CVE-2020-16260

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Winston 1.5.4 devices do not enforce authorization. This is exploitable from the intranet, and can be combined with other vulnerabilities for remote exploitation.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Oct 28, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-162616.8Winston 1.5.4 devices allow a U-Boot interrupt, resulting in local root access.CVE-2020-162627.8Winston 1.5.4 devices have a local www-data user that is overly permissioned, resulting in root privilege escalation.CVE-2020-162639.1Winston 1.5.4 devices have a CORS configuration that trusts arbitrary origins. This allows requests to be made and viewed by arbitrary origiCVE-2020-162665.4An XSS issue was discovered in MantisBT before 2.24.2. Improper escaping on view_all_bug_page.php allows a remote attacker to inject arbitraCVE-2020-162678.8Zoho ManageEngine Applications Manager version 14740 and prior allows an authenticated SQL Injection via a crafted jsp request in the RCA moCVE-2020-162688.8The MSI installer in 1E Client 4.1.0.267 and 5.0.0.745 allows remote authenticated users and local users to gain elevated privileges via theCVE-2020-162695.5radare2 4.5.0 misparses DWARF information in executable files, causing a segmentation fault in parse_typedef in type_dwarf.c via a malformedCVE-2020-16277.5A vulnerability in Juniper Networks Junos OS on vMX and MX150 devices may allow an attacker to cause a Denial of Service (DoS) by sending spCVE-2020-162706.1OLIMPOKS under 3.3.39 allows Auth/Admin ErrorMessage XSS. Remote Attacker can use discovered vulnerability to inject malicious JavaScript paCVE-2020-162719.1The SRP-6a implementation in Kee Vault KeePassRPC before 1.12.0 generates insufficiently random numbers, which allows remote attackers to reCVE-2020-162729.1The SRP-6a implementation in Kee Vault KeePassRPC before 1.12.0 is missing validation for a client-provided parameter, which allows remote aCVE-2020-162737.8In Arm software implementing the Armv8-M processors (all versions), the stack selection mechanism could be influenced by a stack-underflow a
CVE-2020-16260: High severity, CVSS 7.5 | Vulnix