PT-2018-17294

Name of the Vulnerable Software and Affected Versions: Green Electronics RainMachine Mini-8 2nd generation Description: The issue concerns the use of the administrator's password hash instead of the password itself for authentication in the time-based one-time-password TOTP function. This allows ...

PT-2018-17814

Name of the Vulnerable Software and Affected Versions Green Electronics RainMachine Mini-8 2nd Generation and Touch HD 12 affected versions not specified Description A persistent Cross Site Scripting XSS issue in the web application allows an attacker to inject arbitrary JavaScript via the REST...

PT-2018-17295

Name of the Vulnerable Software and Affected Versions: Green Electronics RainMachine Mini-8 2nd generation Description: The issue concerns the 'Weather Service' feature, which allows an attacker to inject arbitrary Python code. This is possible via the 'Add new weather data source' upload functio...

PT-2018-17817

Name of the Vulnerable Software and Affected Versions Green Electronics RainMachine Mini-8 2nd Generation and Touch HD 12 affected versions not specified Description A missing X-Frame-Options header in the web application could be used by a remote attacker for clickjacking, as demonstrated by...

PT-2018-17816

Name of the Vulnerable Software and Affected Versions Green Electronics RainMachine Mini-8 2nd Generation and Touch HD 12 affected versions not specified Description An authentication bypass issue exists in the web application, allowing an unauthenticated attacker to perform actions that should...

CVE-2018-6011: Improper Authentication

The time-based one-time-password TOTP function in the application logic of the Green Electronics RainMachine Mini-8 2nd generation uses the administrator's password hash to generate a 6-digit temporary passcode that can be used for remote and local access, aka a "Use of Password Hash Instead of...