Advantech-AdamView-GNI

!/usr/bin/env ruby Exploit Title: Advantech AdamView .gni SEH Buffer Overflow Date: Dec 09 2014 Vulnerability Discovery: Daniel Kazimirow and Fernando Paez - Core Security Exploit Author: Muhamad Fadzil Ramli mind1355atgmail.com Software Link:...

Advantech ADAMView Display Properties Parameter Remote Code Execution (CVE-2014-8386)

A remote code execution vulnerability has been reported in Advantech ADAMView. The vulnerability is due to insufficient validation of display properties from a file. A remote attacker can exploit this vulnerability by enticing a user to download and process a maliciously crafted file...

Advantech WebAccess SCADA webeye.ocx ip_address Parameter Buffer Overflow - ver 2 (CVE-2014-8388)

A stack buffer overflow exists in Advantech's WebAccess SCADA software. The vulnerability is due to insufficient input validation of the ipaddress parameter contained in the webeye.ocx ActiveX control, a part of the WebAccess Client. A remote, unauthenticated attacker could exploit this...

Advantech WebAccess HMI and SCADA Software CrossSite Scripting - Ver2 (CVE-2012-0233)

A cross-site scripting vulnerability has been reported in Advantech Webaccess. Successful exploitation of this vulnerability would allow remote attackers to inject arbitrary web script into the affected system...

Advantech WebAccess Vulnerabilities

OVERVIEW This advisory is a follow-up to the original advisory titled “ICSA-14-079-03P Advantech WebAccess Vulnerabilities” that was posted to the US-CERT secure Portal library March 20, 2014. Researchers working with HP’s Zero Day Initiative ZDI, Andrea Micalizzi, aka rgod, Tom Gallagher, and an...

PT-2016-02: Cross-Site Scripting in Advantech WebAccess

The specialists of the Positive Research center have detected a Cross-Site Scripting vulnerability in Advantech WebAccess. A Cross-site scripting XSS vulnerability exists in Advantech WebAccess before 8.1 when the web server does not properly filter user input, which allows remote authenticated...

PT-2016-06: Information Disclosure in Advantech WebAccess

The specialists of the Positive Research center have detected an Information Disclosure vulnerability in Advantech WebAccess. Advantech WebAccess before 8.1 stores e-mail project accounts in clear text, which allows remote attackers to obtain sensitive information. How to fix Update your software...

PT-2016-01: Arbitrary File Upload in Advantech WebAccess

The specialists of the Positive Research center have detected an Arbitrary File Upload vulnerability in Advantech WebAccess. It was discovered that Advantech WebAccess before 8.1 allows remote unauthenticated users to create or write to arbitrary files on the server. How to fix Update your softwa...

PT-2016-03: SQL Injection in Advantech WebAccess

The specialists of the Positive Research center have detected an SQL Injection vulnerability in Advantech WebAccess. Advantech WebAccess before 8.1 allows remote authenticated users to execute arbitrary SQL commands to modify web server settings, accounts, and projects. How to fix Update your...

PT-2016-04: Cross-Site Request Forgery in Advantech WebAccess

The specialists of the Positive Research center have detected a Cross-Site Request Forgery vulnerability in Advantech WebAccess. Vulnerability in Advantech WebAccess before 8.1 allows remote attackers to conduct cross-site request forgery CSRF attacks and hijack the authentication of arbitrary...

PT-2016-05: Arbitrary Code Execution in Advantech WebAccess

The specialists of the Positive Research center have detected an Arbitrary Code Execution vulnerability in Advantech WebAccess. A browser plug-in for Advantech WebAccess before 8.1 allows remote attackers to execute arbitrary code. How to fix Update your software up to the latest version Advisory...

Advantech AdamView 4.30.003 - (.gni) SEH Buffer Overflow Exploit

Exploit for windows platform in category local exploits !/usr/bin/env ruby Exploit Title: Advantech AdamView .gni SEH Buffer Overflow Date: Dec 09 2014 Vulnerability Discovery: Daniel Kazimirow and Fernando Paez - Core Security Exploit Author: Muhamad Fadzil Ramli Software Link:...

Advantech AdamView 4.30.003 - '.gni' Local Buffer Overflow (SEH)

!/usr/bin/env ruby Exploit Title: Advantech AdamView .gni SEH Buffer Overflow Date: Dec 09 2014 Vulnerability Discovery: Daniel Kazimirow and Fernando Paez - Core Security Exploit Author: Muhamad Fadzil Ramli Software Link: http://downloadt.advantech.com/download/downloadsr.aspx?FileId=1-179WGW...

[CORE-2014-0010] - Advantech WebAccess Stack-based Buffer Overflow

Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ Advantech WebAccess Stack-based Buffer Overflow 1. Advisory Information Title: Advantech WebAccess Stack-based Buffer Overflow Advisory ID: CORE-2014-0010 Advisory URL:...

Advantech EKI-6340 code execution

Shell commands injection in Web interface...

Advantech AdamView buffer overflow

Buffer overflow on .gni files parsing...

[CORE-2014-0009] - Advantech EKI-6340 Command Injection

Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ Advantech EKI-6340 Command Injection 1. Advisory Information Title: Advantech EKI-6340 Command Injection Advisory ID: CORE-2014-0009 Advisory URL: http://www.coresecurity.com/advisories/advantech-eki-6340-command-injection Date...

[CORE-2014-0008] - Advantech AdamView Buffer Overflow

Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ Advantech AdamView Buffer Overflow 1. Advisory Information Title: Advantech AdamView Buffer Overflow Advisory ID: CORE-2014-0008 Advisory URL: http://www.coresecurity.com/advisories/advantech-adamView-buffer-overflow Date...

Advantech WebAccess buffer overflow

ActiveX buffer overflow...

Advantech WebAccess SCADA webeye.ocx ip_address Parameter Buffer Overflow (CVE-2014-8388)

A stack buffer overflow exists in Advantech's WebAccess SCADA software. The vulnerability is due to insufficient input validation of the ipaddress parameter contained in the webeye.ocx ActiveX control, a part of the WebAccess Client. A remote, unauthenticated attacker could exploit this...