CVE-2016-0860

CVE-2016-0860 describes a buffer overflow in the BwpAlarm subsystem of Advantech WebAccess prior to 8.1, allowing remote attackers to cause a denial of service via a crafted RPC request. Public docs confirm the affected product (Advantech WebAccess), version before 8.1, and remote-execution/DoS r...

CVE-2015-3947

SQL injection vulnerability in Advantech WebAccess before 8.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors...

CVE-2016-0855

CVE-2016-0855 concerns Advantech WebAccess (pre-8.1). The vulnerability is a directory traversal in the WebAccess Dashboard/Viewer that could allow remote attackers to list arbitrary files in a virtual directory via unspecified vectors. Public references from ZDI describe related dashboard viewer...

CVE-2015-3946

CVE-2015-3946 (Advantech WebAccess) : A CSRF vulnerability exists in WebAccess prior to version 8.1 that can allow remote attackers to hijack user authentication. Affected product: Advantech WebAccess (HMI/SCADA software). Root cause: cross-site request forgery enabling unauthorized actions in au...

CVE-2015-3948

Summary : CVE-2015-3948 is a cross-site scripting (XSS) vulnerability in Advantech WebAccess prior to 8.1. The issue allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. According to NVD, the CVSS base score (v3) is 5.4 (Medium) with network access, lo...

CVE-2016-0859

Integer overflow in the Kernel service in Advantech WebAccess before 8.1 allows remote attackers to execute arbitrary code or cause a denial of service stack-based buffer overflow via a crafted RPC request...

CVE-2016-0860

Buffer overflow in the BwpAlarm subsystem in Advantech WebAccess before 8.1 allows remote attackers to cause a denial of service via a crafted RPC request...

CVE-2016-0856

Multiple stack-based buffer overflows in Advantech WebAccess before 8.1 allow remote attackers to execute arbitrary code via unspecified vectors...

CVE-2015-3943

Advantech WebAccess before 8.1 allows remote attackers to read sensitive cleartext information about e-mail project accounts via unspecified vectors...

CVE-2015-6467

Advantech WebAccess before 8.1 allows remote attackers to execute arbitrary code via vectors involving a browser plugin...

CVE-2015-3947

Advantech WebAccess (before 8.1) is affected by a SQL Injection vulnerability (CWE-89) that allows remote authenticated users to execute arbitrary SQL commands, potentially modifying web server settings, accounts, and projects. Root cause details are described in PT-2016-03: SQL Injection in WebA...

CVE-2016-0853: Exposure of Sensitive Information to an Unauthorized Actor

Advantech WebAccess before 8.1 allows remote attackers to obtain sensitive information via crafted input...

CVE-2015-6467: Undefined Security Weakness

Advantech WebAccess before 8.1 allows remote attackers to execute arbitrary code via vectors involving a browser plugin...

CVE-2016-0860: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in the BwpAlarm subsystem in Advantech WebAccess before 8.1 allows remote attackers to cause a denial of service via a crafted RPC request...

CVE-2016-0854: Undefined Security Weakness

Unrestricted file upload vulnerability in the uploadImageCommon function in the UploadAjaxAction script in the WebAccess Dashboard Viewer in Advantech WebAccess before 8.1 allows remote attackers to write to files of arbitrary types via unspecified vectors...

CVE-2015-3947: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Advantech WebAccess before 8.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors...

CVE-2016-0859: Undefined Security Weakness

Integer overflow in the Kernel service in Advantech WebAccess before 8.1 allows remote attackers to execute arbitrary code or cause a denial of service stack-based buffer overflow via a crafted RPC request...

CVE-2016-0856: Improper Restriction of Operations within the Bounds of a Memory Buffer

Multiple stack-based buffer overflows in Advantech WebAccess before 8.1 allow remote attackers to execute arbitrary code via unspecified vectors...

CVE-2015-3946: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in Advantech WebAccess before 8.1 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

CVE-2016-0855: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in Advantech WebAccess before 8.1 allows remote attackers to list arbitrary virtual-directory files via unspecified vectors...