CVE-2020-16260

The provided documents describe CVE-2020-16260 affecting Winston 1.5.4 devices, where authorization is not enforced. The vulnerability is indicated as exploitable from the intranet and capable of being combined with other vulnerabilities for remote exploitation. The descriptions do not specify ex...

CVE-2020-16257

Winston 1.5.4 devices are vulnerable to command injection via the API...

CVE-2020-16257

Winston 1.5.4 devices are vulnerable to command injection via the API...

Command injection

Winston 1.5.4 devices are vulnerable to command injection via the API...

CVE-2020-16263

Technical details about CVE-2020-16263 are not publicly available in the provided documents. Monitor for updates from vendors and security advisories to obtain affected products, root cause, impact, and remediation information.

CVE-2020-16262

The CVE-2020-16262 entry concerns Winston 1.5.4 devices with a misconfigured local www-data user that has excessive permissions. This results in root privilege escalation via local access. The available connected documents confirm the affected product/version and the root-cause (over-authorized l...

CVE-2020-16262

Winston 1.5.4 devices have a local www-data user that is overly permissioned, resulting in root privilege escalation...

CVE-2020-16261

CVE-2020-16261 affects Winston 1.5.4 devices. The vulnerability arises from a U-Boot interrupt that can grant local root access, indicating a component/root-cause issue at boot-time or firmware control paths. The available sources describe the impact as local root access with confidentiality, int...

CVE-2020-16261

Winston 1.5.4 devices allow a U-Boot interrupt, resulting in local root access...

CVE-2020-16256

The CVE-2020-16256 entry concerns Winston 1.5.4: the API is vulnerable to cross-site request forgery (CSRF). The related advisory notes that successful exploitation could allow a remote attacker to execute arbitrary commands on the affected system. The Red Hat entry also reiterates CSRF as the is...

CVE-2020-16256

The API on Winston 1.5.4 devices is vulnerable to CSRF...

CVE-2020-16257

Winston 1.5.4 devices are vulnerable to command injection via the API...

CVE-2020-16257

The CVE relates to Winston 1.5.4 devices, where the API is vulnerable to command injection. The issue is driven by a vulnerability in the API surface that allows remote command execution, with CVSSv3 scores indicating high impact (Base 9.8) across confidentiality, integrity, and availability. Con...

winstonwachter.inventory.gallery Cross Site Scripting vulnerability OBB-1401972

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

winston.com XSS vulnerability

Open Bug Bounty ID: OBB-466986 Description| Value ---|--- Affected Website:| winston.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat Sheet...