535 matches found
CVE-2020-16262
Winston 1.5.4 devices have a local www-data user that is overly permissioned, resulting in root privilege escalation...
CVE-2020-16259
Winston 1.5.4 devices have an SSH user account with access from bastion hosts. This is undocumented in device documents and is not announced to the user...
CVE-2020-16263
Winston 1.5.4 devices have a CORS configuration that trusts arbitrary origins. This allows requests to be made and viewed by arbitrary origins...
CVE-2020-16262
Winston 1.5.4 devices have a local www-data user that is overly permissioned, resulting in root privilege escalation...
CVE-2020-16256
The API on Winston 1.5.4 devices is vulnerable to CSRF...
CVE-2020-16258
Winston 1.5.4 devices make use of a Monit service not managed during the normal user process which is configured with default credentials...
CVE-2020-16256
The API on Winston 1.5.4 devices is vulnerable to CSRF...
CVE-2020-16258
Winston 1.5.4 devices make use of a Monit service not managed during the normal user process which is configured with default credentials...
Design/Logic Flaw
Winston 1.5.4 devices allow a U-Boot interrupt, resulting in local root access...
Default credentials
Winston 1.5.4 devices make use of a Monit service not managed during the normal user process which is configured with default credentials...
Authorization
Winston 1.5.4 devices do not enforce authorization. This is exploitable from the intranet, and can be combined with other vulnerabilities for remote exploitation...
Design/Logic Flaw
Winston 1.5.4 devices have a CORS configuration that trusts arbitrary origins. This allows requests to be made and viewed by arbitrary origins...
Privilege escalation
Winston 1.5.4 devices have a local www-data user that is overly permissioned, resulting in root privilege escalation...
Cross site request forgery (csrf)
The API on Winston 1.5.4 devices is vulnerable to CSRF...
Design/Logic Flaw
Winston 1.5.4 devices have an SSH user account with access from bastion hosts. This is undocumented in device documents and is not announced to the user...
CVE-2020-16259
Affected product: Winston 1.5.4 devices. Issue: an SSH user account is accessible from bastion hosts, described as undocumented and not announced to users. This root cause enables full compromises of confidentiality, integrity, and availability per CVSS 3.1/5.0? (from the CVE data: attacker could...
CVE-2020-16259
Winston 1.5.4 devices have an SSH user account with access from bastion hosts. This is undocumented in device documents and is not announced to the user...
CVE-2020-16258
Winston 1.5.4 devices make use of a Monit service not managed during the normal user process which is configured with default credentials...
CVE-2020-16258
Winston 1.5.4 devices expose a Monit service that is not managed during the normal user process and is configured with default credentials. This creates a local-access vulnerability with potential partial confidentiality loss and complete availability impact, as indicated by CVSS metrics. The doc...