to third party DNS servers...

Design/Logic Flaw

An issue was discovered in Damstra Smart Asset 2020.7. It is possible to enumerate valid usernames on the login page. The application sends a different server response when the username is invalid than when the username is valid "Unable to find an APIDomain" versus "Wrong email or password"...

Sql injection

Damstra Smart Asset 2020.7 has SQL injection via the API/api/Asset originator parameter. This allows forcing the database and server to initiate remote connections to third party DNS servers...

CVE-2020-26527

An issue was discovered in API/api/Version in Damstra Smart Asset 2020.7. Cross-origin resource sharing trusts random origins by accepting the arbitrary 'Origin: example.com' header and responding with 200 OK and a wildcard 'Access-Control-Allow-Origin: ' header...

CVE-2020-26527

The CVE-2020-26527 entry concerns Damstra Smart Asset 2020.7, specifically the API/api/Version endpoint. The underlying issue is a Cross-Origin Resource Sharing (CORS) misconfiguration where arbitrary origins are trusted by accepting any Origin header and replying with 200 OK and Access-Control-A...

CVE-2020-26526

Technical details about CVE-2020-26526 are not publicly provided in the supplied documents. What is disclosed is the login-page username enumeration issue for Damstra Smart Asset 2020.7. Monitor for updates from vendors/security advisories.

CVE-2020-26526

An issue was discovered in Damstra Smart Asset 2020.7. It is possible to enumerate valid usernames on the login page. The application sends a different server response when the username is invalid than when the username is valid "Unable to find an APIDomain" versus "Wrong email or password"...

CVE-2020-26525

Damstra Smart Asset 2020.7 has SQL injection via the API/api/Asset originator parameter. This allows forcing the database and server to initiate remote connections to third party DNS servers...

CVE-2020-26525

Damstra Smart Asset 2020.7 is affected by a SQL injection in the API endpoint API/Asset originator parameter. The root cause is an SQL injection vulnerability that can cause the database and server to initiate remote connections to third‑party DNS servers. This CVE (CVE-2020-26525) is documented ...