Winstonprivacy Security Vulnerabilities

CVE-2020-16260

Winston 1.5.4 devices do not enforce authorization. This is exploitable from the intranet, and can be combined with other vulnerabilities for remote...

CVE-2020-16261

Winston 1.5.4 devices allow a U-Boot interrupt, resulting in local root...

CVE-2020-16263

Winston 1.5.4 devices have a CORS configuration that trusts arbitrary origins. This allows requests to be made and viewed by arbitrary...

CVE-2020-16259

Winston 1.5.4 devices have an SSH user account with access from bastion hosts. This is undocumented in device documents and is not announced to the...

CVE-2020-16262

Winston 1.5.4 devices have a local www-data user that is overly permissioned, resulting in root privilege...

CVE-2020-16258

Winston 1.5.4 devices make use of a Monit service (not managed during the normal user process) which is configured with default...

CVE-2020-16256

The API on Winston 1.5.4 devices is vulnerable to...

CVE-2020-16257

Winston 1.5.4 devices are vulnerable to command injection via the...