CVE-2020-14505

Advantech iView, versions 5.6 and prior, has an improper neutralization of special elements used in a command “command injection” vulnerability. Successful exploitation of this vulnerability may allow an attacker to send a HTTP GET or POST request that creates a command string without any...

CVE-2020-14507

Advantech iView, versions 5.6 and prior, is vulnerable to multiple path traversal vulnerabilities that could allow an attacker to create/download arbitrary files, limit system availability, and remotely execute code...

CVE-2020-14507

Advantech iView, versions 5.6 and prior, is vulnerable to multiple path traversal vulnerabilities that could allow an attacker to create/download arbitrary files, limit system availability, and remotely execute code...

Path traversal

Advantech iView, versions 5.6 and prior, is vulnerable to multiple path traversal vulnerabilities that could allow an attacker to create/download arbitrary files, limit system availability, and remotely execute code...

Sql injection

Advantech iView, versions 5.6 and prior, contains multiple SQL injection vulnerabilities that are vulnerable to the use of an attacker-controlled string in the construction of SQL queries. An attacker could extract user credentials, read or modify information, and remotely execute code...

Command injection

Advantech iView, versions 5.6 and prior, has an improper neutralization of special elements used in a command “command injection” vulnerability. Successful exploitation of this vulnerability may allow an attacker to send a HTTP GET or POST request that creates a command string without any...

CVE-2020-14499

Advantech iView (versions 5.6 and prior) is affected by an improper access control vulnerability (CVE-2020-14499) that could allow an attacker to obtain all user account credentials. Connected sources confirm the issue stems from inadequate access control in the application, enabling credential d...

CVE-2020-14499

Advantech iView, versions 5.6 and prior, has an improper access control vulnerability. Successful exploitation of this vulnerability may allow an attacker to obtain all user accounts credentials...

CVE-2020-14505

CVE-2020-14505 affects Advantech iView (versions 5.6 and prior). The vulnerability is an improper neutralization of special elements used in a command (command injection) that could allow an attacker to compose a command string via HTTP GET/POST without proper validation, enabling remote code exe...

CVE-2020-14505

Advantech iView, versions 5.6 and prior, has an improper neutralization of special elements used in a command “command injection” vulnerability. Successful exploitation of this vulnerability may allow an attacker to send a HTTP GET or POST request that creates a command string without any...

CVE-2020-14497

Advantech iView, versions 5.6 and prior, contains multiple SQL injection vulnerabilities that are vulnerable to the use of an attacker-controlled string in the construction of SQL queries. An attacker could extract user credentials, read or modify information, and remotely execute code...

CVE-2020-14497

CVE-2020-14497 affects Advantech iView (versions ≤5.6). Connected documents reveal multiple SQL Injection vulnerabilities across iView components (NetworkServlet, LinksTable, DeviceTreeTable, SystemTable) that allow attacker-controlled input to be used in SQL queries. Root cause: lack of proper v...

CVE-2020-14507

Advantech iView (versions 5.6 and earlier) is affected by multiple path traversal vulnerabilities in various components (MenuServlet, NetworkServlet, ZTPConfig, LinksTable) enabling creation/download of arbitrary files, disruption of availability, and remote code execution. Root cause across advi...

CVE-2020-14507

Advantech iView, versions 5.6 and prior, is vulnerable to multiple path traversal vulnerabilities that could allow an attacker to create/download arbitrary files, limit system availability, and remotely execute code...

Information Disclosure Vulnerability in Advantech WebAccess/SCADA

Advantech WebAccess/SCADA is a suite of SCADA software based on a browser architecture. An information disclosure vulnerability exists in Advantech WebAccess/SCADA. The vulnerability can be exploited to obtain sensitive information such as remote connection passwords, backend administrator...

Advantech WebAccess/SCADA suffers from a command execution vulnerability (CNVD-2020-48616)

Advantech WebAccess/SCADA is a suite of SCADA software based on a browser architecture. A command execution vulnerability exists in Advantech WebAccess/SCADA. An attacker could exploit the vulnerability to execute console commands...

Advantech WebAccess/SCADA suffers from a logic flaw vulnerability (CNVD-2020-48617)

Advantech WebAccess/SCADA is a suite of SCADA software based on a browser architecture. A logic flaw vulnerability exists in Advantech WebAccess/SCADA. The vulnerability can be exploited to gain access to modify the registry of a user's system and execute arbitrary commands on the user's system...

Advantech WebAccess/SCADA suffers from an arbitrary file deletion vulnerability (CNVD-2020-48623)

Advantech WebAccess/SCADA is a suite of SCADA software based on a browser architecture. An arbitrary file deletion vulnerability exists in Advantech WebAccess/SCADA. An attacker can exploit the vulnerability to delete arbitrary files...

Advantech WebAccess/SCADA has a Logic Flaw Vulnerability

Advantech WebAccess/SCADA is a suite of SCADA software based on a browser architecture. A logic flaw vulnerability exists in Advantech WebAccess/SCADA. The vulnerability can be exploited to gain access to modify the registry of a user's system and execute arbitrary commands on the user's system...

Advantech WebAccess/SCADA suffers from a command execution vulnerability (CNVD-2020-48619)

Advantech WebAccess/SCADA is a suite of SCADA software based on a browser architecture. A command execution vulnerability exists in Advantech WebAccess/SCADA. An attacker could exploit the vulnerability to execute console commands...