CVE-2017-12706

Advantech WebAccess contains a stack-based buffer overflow in versions prior to V8.2_20170817 caused by insufficient validation of the length of user-supplied data copied into a stack buffer. This could allow remote execution of arbitrary code in the process context. Affected product: Advantech W...

CVE-2017-12708

CVE-2017-12708 affects Advantech WebAccess versions prior to V8.2_20170817. It is an improper restriction of operations within the bounds of a memory buffer (CWE-119) that could allow referencing invalid memory locations, potentially enabling arbitrary code execution or a crash. Multiple connecte...

CVE-2017-12710

CVE-2017-12710 corresponds to an SQL injection vulnerability in Advantech WebAccess, affecting versions prior to V8.2_20170817. The vulnerability arises from insufficient validation of input used to construct SQL queries (rmTemplate.aspx context per ZDI advisory), potentially allowing an attacker...

CVE-2017-12711

CVE-2017-12711 affects Advantech WebAccess prior to V8.2_20170817. The root cause is an Incorrect Privilege Assignment where a built-in user account has been granted a sensitive privilege, potentially allowing elevation to administrative privileges. Impact is elevated access with high severity (p...

CVE-2017-12713

Advantech WebAccess before version V8.2_20170817 is affected by CVE-2017-12713: Incorrect Permission Assignment for Critical Resource, where non-administrator accounts can modify multiple files/folders with ACLs that affect other users. This is a local-privilege-escalation issue rooted in access ...

CVE-2017-12704

Advantech WebAccess is affected by a HEAP-BASED BUFFER OVERFLOW (CVE-2017-12704) in versions prior to V8.2_20170817. The issue arises from improper validation of the length of user-supplied data before copying to a heap buffer, potentially allowing arbitrary code execution under the process. Affe...

CVE-2017-12717

An Uncontrolled Search Path Element issue was discovered in Advantech WebAccess versions prior to V8.220170817. A maliciously crafted dll file placed earlier in the search path may allow an attacker to execute code within the context of the application...

CVE-2017-12711

An Incorrect Privilege Assignment issue was discovered in Advantech WebAccess versions prior to V8.220170817. A built-in user account has been granted a sensitive privilege that may allow a user to elevate to administrative privileges...

CVE-2017-12702

CVE-2017-12702 affects Advantech WebAccess prior to version V8.2_20170817. The issue is an Externally Controlled Format String (CWE-134): string format specifiers based on user input are not properly validated, potentially enabling arbitrary code execution. The vulnerability is associated with th...

CVE-2017-12702

An Externally Controlled Format String issue was discovered in Advantech WebAccess versions prior to V8.220170817. String format specifiers based on user provided input are not properly validated, which could allow an attacker to execute arbitrary code...

CVE-2017-12708

An Improper Restriction Of Operations Within The Bounds Of A Memory Buffer issue was discovered in Advantech WebAccess versions prior to V8.220170817. Researchers have identified multiple vulnerabilities that allow invalid locations to be referenced for the memory buffer, which may allow an...

Advantech WebAccess SQL Injection Vulnerability (CNVD-2017-23886)

Advantech WebAccess is a set of HMI/SCADA software from Advantech based on browser architecture. The software supports dynamic graphic display and real-time data control, and provides remote control and management of automation equipment. Advantech WebAccess suffers from a SQL injection...

Advantech WebAccess Buffer Overflow Vulnerability (CNVD-2017-23885)

Advantech WebAccess is a set of HMI/SCADA software from Advantech based on browser architecture. The software supports dynamic graphic display and real-time data control, and provides remote control and management of automation equipment. A buffer overflow vulnerability exists in Advantech...

Advantech WebAccess Stack Buffer Overflow Vulnerability

Advantech WebAccess is a set of HMI/SCADA software from Advantech based on browser architecture. The software supports dynamic graphic display and real-time data control, and provides remote control and management of automation equipment. A stack buffer overflow vulnerability exists in Advantech...

Advantech WebAccess HEAP Buffer Overflow Vulnerability

Advantech WebAccess is a set of HMI/SCADA software from Advantech based on browser architecture. The software supports dynamic graphic display and real-time data control, and provides remote control and management of automation equipment. Advantech WebAccess suffers from a HEAP buffer overflow...

Advantech WebAccess Unauthorized Operation Vulnerability

Advantech WebAccess is a set of HMI/SCADA software from Advantech based on browser architecture. The software supports dynamic graphic display and real-time data control, and provides remote control and management of automation equipment. An unauthorized operation vulnerability exists in Advantec...

Advantech WebAccess Elevation of Privilege Vulnerability

Advantech WebAccess is a set of HMI/SCADA software from Advantech based on browser architecture. The software supports dynamic graphic display and real-time data control, and provides remote control and management of automation equipment. An elevation of privilege vulnerability exists in Advantec...

Advantech WebAccess Arbitrary Code Execution Vulnerability (CNVD-2017-23878)

Advantech WebAccess is a set of HMI/SCADA software from Advantech based on browser architecture. The software supports dynamic graphic display and real-time data control, and provides remote control and management of automation equipment. An arbitrary code execution vulnerability exists in...

CVE-2017-12717: Uncontrolled Search Path Element

An Uncontrolled Search Path Element issue was discovered in Advantech WebAccess versions prior to V8.220170817. A maliciously crafted dll file placed earlier in the search path may allow an attacker to execute code within the context of the application...

PT-2017-12658

Name of the Vulnerable Software and Affected Versions Advantech WebAccess versions prior to V8.2 20170817 Description A heap-based buffer overflow issue was discovered due to a lack of proper validation of the length of user-supplied data prior to copying it to the heap-based buffer. This could...