534 matches found
CVE-2020-16260
Winston 1.5.4 devices do not enforce authorization. This is exploitable from the intranet, and can be combined with other vulnerabilities for remote exploitation...
CVE-2020-16259
Winston 1.5.4 devices have an SSH user account with access from bastion hosts. This is undocumented in device documents and is not announced to the user...
CVE-2020-16258
Winston 1.5.4 devices make use of a Monit service not managed during the normal user process which is configured with default credentials...
CVE-2020-16256
The API on Winston 1.5.4 devices is vulnerable to CSRF...
MAL-2025-2433 Malicious code in winston-js (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b9a7a8915407cab1038d31144af0dc322ca271f4ddcd30cbf0e040dccc9b7dca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in winston-js (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b9a7a8915407cab1038d31144af0dc322ca271f4ddcd30cbf0e040dccc9b7dca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-3958 Malicious code in winston-nelo2 (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in winston-nelo2 (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2022-7152 Malicious code in winston-pg-native (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c5ce4395f11e08aabe826bbeccb1004202503971e7d29e5d42730ce51f7f44b3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in winston-pg-native (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c5ce4395f11e08aabe826bbeccb1004202503971e7d29e5d42730ce51f7f44b3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Winston Command Injection (CVE-2020-16257)
A command injection vulnerability exists in Winston. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...
Winston Cross Site Request Forgery (CVE-2020-16256)
A cross site request forgery vulnerability exists in Winston. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...
Winston Privacy Elevation of Privilege Vulnerability
Winston Privacy is a hardware VPN device from the American company Winston Privacy. Winston version 1.5.4 suffers from an elevation of privilege vulnerability that stems from the device having an over-authorized local www-data user, resulting in root privilege escalation. No detailed vulnerabilit...
CVE-2020-16260
Winston 1.5.4 devices do not enforce authorization. This is exploitable from the intranet, and can be combined with other vulnerabilities for remote exploitation...
CVE-2020-16260
Winston 1.5.4 devices do not enforce authorization. This is exploitable from the intranet, and can be combined with other vulnerabilities for remote exploitation...
CVE-2020-16261
Winston 1.5.4 devices allow a U-Boot interrupt, resulting in local root access...
CVE-2020-16259
Winston 1.5.4 devices have an SSH user account with access from bastion hosts. This is undocumented in device documents and is not announced to the user...
CVE-2020-16261
Winston 1.5.4 devices allow a U-Boot interrupt, resulting in local root access...