Filtered by vendor Winstonprivacy Subscriptions
Filtered by product Winston Firmware Subscriptions
Total 8 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2020-16263 1 Winstonprivacy 2 Winston, Winston Firmware 2024-11-21 9.1 Critical
Winston 1.5.4 devices have a CORS configuration that trusts arbitrary origins. This allows requests to be made and viewed by arbitrary origins.
CVE-2020-16262 1 Winstonprivacy 2 Winston, Winston Firmware 2024-11-21 7.8 High
Winston 1.5.4 devices have a local www-data user that is overly permissioned, resulting in root privilege escalation.
CVE-2020-16261 1 Winstonprivacy 2 Winston, Winston Firmware 2024-11-21 6.8 Medium
Winston 1.5.4 devices allow a U-Boot interrupt, resulting in local root access.
CVE-2020-16260 1 Winstonprivacy 2 Winston, Winston Firmware 2024-11-21 7.5 High
Winston 1.5.4 devices do not enforce authorization. This is exploitable from the intranet, and can be combined with other vulnerabilities for remote exploitation.
CVE-2020-16259 1 Winstonprivacy 2 Winston, Winston Firmware 2024-11-21 9.8 Critical
Winston 1.5.4 devices have an SSH user account with access from bastion hosts. This is undocumented in device documents and is not announced to the user.
CVE-2020-16258 1 Winstonprivacy 2 Winston, Winston Firmware 2024-11-21 7.1 High
Winston 1.5.4 devices make use of a Monit service (not managed during the normal user process) which is configured with default credentials.
CVE-2020-16257 1 Winstonprivacy 2 Winston, Winston Firmware 2024-11-21 9.8 Critical
Winston 1.5.4 devices are vulnerable to command injection via the API.
CVE-2020-16256 1 Winstonprivacy 2 Winston, Winston Firmware 2024-11-21 8.8 High
The API on Winston 1.5.4 devices is vulnerable to CSRF.