CVE-2020-26526

Technical details about CVE-2020-26526 are not publicly provided in the supplied documents. What is disclosed is the login-page username enumeration issue for Damstra Smart Asset 2020.7. Monitor for updates from vendors/security advisories.

CVE-2020-26525

Damstra Smart Asset 2020.7 is affected by a SQL injection in the API endpoint API/Asset originator parameter. The root cause is an SQL injection vulnerability that can cause the database and server to initiate remote connections to third‑party DNS servers. This CVE (CVE-2020-26525) is documented ...

CVE-2020-26527

The CVE-2020-26527 entry concerns Damstra Smart Asset 2020.7, specifically the API/api/Version endpoint. The underlying issue is a Cross-Origin Resource Sharing (CORS) misconfiguration where arbitrary origins are trusted by accepting any Origin header and replying with 200 OK and Access-Control-A...