TI-2020-12787 CVE-2020-16259 · GHSA-x7xx-38x8-pxv5
Winston 1.5.4 devices have an SSH user account with access from bastion hosts.
Priority MEDIUM 46
Winston 1.5.4 devices have an SSH user account with access from bastion hosts.
Vulnerabilities
8 records
TI-2020-12786 CVE-2020-16258 · GHSA-jcj3-v9q6-fvg4
Winston 1.5.4 devices make use of a Monit service (not managed during the normal user…
Priority LOW 31
Winston 1.5.4 devices make use of a Monit service (not managed during the normal user process) which is configured with default credentials.
TI-2020-12788 CVE-2020-16260 · GHSA-xhmw-9xf2-ph22
Winston 1.5.4 devices do not enforce authorization.
Priority LOW 35
Winston 1.5.4 devices do not enforce authorization.
TI-2020-12791 CVE-2020-16263 · GHSA-5hj6-wm8r-gqj8
Winston 1.5.4 devices have a CORS configuration that trusts arbitrary origins.
Priority MEDIUM 42
Winston 1.5.4 devices have a CORS configuration that trusts arbitrary origins.
TI-2020-12790 CVE-2020-16262 · GHSA-v3mr-gg23-hh87
Winston 1.5.4 devices have a local www-data user that is overly permissioned, resulting in root privilege escalation.
Priority LOW 34
Winston 1.5.4 devices have a local www-data user that is overly permissioned, resulting in root privilege escalation.
TI-2020-12789 CVE-2020-16261 · GHSA-8gwv-wgm9-cqj9
Winston 1.5.4 devices allow a U-Boot interrupt, resulting in local root access.
Priority LOW 31
Winston 1.5.4 devices allow a U-Boot interrupt, resulting in local root access.
TI-2020-12784 CVE-2020-16256 · GHSA-xx9g-fvg8-hmfw
The API on Winston 1.5.4 devices is vulnerable to CSRF.
Priority LOW 39
The API on Winston 1.5.4 devices is vulnerable to CSRF.
TI-2020-12785 CVE-2020-16257 · GHSA-3p3p-pvm7-cggr
Winston 1.5.4 devices are vulnerable to command injection via the API.
Priority MEDIUM 48
Winston 1.5.4 devices are vulnerable to command injection via the API.