CVE-2011-4521

SQL injection vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary SQL commands via crafted string input...

CVE-2012-0238

CVE-2012-0238 affects Advantech/BroadWin WebAccess prior to 7.0. A stack-based buffer overflow in opcImg.asp could allow a remote attacker to execute arbitrary code. ICS-CERT notes multiple vulnerabilities in WebAccess 7.0 era; public exploits exist for these issues. Mitigation: Advantech release...

CVE-2012-0237

Advantech/BroadWin WebAccess before 7.0 allows remote attackers to 1 enable date and time syncing or 2 disable date and time syncing via a crafted URL...

CVE-2011-4522

CVE-2011-4522 is a Cross-site Scripting (XSS) vulnerability in Advantech/BroadWin WebAccess prior to version 7.0, affecting the file bwerrdn.asp. The issue allows remote attackers to inject arbitrary web script or HTML via unspecified parameters. Multiple connected sources document this XSS vulne...

CVE-2011-1914

CVE-2011-1914 describes a buffer overflow in the Advantech ADAM OPC Server ActiveX control used by multiple ADAM OPC Server products. The vulnerability affects ADAM OPC Server before 3.01.012, Modbus RTU OPC Server before 3.01.010, and Modbus TCP OPC Server before 3.01.010, enabling remote code e...

CVE-2012-0241

Advantech/BroadWin WebAccess prior to version 7.0 is affected by CVE-2012-0241, where a remote attacker can trigger memory corruption by supplying a modified stream identifier to a function, resulting in denial of service. The vulnerability is part of a broader set described in ICS-CERT advisorie...

CVE-2012-0235

Cross-site request forgery CSRF vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

CVE-2012-1235

CVE-2012-1235 affects Advantech/BroadWin WebAccess 7.0 with a Cross-Site Request Forgery (CSRF) flaw that can allow remote authenticated users to hijack the authentication of unspecified victims, stemming from an incomplete fix for CVE-2012-0235. The ICS-CERT advisory notes that Advantech release...

CVE-2011-4523

Cross-site scripting XSS vulnerability in bwview.asp in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters...

CVE-2012-0242

CVE-2012-0242 : A format-string vulnerability in Advantech/BroadWin WebAccess prior to 7.0 allows remote execution of arbitrary code via a crafted message string. Public advisories note that attacks can be remote and exploitable for full control. ICS-CERT summarizes the impact as bypassing authen...

CVE-2012-0240

CVE-2012-0240 affects Advantech/BroadWin WebAccess prior to version 7.0. The vulnerability is in GbScriptAddUp.asp where authentication is not performed properly, allowing remote attackers to execute arbitrary code via unspecified vectors. The issue is remotely exploitable and public exploits are...

CVE-2011-4525

CVE-2011-4525 affects Advantech/BroadWin WebAccess prior to 7.0. A remote attacker can cause the client to create and execute a batch file by injecting arbitrary web content, enabling potential remote code execution. ICS-CERT notes Advantech released WebAccess 7.0 to address most vulnerabilities;...

CVE-2012-1234

CVE-2012-1234 describes an SQL injection in Advantech/BroadWin WebAccess 7.0 where remote authenticated users can execute arbitrary SQL via a malformed URL. The entry notes this vulnerability exists due to an incomplete fix for CVE-2012-0234. Connected records confirm affected product is Advantec...

CVE-2011-4524

The CVE-2011-4524 entry concerns Advantech/BroadWin WebAccess prior to version 7.0. The vulnerability is a buffer overflow triggered by a long string value in unspecified parameters, enabling remote code execution. Connected documents corroborate a family of vulnerabilities in WebAccess affecting...

CVE-2011-4521

CVE-2011-4521 describes an SQL injection vulnerability in Advantech/BroadWin WebAccess prior to version 7.0, allowing remote attackers to execute arbitrary SQL commands via crafted string input. Affected product: Advantech/BroadWin WebAccess (pre-7.0). Root cause centers on unsanitized input hand...

CVE-2012-0234: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary SQL commands via a malformed URL...

CVE-2011-4522: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in bwerrdn.asp in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters...

CVE-2012-0236: Exposure of Sensitive Information to an Unauthorized Actor

Advantech/BroadWin WebAccess 7.0 and earlier allows remote attackers to obtain sensitive information via a direct request to a URL. NOTE: the vendor reportedly "does not consider it to be a security risk."...

CVE-2012-0240: Improper Authentication

GbScriptAddUp.asp in Advantech/BroadWin WebAccess before 7.0 does not properly perform authentication, which allows remote attackers to execute arbitrary code via unspecified vectors...

CVE-2012-0242: Use of Externally-Controlled Format String

Format string vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary code via format string specifiers in a message string...