CVE-2018-15705

WADashboard API in Advantech WebAccess 8.3.1 and 8.3.2 allows remote authenticated attackers to write or overwrite any file on the filesystem due to a directory traversal vulnerability in the writeFile API. An attacker can use this vulnerability to remotely execute arbitrary code...

CVE-2018-15707

Advantech WebAccess 8.3.1 and 8.3.2 are vulnerable to cross-site scripting in the Bwmainleft.asp page. An attacker could leverage this vulnerability to disclose credentials amongst other things...

CVE-2018-15706

WADashboard API in Advantech WebAccess 8.3.1 and 8.3.2 allows remote authenticated attackers to read any file on the filesystem due to a directory traversal vulnerability in the readFile API...

CVE-2018-15707

Advantech WebAccess 8.3.1/8.3.2 are affected by a Bwmainleft.asp cross-site scripting vulnerability (CVE-2018-15707). The XSS can disclose credentials among other data. Connected sources include exploit listings and writeups illustrating the vulnerability and, in at least one reference, that user...

CVE-2018-15705: Improper Limitation of a Pathname to a Restricted Directory

WADashboard API in Advantech WebAccess 8.3.1 and 8.3.2 allows remote authenticated attackers to write or overwrite any file on the filesystem due to a directory traversal vulnerability in the writeFile API. An attacker can use this vulnerability to remotely execute arbitrary code...

CVE-2018-15706: Improper Limitation of a Pathname to a Restricted Directory

WADashboard API in Advantech WebAccess 8.3.1 and 8.3.2 allows remote authenticated attackers to read any file on the filesystem due to a directory traversal vulnerability in the readFile API...

CVE-2018-15707: Improper Neutralization of Input During Web Page Generation

Advantech WebAccess 8.3.1 and 8.3.2 are vulnerable to cross-site scripting in the Bwmainleft.asp page. An attacker could leverage this vulnerability to disclose credentials amongst other things...

PT-2018-13156

Name of the Vulnerable Software and Affected Versions Advantech WebAccess versions 8.3.1 through 8.3.2 Description The issue allows remote authenticated attackers to write or overwrite any file on the filesystem due to a directory traversal vulnerability in the writeFile API endpoint. This can be...

PT-2018-3084

Name of the Vulnerable Software and Affected Versions Advantech WebAccess versions 8.3.1 through 8.3.2 Description The issue concerns a directory traversal vulnerability in the readFile API of the WADashboard component. This vulnerability allows remote authenticated attackers to read any file on...

Advantech WebAccess Client bwswfcfg Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Advantech WebAccess Client. Authentication is not required to exploit this vulnerability. The specific flaw exists within bwswfcfg.exe, which is accessed through the 0x2711 IOCTL in the webvrpcs...

Advantech WebAccess Node Improper Access Control Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on vulnerable installations of Advantech WebAccess Node. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the access...

PT-2018-14263

Name of the Vulnerable Software and Affected Versions Advantech WebAccess versions 8.3.2 and prior Description The issue arises from the application's failure to properly validate the length of user-supplied data, leading to a buffer overflow condition. This condition allows for arbitrary remote...

Advantech WebAccess Improper Access Control Vulnerability

Advantech WebAccess software is the core of Advantech's IoT application platform solution, providing users with a user interface based on HTML5 technology for a cross-platform, cross-browser data access experience. An improper access control vulnerability exists in Advantech WebAccess. The...

Advantech WebAccess Node Product Installation File Access Control Modification Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on vulnerable installations of Advantech WebAccess Node. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the acces...

Advantech WebAccess

1. EXECUTIVE SUMMARY CVSS v3 8.4 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Advantech Equipment: WebAccess Vulnerabilities: Improper Access Control, Stack-based Buffer Overflow 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow for arbitrary...

Advantech WebAccess Arbitrary File Deletion Vulnerability

Advantech WebAccess is a set of HMI/SCADA software from Advantech based on browser architecture. The software supports dynamic graphic display and real-time data control, and provides remote control and management of automation equipment. The .dll is one of the dynamic link library components. A...

Advantech WebAccess path traversal vulnerability (CNVD-2018-21791)

Advantech WebAccess is a set of HMI/SCADA software from Advantech based on browser architecture. The software supports dynamic graphic display and real-time data control, and provides remote control and management of automation equipment. A path traversal vulnerability exists in Advantech WebAcce...

Advantech WebAccess stack buffer overflow vulnerability (CNVD-2018-21935)

Advantech WebAccess software is the core of Advantech's IoT application platform solution, providing users with a user interface based on HTML5 technology for a cross-platform, cross-browser data access experience. A stack buffer overflow vulnerability exists in Advantech WebAccess. An attacker c...

Advantech WebAccess Client bwrunmie Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Advantech WebAccess Node. Authentication is not required to exploit this vulnerability. The specific flaw exists within bwrunmie.exe, which is accessed through the 0x2711 IOCTL in the webvrpcs...

Advantech WebAccess Client bwwebv Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Advantech WebAccess Node. Authentication is not required to exploit this vulnerability. The specific flaw exists within bwwebv.exe, which is accessed through the 0x2711 IOCTL in the webvrpcs proces...