Winstonprivacy Winston
8 CVEs affecting Winstonprivacy Winston. Latest disclosed: 2020-10-28. Critical: 3, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-16259 | Critical | 9.8 | 2020-10-28 | Winston 1.5.4 devices have an SSH user account with access from bastion hosts. This is undocumented in device documents and is not announced to the user. |
CVE-2020-16257 | Critical | 9.8 | 2020-10-28 | Winston 1.5.4 devices are vulnerable to command injection via the API. |
CVE-2020-16263 | Critical | 9.1 | 2020-10-28 | Winston 1.5.4 devices have a CORS configuration that trusts arbitrary origins. This allows requests to be made and viewed by arbitrary origins. |
CVE-2020-16256 | High | 8.8 | 2020-10-28 | The API on Winston 1.5.4 devices is vulnerable to CSRF. |
CVE-2020-16262 | High | 7.8 | 2020-10-28 | Winston 1.5.4 devices have a local www-data user that is overly permissioned, resulting in root privilege escalation. |
CVE-2020-16260 | High | 7.5 | 2020-10-28 | Winston 1.5.4 devices do not enforce authorization. This is exploitable from the intranet, and can be combined with other vulnerabilities for remote exploitati… |
CVE-2020-16258 | High | 7.1 | 2020-10-28 | Winston 1.5.4 devices make use of a Monit service (not managed during the normal user process) which is configured with default credentials. |
CVE-2020-16261 | Medium | 6.8 | 2020-10-28 | Winston 1.5.4 devices allow a U-Boot interrupt, resulting in local root access. |