Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple stack-based buffer overflow vulnerabilities exist caused by a lack of proper validation of the length of user-supplied data, which may allow remote code...
9.8CVSS
9.9AI Score
0.082EPSS
Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple relative path traversal vulnerabilities exist that may allow a low privilege user to overwrite files outside the application’s...
8.8CVSS
8.8AI Score
0.01EPSS
An attacker could use a specially crafted URL to delete or read files outside the WebAccess/NMS's (versions prior to 3.0.2)...
9.8CVSS
9.2AI Score
0.015EPSS
WebAccess/NMS (versions prior to 3.0.2) allows an unauthenticated remote user to create a new admin...
9.8CVSS
9.4AI Score
0.009EPSS
Multiple vulnerabilities could allow an attacker with low privileges to perform SQL injection on WebAccess/NMS (versions prior to 3.0.2) to gain access to sensitive...
6.5CVSS
7.1AI Score
0.003EPSS
An attacker could use a specially crafted URL to delete files outside the WebAccess/NMS's (versions prior to 3.0.2)...
9.1CVSS
9AI Score
0.017EPSS
There are multiple ways an unauthenticated attacker could perform SQL injection on WebAccess/NMS (versions prior to 3.0.2) to gain access to sensitive...
7.5CVSS
7.9AI Score
0.005EPSS
WebAccess/NMS (versions prior to 3.0.2) does not sanitize XML input. Specially crafted XML input could allow an attacker to read sensitive...
7.5CVSS
7.3AI Score
0.007EPSS
WebAccess/NMS (versions prior to 3.0.2) does not properly sanitize user input and may allow an attacker to inject system commands...
8.8CVSS
8.7AI Score
0.003EPSS
Multiple issues exist that allow files to be uploaded and executed on the WebAccess/NMS (versions prior to...
9.8CVSS
9.2AI Score
0.006EPSS
Advantech WebAccess 8.3.4 does not properly restrict an RPC call that allows unauthenticated, remote users to read files. An attacker can use this vulnerability to recover the administrator...
7.5CVSS
7.4AI Score
0.004EPSS
In Advantech WebAccess, Versions 8.4.2 and prior. A stack-based buffer overflow vulnerability caused by a lack of proper validation of the length of user-supplied data may allow remote code...
8.8CVSS
9AI Score
0.006EPSS
Advantech WebAccess before 8.4.3 allows unauthenticated remote attackers to execute arbitrary code or cause a denial of service (memory corruption) due to a stack-based buffer overflow when handling IOCTL 70533 RPC...
9.8CVSS
9.9AI Score
0.017EPSS
7.5CVSS
7.5AI Score
0.002EPSS
Advantech WebAccess/HMI Designer 2.1.9.31 has Exception Handler Chain corruption starting at Unknown Symbol @ 0x0000000000000000 called from...
7.5CVSS
7.7AI Score
0.002EPSS
In Advantech WebAccess/HMI Designer 2.1.9.31, Data from a Faulting Address controls Code Flow starting at...
7.5CVSS
7.6AI Score
0.002EPSS
In WebAccess versions 8.4.1 and prior, multiple stack-based buffer overflow vulnerabilities are caused by a lack of proper validation of the length of user-supplied data. Exploitation of these vulnerabilities may allow remote code...
8.8CVSS
9.3AI Score
0.02EPSS
In WebAccess versions 8.4.1 and prior, an exploit executed over the network may cause improper control of generation of code, which may allow remote code execution, data exfiltration, or cause a system...
9.8CVSS
9.6AI Score
0.011EPSS
In WebAccess versions 8.4.1 and prior, multiple command injection vulnerabilities are caused by a lack of proper validation of user-supplied data and may allow arbitrary file deletion and remote code...
8.8CVSS
9.3AI Score
0.01EPSS
In WebAccess, versions 8.4.1 and prior, an improper authorization vulnerability may allow an attacker to disclose sensitive information, cause improper control of generation of code, which may allow remote code execution or cause a system...
9.8CVSS
9.6AI Score
0.008EPSS
Stack-based buffer overflow in Advantech WebAccess/SCADA 8.4.1 allows a remote, unauthenticated attacker to execute arbitrary code via a crafted IOCTL 70603 RPC...
9.8CVSS
9.8AI Score
0.021EPSS
In Advantech WebAccess HMI Designer Version 2.1.9.23 and prior, processing specially crafted MCR files lacking proper validation of user supplied data may cause the system to write outside the intended buffer area, allowing remote code...
8.8CVSS
9AI Score
0.009EPSS
In WebAccess/SCADA, Versions 8.3.5 and prior, a path traversal vulnerability is caused by a lack of proper validation of a user-supplied path prior to use in file operations. An attacker can leverage this vulnerability to delete files while posing as an...
9.1CVSS
9.1AI Score
0.009EPSS
In WebAccess/SCADA Versions 8.3.5 and prior, multiple heap-based buffer overflow vulnerabilities are caused by a lack of proper validation of the length of user-supplied data. Exploitation of these vulnerabilities may allow remote code execution. Note: A different vulnerability than...
9.8CVSS
10AI Score
0.075EPSS
In WebAccess/SCADA, Versions 8.3.5 and prior, multiple stack-based buffer overflow vulnerabilities are caused by a lack of proper validation of the length of user-supplied data. Exploitation of these vulnerabilities may allow remote code...
9.8CVSS
10AI Score
0.075EPSS
In WebAccess/SCADA Versions 8.3.5 and prior, multiple untrusted pointer dereference vulnerabilities may allow a remote attacker to execute arbitrary...
9.8CVSS
9.6AI Score
0.061EPSS
In WebAccess/SCADA Versions 8.3.5 and prior, an out-of-bounds read vulnerability is caused by a lack of proper validation of user-supplied data. Exploitation of this vulnerability may allow disclosure of...
7.5CVSS
7.3AI Score
0.005EPSS
In WebAccess/SCADA Versions 8.3.5 and prior, multiple out-of-bounds write vulnerabilities are caused by a lack of proper validation of the length of user-supplied data. Exploitation of these vulnerabilities may allow remote code...
8.8CVSS
9.2AI Score
0.061EPSS
Stack-based buffer overflow in Advantech WebAccess/SCADA 8.4.0 allows a remote, unauthenticated attacker to execute arbitrary code by sending a crafted IOCTL 81024 RPC...
9.8CVSS
9.7AI Score
0.021EPSS
Stack-based buffer overflow in Advantech WebAccess/SCADA 8.4.0 allows a remote, unauthenticated attacker to execute arbitrary code by sending a crafted IOCTL 10012 RPC...
9.8CVSS
9.8AI Score
0.021EPSS
Unauthenticated reflected cross-site scripting (XSS) exists in Zarafa Webapp 2.0.1.47791 and earlier. NOTE: this is a discontinued product. The issue was fixed in later Zarafa Webapp versions; however, some former Zarafa Webapp customers use the related Kopano product...
6.1CVSS
5.9AI Score
0.001EPSS
Advantech WebAccess 8.3.4 allows unauthenticated, remote attackers to delete arbitrary files via IOCTL 10005...
7.5CVSS
7.6AI Score
0.009EPSS
Advantech WebAccess 8.3.4 is vulnerable to file upload attacks via unauthenticated RPC call. An unauthenticated, remote attacker can use this vulnerability to execute arbitrary...
9.8CVSS
9.7AI Score
0.008EPSS
Advantech WebAccess/SCADA, Versions 8.3.5 and prior. An improper access control vulnerability may allow an attacker to cause a denial-of-service...
7.5CVSS
7.3AI Score
0.018EPSS
Advantech WebAccess/SCADA, Versions 8.3.5 and prior. Multiple stack-based buffer overflow vulnerabilities, caused by a lack of proper validation of the length of user-supplied data, may allow remote code...
9.8CVSS
9.8AI Score
0.044EPSS
Advantech WebAccess/SCADA, Versions 8.3.5 and prior. Multiple command injection vulnerabilities, caused by a lack of proper validation of user-supplied data, may allow remote code...
9.8CVSS
10AI Score
0.005EPSS
WebAccess/SCADA, Version 8.3. An improper authentication vulnerability exists that could allow a possible authentication bypass allowing an attacker to upload malicious...
9.8CVSS
9.5AI Score
0.002EPSS
WebAccess/SCADA, Version 8.3. Specially crafted requests could allow a possible authentication bypass that could allow an attacker to obtain and manipulate sensitive...
8.6CVSS
8.9AI Score
0.001EPSS
WebAccess/SCADA, Version 8.3. The software does not properly sanitize its inputs for SQL...
9.8CVSS
9.7AI Score
0.002EPSS
WebAccess/SCADA, WebAccess/SCADA Version 8.3.2 installed on Windows 2008 R2 SP1. Lack of proper validation of user supplied input may allow an attacker to cause the overflow of a buffer on the...
7.3CVSS
7.3AI Score
0.003EPSS
WADashboard API in Advantech WebAccess 8.3.1 and 8.3.2 allows remote authenticated attackers to write or overwrite any file on the filesystem due to a directory traversal vulnerability in the writeFile API. An attacker can use this vulnerability to remotely execute arbitrary...
6.5CVSS
6.5AI Score
0.007EPSS
Advantech WebAccess 8.3.1 and 8.3.2 are vulnerable to cross-site scripting in the Bwmainleft.asp page. An attacker could leverage this vulnerability to disclose credentials amongst other...
5.4CVSS
5.5AI Score
0.003EPSS
WADashboard API in Advantech WebAccess 8.3.1 and 8.3.2 allows remote authenticated attackers to read any file on the filesystem due to a directory traversal vulnerability in the readFile...
6.5CVSS
6.1AI Score
0.004EPSS
WebAccess Versions 8.3.2 and prior. The application fails to properly validate the length of user-supplied data, causing a buffer overflow condition that allows for arbitrary remote code...
7.8CVSS
8.1AI Score
0.06EPSS
WebAccess Versions 8.3.2 and prior. During installation, the application installer disables user access control and does not re-enable it after the installation is complete. This could allow an attacker to run elevated arbitrary...
7.8CVSS
7.5AI Score
0.001EPSS
Advantech WebAccess 8.3.1 and earlier has a path traversal vulnerability which may allow an attacker to execute arbitrary...
9.8CVSS
9.6AI Score
0.016EPSS
Advantech WebAccess 8.3.1 and earlier has a .dll component that is susceptible to external control of file name or path vulnerability, which may allow an arbitrary file deletion when...
7.5CVSS
7.5AI Score
0.013EPSS
Advantech WebAccess 8.3.1 and earlier has several stack-based buffer overflow vulnerabilities that have been identified, which may allow an attacker to execute arbitrary...
9.8CVSS
10AI Score
0.074EPSS
Advantech WebAccess 8.3.1 and earlier has an improper privilege management vulnerability, which may allow an attacker to access those files and perform actions at a system administrator...
7.8CVSS
7.5AI Score
0.001EPSS
Advantech WebAccess 8.3.2 and below is vulnerable to multiple reflected cross site scripting vulnerabilities. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim to supply malicious HTML or JavaScript code to WebAccess, which is then reflected back...
6.1CVSS
6.3AI Score
0.004EPSS