Advantech WebAccess bwocxrun.ocx OpenUrlToBufferTimeout Information Disclosure Vulnerability

This vulnerability allows remote attackers to access arbitrary files on vulnerable installations of Advantech WebAccess. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Advantech WebAccess bwocxrun.ocx OpenUrlToBuffer Information Disclosure Vulnerability

This vulnerability allows remote attackers to access arbitrary files on vulnerable installations of Advantech WebAccess. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Advantech WebAccess SCADA bwocxrun.ocx Command Execution (CVE-2014-0773)

A command execution vulnerability has been reported in Advantech WebAccess SCADA software. The vulnerability is due to insufficient input validation while parsing the first parameter of the bwocxrun.ocx ActiveX control. A remote, unauthenticated attacker could exploit this vulnerability by entici...

Advantech WebAccess SCADA webvact.ocx NodeName Buffer Overflow (CVE-2014-0764)

A stack buffer overflow has been reported in Advantech's WebAccess SCADA software. This is due to insufficient input validation on the NodeName parameter of the webvact.ocx ActiveX control, a part of the WebAccess Client. A remote, unauthenticated attacker could exploit this vulnerability by...

Advantech WebAccess webvact.ocx AccessCode2 Stack Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Advantech WebAccess. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Advantech WebAccess Multiple Vulnerabilities

Advantech WebAccess is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Advantech WebAccess Version Detection (HTTP)

Detection of Advantech WebAccess. The script sends a connection request to the server and attempts to extract the version number from the reply. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective rig...

Advantech WebAccess odeName2参数处理栈缓冲区溢出漏洞

CVE ID:CVE-2014-0766 Advantech WebAccess HMI/SCADA是一款HMI/SCADA软件。 Advantech WebAccess处理odeName2参数时不正确过滤用户输入，允许远程攻击者利用漏洞提交特殊参数触发基于栈的缓冲区溢出，可使应用程序崩溃或执行任意代码。 0 Advantech WebAccess 7.1 Advantech WebAccess 7.2版本已修复该漏洞，建议用户下载更新： http://webaccess.advantech.com/...

Advantech WebAccess AccessCode参数处理栈缓冲区溢出漏洞

CVE ID:CVE-2014-0767 Advantech WebAccess HMI/SCADA是一款HMI/SCADA软件。 Advantech WebAccess处理AccessCode参数时不正确过滤用户输入，允许远程攻击者利用漏洞提交特殊参数触发基于栈的缓冲区溢出，可使应用程序崩溃或执行任意代码。 0 Advantech WebAccess 7.1 Advantech WebAccess 7.2版本已修复该漏洞，建议用户下载使用： http://webaccess.advantech.com/...

Advantech WebAccess DBVisitor.dll特制SOAP请求SQL注入漏洞

CVE ID:CVE-2014-0763 Advantech WebAccess HMI/SCADA是一款HMI/SCADA软件。 Advantech WebAccess存在一个SQL注入攻击，漏洞是由于SOAP接口公开DBVisitor.dll，允许攻击者利用漏洞提交特制的SOAP请求，注入或操作SQL查询，可获取敏感敏感信息或操作数据库。 0 Advantech WebAccess 7.1 Advantech WebAccess 7.2版本已修复该漏洞，建议用户下载使用： http://webaccess.advantech.com/...

Advantech WebAccess bwocxrun.ocx OpenUrlToBufferTimeout方法任意文件访问漏洞

CVE ID:CVE-2014-0772 Advantech WebAccess HMI/SCADA是一款HMI/SCADA软件。 Advantech WebAccess BWOCXRUN.BwocxrunCtrl.1 ActiveX控件bwocxrun.ocx中的OpenUrlToBufferTimeout方法存在安全漏洞，由于程序不正确对'file://' URL进行校验，允许攻击者访问任意文件。 0 Advantech WebAccess 7.1 Advantech WebAccess 7.2版本已修复该漏洞，建议用户下载使用：...

Advantech WebAccess NodeName参数处理栈缓冲区溢出漏洞

CVE ID:CVE-2014-0764 Advantech WebAccess HMI/SCADA是一款HMI/SCADA软件。 Advantech WebAccess处理NodeName参数时不正确过滤用户输入，允许远程攻击者利用漏洞提交特殊参数触发基于栈的缓冲区溢出，可使应用程序崩溃或执行任意代码。 0 Advantech WebAccess 7.1 Advantech WebAccess 7.2版本已修复该漏洞，建议用户下载使用： http://webaccess.advantech.com/...

Advantech WebAccess Default Credential Check

Binary data scadaadvantechwebaccessdefaultcreds.nbin...

Advantech WebAccess Multiple BWOCXRUN.OCX ActiveX Vulnerabilities

Binary data scadaadvantechbwocxrun1.nbin...

Advantech WebAccess < 7.2-2014.06.06 Multiple Vulnerabilities

Binary data scadaadvantechwebaccess72.nbin...

Advantech WebAccess webvact ActiveX Multiple Buffer Overflow Vulnerabilities

Binary data scadaadvantechwebvactactivex.nbin...

CVE-2014-0763

An attacker using SQL injection may use arguments to construct queries without proper sanitization. The DBVisitor.dll is exposed through SOAP interfaces, and the exposed functions are vulnerable to SOAP injection. This may allow unexpected SQL action and access to records in the table of the...

CVE-2014-0765

To exploit this vulnerability, the attacker sends data from the GotoCmd argument to control. If the value of the argument is overly long, the static stack buffer can be overflowed. This will allow the attacker to execute arbitrary code remotely...

CVE-2014-0772

The BWOCXRUN.BwocxrunCtrl.1 control contains a method named OpenUrlToBufferTimeout. This method takes a URL as a parameter and returns its contents to the caller in JavaScript. The URLs are accessed in the security context of the current browser session. The control does not perform any URL...

CVE-2014-0773

The BWOCXRUN.BwocxrunCtrl.1 control contains a method named “CreateProcess.” This method contains validation to ensure an attacker cannot run arbitrary command lines. After validation, the values supplied in the HTML are passed to the Windows CreateProcessA API. The validation can be bypassed...