CVE-2020-16257

Winston 1.5.4 devices are vulnerable to command injection via the API...

CVE-2020-16257

Winston 1.5.4 devices are vulnerable to command injection via the API...

Command injection

Winston 1.5.4 devices are vulnerable to command injection via the API...

CVE-2020-16263

Technical details about CVE-2020-16263 are not publicly available in the provided documents. Monitor for updates from vendors and security advisories to obtain affected products, root cause, impact, and remediation information.

CVE-2020-16262

The CVE-2020-16262 entry concerns Winston 1.5.4 devices with a misconfigured local www-data user that has excessive permissions. This results in root privilege escalation via local access. The available connected documents confirm the affected product/version and the root-cause (over-authorized l...

CVE-2020-16262

Winston 1.5.4 devices have a local www-data user that is overly permissioned, resulting in root privilege escalation...

CVE-2020-16261

Winston 1.5.4 devices allow a U-Boot interrupt, resulting in local root access...

CVE-2020-16261

CVE-2020-16261 affects Winston 1.5.4 devices. The vulnerability arises from a U-Boot interrupt that can grant local root access, indicating a component/root-cause issue at boot-time or firmware control paths. The available sources describe the impact as local root access with confidentiality, int...

CVE-2020-16256

The CVE-2020-16256 entry concerns Winston 1.5.4: the API is vulnerable to cross-site request forgery (CSRF). The related advisory notes that successful exploitation could allow a remote attacker to execute arbitrary commands on the affected system. The Red Hat entry also reiterates CSRF as the is...

CVE-2020-16256

The API on Winston 1.5.4 devices is vulnerable to CSRF...

CVE-2020-16257

The CVE relates to Winston 1.5.4 devices, where the API is vulnerable to command injection. The issue is driven by a vulnerability in the API surface that allows remote command execution, with CVSSv3 scores indicating high impact (Base 9.8) across confidentiality, integrity, and availability. Con...

CVE-2020-16257

Winston 1.5.4 devices are vulnerable to command injection via the API...

winstonwachter.inventory.gallery Cross Site Scripting vulnerability OBB-1401972

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

winston.com XSS vulnerability

Open Bug Bounty ID: OBB-466986 Description| Value ---|--- Affected Website:| winston.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat Sheet...