Privilege escalation

Advantech WebAccess 8.3.1 and earlier has an improper privilege management vulnerability, which may allow an attacker to access those files and perform actions at a system administrator level...

Stack overflow

Advantech WebAccess 8.3.1 and earlier has several stack-based buffer overflow vulnerabilities that have been identified, which may allow an attacker to execute arbitrary code...

Path traversal

Advantech WebAccess 8.3.1 and earlier has a path traversal vulnerability which may allow an attacker to execute arbitrary code...

CVE-2018-14806

Advantech WebAccess 8.3.1 and earlier has a path traversal vulnerability which may allow an attacker to execute arbitrary code...

CVE-2018-14828

Advantech WebAccess 8.3.1 and earlier has an improper privilege management vulnerability, which may allow an attacker to access those files and perform actions at a system administrator level...

CVE-2018-14806

Advantech WebAccess 8.3.1 and earlier has a path traversal vulnerability which may allow an attacker to execute arbitrary code...

Arbitrary file deletion

Advantech WebAccess 8.3.1 and earlier has a .dll component that is susceptible to external control of file name or path vulnerability, which may allow an arbitrary file deletion when processing...

CVE-2018-14828

Advantech WebAccess 8.3.1 and earlier has an improper privilege management vulnerability, which may allow an attacker to access those files and perform actions at a system administrator level...

CVE-2018-14820

Advantech WebAccess 8.3.1 and earlier are affected by CVE-2018-14820 due to a .dll component that permits external control of file name or path, enabling arbitrary file deletion when processing. Exploitation is described as remote and unauthenticated in vendor advisories and ZDI reports, with the...

CVE-2018-14820

Advantech WebAccess 8.3.1 and earlier has a .dll component that is susceptible to external control of file name or path vulnerability, which may allow an arbitrary file deletion when processing...

CVE-2018-14816

CVE-2018-14816 maps to multiple stack-based buffer overflow flaws in Advantech WebAccess components. Connected advisories (ZDI-18-1300, -1302, -1303, -1304, -1305, -1306, -1307, -1300? and related CNVD) describe remote code execution via careless validation of user-supplied data copied into fixed...

CVE-2018-14828

Summary: CVE-2018-14828 affects Advantech WebAccess 8.3.1 and earlier, through an improper privilege management vulnerability that can allow an attacker to access files and perform actions at administrator level. Affected product/condition: WebAccess on vulnerable installs; the flaw arises from a...

CVE-2018-14816

Advantech WebAccess 8.3.1 and earlier has several stack-based buffer overflow vulnerabilities that have been identified, which may allow an attacker to execute arbitrary code...

CVE-2018-14806

Advantech WebAccess 8.3.1 and earlier has a path traversal vulnerability which may allow an attacker to execute arbitrary code...

CVE-2018-14806

Advantech WebAccess CVE-2018-14806 is a path traversal vulnerability in WebAccess 8.3.1 and earlier that could allow an attacker to execute arbitrary code. Affected software: Advantech WebAccess (versions 8.3.1 and prior). Root cause: path traversal in handling file paths/execution flow enabling ...

Advantech WebAccess

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Advantech Equipment: WebAccess Vulnerabilities: Stack-based Buffer Overflow, External Control of File Name or Path, Improper Privilege Management, Path Traversal 2. RISK EVALUATION Successful...

Advantech WebAccess stack buffer overflow vulnerability (CNVD-2018-21797)

Advantech WebAccess is a set of HMI/SCADA software from Advantech based on browser architecture. The software supports dynamic graphic display and real-time data control, and provides remote control and management of automation equipment. A stack buffer overflow vulnerability exists in Advantech...

Advantech WebAccess Cross-Site Scripting Vulnerability (CNVD-2018-21798)

Advantech WebAccess is a set of HMI/SCADA software from Advantech based on browser architecture. The software supports dynamic graphic display and real-time data control, and provides remote control and management of automation equipment. A cross-site scripting vulnerability exists in Advantech...

CVE-2018-15703

Advantech WebAccess 8.3.2 and below is vulnerable to multiple reflected cross site scripting vulnerabilities. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim to supply malicious HTML or JavaScript code to WebAccess, which is then reflected back ...

CVE-2018-15704

Advantech WebAccess 8.3.2 and below is vulnerable to a stack buffer overflow vulnerability. A remote authenticated attacker could potentially exploit this vulnerability by sending a crafted HTTP request to broadweb/system/opcImg.asp...