Double free

Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior. A double free vulnerability caused by processing specially crafted project files may allow remote code execution, disclosure/modification of information, or cause the application to crash...

Heap overflow

Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior. Multiple heap-based buffer overflow vulnerabilities may be exploited by opening specially crafted project files that may overflow the heap, which may allow remote code execution, disclosure/modification of information, or cause the...

Type confusion

Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior. Processing specially crafted project files lacking proper validation of user supplied data may cause a type confusion condition, which may allow remote code execution, disclosure/modification of information, or cause the application t...

Remote code execution

Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior. Processing specially crafted project files lacking proper validation of user supplied data may cause the system to write outside the intended buffer area, which may allow remote code execution, disclosure/modification of information, ...

CVE-2020-16229

Advantech WebAccess HMI Designer (v2.1.9.31 and earlier) contains a type confusion vulnerability triggered by processing specially crafted project files with insufficient input validation. Exploitation can lead to remote code execution, information disclosure/modification, or application crash. R...

CVE-2020-16207

Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior. Multiple heap-based buffer overflow vulnerabilities may be exploited by opening specially crafted project files that may overflow the heap, which may allow remote code execution, disclosure/modification of information, or cause the...

CVE-2020-16207

CVE-2020-16207 affects Advantech WebAccess/HMI Designer (PM3 parsing) with heap-based buffer overflow vulnerabilities. The connected ZDI advisories describe multiple heap-overflow flaws in PM3 file parsing that can lead to remote code execution, information disclosure, or crashes when a crafted P...

CVE-2020-16211

CVE-2020-16211 affects Advantech WebAccess HMI Designer, version 2.1.9.31 and earlier. The vulnerability is an out-of-bounds read triggered by processing specially crafted project files, which can allow an attacker to read information. Public documents identify this as a local/targeted issue in p...

CVE-2020-16211

Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior. An out-of-bounds read vulnerability may be exploited by processing specially crafted project files, which may allow an attacker to read information...

CVE-2020-16213

Advantech WebAccess HMI Designer (WebAccess HMI Designer) versions 2.1.9.31 and earlier are affected by CVE-2020-16213 due to processing of specially crafted project files that may write outside the intended buffer, potentially enabling remote code execution, disclosure/modification of informatio...

CVE-2020-16213

Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior. Processing specially crafted project files lacking proper validation of user supplied data may cause the system to write outside the intended buffer area, which may allow remote code execution, disclosure/modification of information, ...

CVE-2020-16215

Advantech WebAccess HMI Designer (Windows) affected: Versions 2.1.9.31 and prior. Processing specially crafted project files may cause a stack-based buffer overflow, enabling remote code execution, information disclosure/modification, or application crash. Multiple sources (NVD, Red Hat, ZDI, CVE...

CVE-2020-16217

Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior. A double free vulnerability caused by processing specially crafted project files may allow remote code execution, disclosure/modification of information, or cause the application to crash...

CVE-2020-16217

Advantech WebAccess HMI Designer (versions

Cross-site Scripting (XSS)

Overview canvas-designer is a JavaScript Canvas2D drawing tool, supporting dozens of builtin tools, as well as generates JavaScript code for 2D animations. Affected versions of this package are vulnerable to Cross-site Scripting XSS. It's possible to send malicious data to the message listener...

Advantech WebAccess HMI Designer

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Advantech Equipment: WebAccess HMI Designer Vulnerabilities: Heap-based Buffer Overflow, Out-of-bounds Read, Out-of-bounds Write, Type Confusion, Stack-based Buffer Overflow, Double Free 2. RISK...

PT-2020-14816 · Advantech · Advantech Webaccess Hmi Designer

Name of the Vulnerable Software and Affected Versions: Advantech WebAccess HMI Designer versions 2.1.9.31 and prior Description: A double free vulnerability exists due to the processing of specially crafted project files, which may allow remote code execution, disclosure or modification of...

PT-2020-14828 · Advantech · Advantech Webaccess Hmi Designer

Name of the Vulnerable Software and Affected Versions: Advantech WebAccess HMI Designer versions 2.1.9.31 and prior Description: The issue arises from the processing of specially crafted project files that lack proper validation of user-supplied data, potentially leading to a type confusion...

PT-2020-14812 · Advantech · Advantech Webaccess Hmi Designer

Name of the Vulnerable Software and Affected Versions: Advantech WebAccess HMI Designer versions 2.1.9.31 and prior Description: The issue arises from the processing of specially crafted project files that lack proper validation of user-supplied data. This can cause the system to write outside th...

CVE-2020-12684

XXE injection can occur in i-net Clear Reports 2019 19.0.287 Designer, as used in i-net HelpDesk and other products, when XML input containing a reference to an external entity is processed by a weakly configured XML parser...