TI-2020-12785 CVE-2020-16257 · GHSA-3p3p-pvm7-cggr
Winston 1.5.4 devices are vulnerable to command injection via the API.
Priority MEDIUM 48
Winston 1.5.4 devices are vulnerable to command injection via the API.
Winstonprivacy
Records8All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical3CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9
Exploited now
Winstonprivacy records in CISA KEVNo Winstonprivacy vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
8 records
TI-2020-12787 CVE-2020-16259 · GHSA-x7xx-38x8-pxv5
Winston 1.5.4 devices have an SSH user account with access from bastion hosts.
Priority MEDIUM 46
Winston 1.5.4 devices have an SSH user account with access from bastion hosts.
TI-2020-12791 CVE-2020-16263 · GHSA-5hj6-wm8r-gqj8
Winston 1.5.4 devices have a CORS configuration that trusts arbitrary origins.
Priority MEDIUM 42
Winston 1.5.4 devices have a CORS configuration that trusts arbitrary origins.
TI-2020-12784 CVE-2020-16256 · GHSA-xx9g-fvg8-hmfw
The API on Winston 1.5.4 devices is vulnerable to CSRF.
Priority LOW 39
The API on Winston 1.5.4 devices is vulnerable to CSRF.
TI-2020-12788 CVE-2020-16260 · GHSA-xhmw-9xf2-ph22
Winston 1.5.4 devices do not enforce authorization.
Priority LOW 35
Winston 1.5.4 devices do not enforce authorization.
TI-2020-12790 CVE-2020-16262 · GHSA-v3mr-gg23-hh87
Winston 1.5.4 devices have a local www-data user that is overly permissioned, resulting in root privilege escalation.
Priority LOW 34
Winston 1.5.4 devices have a local www-data user that is overly permissioned, resulting in root privilege escalation.
TI-2020-12789 CVE-2020-16261 · GHSA-8gwv-wgm9-cqj9
Winston 1.5.4 devices allow a U-Boot interrupt, resulting in local root access.
Priority LOW 31
Winston 1.5.4 devices allow a U-Boot interrupt, resulting in local root access.
TI-2020-12786 CVE-2020-16258 · GHSA-jcj3-v9q6-fvg4
Winston 1.5.4 devices make use of a Monit service (not managed during the normal user…
Priority LOW 31
Winston 1.5.4 devices make use of a Monit service (not managed during the normal user process) which is configured with default credentials.