PT-2014-3834

Name of the Vulnerable Software and Affected Versions Advantech WebAccess versions prior to 7.2 Description The issue allows remote attackers to read arbitrary files via a file: URL, specifically through the OpenUrlToBufferTimeout method in the BWOCXRUN.BwocxrunCtrl.1 ActiveX control in...

PT-2014-3833

Name of the Vulnerable Software and Affected Versions Advantech WebAccess versions prior to 7.2 Description The issue allows remote attackers to read arbitrary files via a file: URL, specifically through the OpenUrlToBuffer method in the BWOCXRUN.BwocxrunCtrl.1 ActiveX control in bwocxrun.ocx...

PT-2014-3835

Name of the Vulnerable Software and Affected Versions Advantech WebAccess versions prior to 7.2 Description The issue allows remote attackers to execute specific programs from arbitrary pathnames via a crafted argument. This can be demonstrated by using a UNC share pathname to execute 1 setup.exe...

PT-2014-3830

Name of the Vulnerable Software and Affected Versions Advantech WebAccess versions prior to 7.2 Description The issue is related to a stack-based buffer overflow that allows remote attackers to execute arbitrary code. This is achieved by providing a long AccessCode2 argument. Recommendations For...

Advantech WebAccess webvact.ocx NodeName2 Stack Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Advantech WebAccess. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

PT-2014-3832

Name of the Vulnerable Software and Affected Versions Advantech WebAccess versions prior to 7.2 Description The issue is related to a stack-based buffer overflow that allows remote attackers to execute arbitrary code. This is achieved by providing a long UserName parameter. Recommendations For...

Advantech WebAccess webvact.ocx AccessCode Stack Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Advantech WebAccess. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Advantech WebAccess DBVisitor.dll SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Advantech WebAccess. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DBVisitor.dll component. Multiple SOAP requests implemented by the component a...

Advantech WebAccess webvact.ocx NodeName Stack Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Advantech WebAccess. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Advantech WebAccess webvact.ocx GotoCmd Stack Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Advantech WebAccess. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

PT-2014-3829

Name of the Vulnerable Software and Affected Versions Advantech WebAccess versions prior to 7.2 Description The issue is related to a stack-based buffer overflow that allows remote attackers to execute arbitrary code. This is achieved by providing a long AccessCode argument. Recommendations For...

PT-2014-3826

Name of the Vulnerable Software and Affected Versions Advantech WebAccess versions prior to 7.2 Description The issue is related to a stack-based buffer overflow that allows remote attackers to execute arbitrary code. This is achieved by providing a long NodeName parameter. Recommendations For...

PT-2014-3825

Name of the Vulnerable Software and Affected Versions Advantech WebAccess versions prior to 7.2 Description The issue concerns SQL injection vulnerabilities in the DBVisitor.dll component of Advantech WebAccess. These vulnerabilities allow remote attackers to execute arbitrary SQL commands via SO...

PT-2014-3828

Name of the Vulnerable Software and Affected Versions Advantech WebAccess versions prior to 7.2 Description The issue is a stack-based buffer overflow that allows remote attackers to execute arbitrary code via a long NodeName2 argument. This can be exploited in the webvact.ocx component of...

PT-2014-3827

Name of the Vulnerable Software and Affected Versions Advantech WebAccess versions prior to 7.2 Description The issue is related to a stack-based buffer overflow that allows remote attackers to execute arbitrary code. This is achieved by providing a long GotoCmd argument. Recommendations For...

Advantech WebAccess DBVisitor.dll ChartThemeConfig SQL Injection

This module exploits a SQL injection vulnerability found in Advantech WebAccess 7.1. The vulnerability exists in the DBVisitor.dll component, and can be abused through malicious requests to the ChartThemeConfig web service. This module can be used to extract the site and project usernames and...

InduSoft Advantech Studio Directory Traversal

OVERVIEW This advisory is a follow-up to the alert titled ICS-ALERT-13-004-01—Advantech Studio Directory Traversal that was published January 4, 2013, on the ICS-CERT Web page. Independent researcher Nin3 released proof-of-concept PoC exploit code for a directory traversal vulnerability in Induso...

Advantech Embedded Linux Operating System Detection

Binary data 8053.prm...

CVE-2013-2299

Cross-site scripting XSS vulnerability in Advantech WebAccess formerly BroadWin WebAccess before 7.1 2013.05.30 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in Advantech WebAccess formerly BroadWin WebAccess before 7.1 2013.05.30 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...