PT-2017-12656

Name of the Vulnerable Software and Affected Versions Advantech WebAccess versions prior to V8.2 20170817 Description An issue was discovered where string format specifiers based on user-provided input are not properly validated, which could allow an attacker to execute arbitrary code. This is...

PT-2017-12664

Name of the Vulnerable Software and Affected Versions Advantech WebAccess versions prior to V8.2 20170817 Description An issue with incorrect privilege assignment was found, where a built-in user account was granted a sensitive privilege. This could potentially allow a user to elevate their...

PT-2017-12665

Name of the Vulnerable Software and Affected Versions Advantech WebAccess versions prior to V8.2 20170817 Description An issue with incorrect permission assignment for critical resources was found, allowing non-administrator accounts to modify multiple files and folders with ACLs that affect othe...

PT-2017-12663

Name of the Vulnerable Software and Affected Versions Advantech WebAccess versions prior to V8.2 20170817 Description A SQL Injection issue was discovered, allowing an attacker to inject arbitrary SQL statements by submitting a specially crafted parameter. This could enable the attacker to obtain...

PT-2017-12658

Name of the Vulnerable Software and Affected Versions Advantech WebAccess versions prior to V8.2 20170817 Description A heap-based buffer overflow issue was discovered due to a lack of proper validation of the length of user-supplied data prior to copying it to the heap-based buffer. This could...

PT-2017-12666

Name of the Vulnerable Software and Affected Versions Advantech WebAccess versions prior to V8.2 20170817 Description An issue was discovered that allows an attacker to execute code within the context of the application by using a maliciously crafted dll file placed earlier in the search path...

CVE-2017-12711: Incorrect Privilege Assignment

An Incorrect Privilege Assignment issue was discovered in Advantech WebAccess versions prior to V8.220170817. A built-in user account has been granted a sensitive privilege that may allow a user to elevate to administrative privileges...

CVE-2017-12710: Improper Neutralization of Special Elements used in an SQL Command

A SQL Injection issue was discovered in Advantech WebAccess versions prior to V8.220170817. By submitting a specially crafted parameter, it is possible to inject arbitrary SQL statements that could allow an attacker to obtain sensitive information...

CVE-2017-12706: Stack-based Buffer Overflow

A stack-based buffer overflow issue was discovered in Advantech WebAccess versions prior to V8.220170817. Researchers have identified multiple vulnerabilities where there is a lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer, which could...

CVE-2017-12713: Incorrect Permission Assignment for Critical Resource

An Incorrect Permission Assignment for Critical Resource issue was discovered in Advantech WebAccess versions prior to V8.220170817. Multiple files and folders with ACLs that affect other users are allowed to be modified by non-administrator accounts...

CVE-2017-12702: Use of Externally-Controlled Format String

An Externally Controlled Format String issue was discovered in Advantech WebAccess versions prior to V8.220170817. String format specifiers based on user provided input are not properly validated, which could allow an attacker to execute arbitrary code...

CVE-2017-12717: Uncontrolled Search Path Element

An Uncontrolled Search Path Element issue was discovered in Advantech WebAccess versions prior to V8.220170817. A maliciously crafted dll file placed earlier in the search path may allow an attacker to execute code within the context of the application...

CVE-2017-12708: Improper Restriction of Operations within the Bounds of a Memory Buffer

An Improper Restriction Of Operations Within The Bounds Of A Memory Buffer issue was discovered in Advantech WebAccess versions prior to V8.220170817. Researchers have identified multiple vulnerabilities that allow invalid locations to be referenced for the memory buffer, which may allow an...

CVE-2017-12698: Improper Authentication

An Improper Authentication issue was discovered in Advantech WebAccess versions prior to V8.220170817. Specially crafted requests allow a possible authentication bypass that could allow remote code execution...

Advantech WebAccess Authentication Bypass Vulnerability

Advantech WebAccess is a set of HMI/SCADA software from Advantech based on browser architecture. The software supports dynamic graphic display and real-time data control, and provides remote control and management of automation equipment. An authentication bypass vulnerability exists in Advantech...

CVE-2017-12704: Heap-based Buffer Overflow

A heap-based buffer overflow issue was discovered in Advantech WebAccess versions prior to V8.220170817. Researchers have identified multiple vulnerabilities where there is a lack of proper validation of the length of user-supplied data prior to copying it to the heap-based buffer, which could...

PT-2017-2797

Name of the Vulnerable Software and Affected Versions Advantech WebAccess versions prior to V8.2 20170817 Description The issue is caused by an improper restriction of operations within the bounds of a memory buffer, which may allow an attacker to execute arbitrary code or cause the system to...

Advantech WebAccess

CVSS v3 7.8 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Advantech Equipment: WebAccess Vulnerabilities: SQL Injection, Out-of-Bounds Access, Multiple Buffer Overflows, Externally Controlled Format String, Improper Authentication, Incorrect Permission Assignment for Critica...

(0Day) Advantech WebOP Designer Project File Heap Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Advantech WebOP Designer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

PT-2017-12659

Name of the Vulnerable Software and Affected Versions Advantech WebOP affected versions not specified Description A Heap-Based Buffer Overflow issue was discovered, where a maliciously crafted project file may trigger a heap-based buffer overflow. This could crash the process and allow an attacke...