Ewon_cosy_firmware - Vulncode-DB

Repositories	Unknown: This might be proprietary software.
#Vulnerabilities	2

Date	Id	Summary	Products	Score	Patch	Annotated
2020-09-18	CVE-2020-16230	All version of Ewon Flexy and Cosy prior to 14.1 use wildcards such as (*) under which domains can request resources. An attacker with local access and high privileges could inject scripts into the Cross-origin Resource Sharing (CORS) configuration that could abuse this vulnerability, allowing the attacker to retrieve limited confidential information through sniffing.	Ewon_cosy_firmware, Ewon_flexy_firmware	2.3
2020-04-08	CVE-2020-10633	A non-persistent XSS (cross-site scripting) vulnerability exists in eWON Flexy and Cosy (all firmware versions prior to 14.1s0). An attacker could send a specially crafted URL to initiate a password change for the device. The target must introduce the credentials to the gateway before the attack can be successful.	Ewon_cosy_firmware, Ewon_flexy_firmware	N/A