CVE-2018-15707

Advantech WebAccess 8.3.1 and 8.3.2 are vulnerable to cross-site scripting in the Bwmainleft.asp page. An attacker could leverage this vulnerability to disclose credentials amongst other things...

CVE-2018-15705

WADashboard API in Advantech WebAccess 8.3.1 and 8.3.2 allows remote authenticated attackers to write or overwrite any file on the filesystem due to a directory traversal vulnerability in the writeFile API. An attacker can use this vulnerability to remotely execute arbitrary code...

CVE-2018-15707

Advantech WebAccess 8.3.1 and 8.3.2 are vulnerable to cross-site scripting in the Bwmainleft.asp page. An attacker could leverage this vulnerability to disclose credentials amongst other things...

CVE-2018-15707

Advantech WebAccess 8.3.1/8.3.2 are affected by a Bwmainleft.asp cross-site scripting vulnerability (CVE-2018-15707). The XSS can disclose credentials among other data. Connected sources include exploit listings and writeups illustrating the vulnerability and, in at least one reference, that user...

CVE-2018-15706

WADashboard API in Advantech WebAccess 8.3.1 and 8.3.2 allows remote authenticated attackers to read any file on the filesystem due to a directory traversal vulnerability in the readFile API...

CVE-2018-15706

The CVE-2018-15706 vulnerability affects Advantech WebAccess WADashboard API (versions 8.3.1 and 8.3.2). The readFile API is vulnerable to a directory traversal flaw that allows remote authenticated attackers to read arbitrary files on the server filesystem. The issue is caused by insufficient va...

CVE-2018-15705

Summary: CVE-2018-15705 is a directory traversal vulnerability in Advantech WebAccess WADashboard API (writeFile) that allows remote authenticated attackers to write/overwrite arbitrary files and potentially execute arbitrary code. Affected versions include 8.3.1 and 8.3.2. The root cause is inad...

PT-2018-13156

Name of the Vulnerable Software and Affected Versions Advantech WebAccess versions 8.3.1 through 8.3.2 Description The issue allows remote authenticated attackers to write or overwrite any file on the filesystem due to a directory traversal vulnerability in the writeFile API endpoint. This can be...

Advantech WebAccess Node Improper Access Control Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on vulnerable installations of Advantech WebAccess Node. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the access...

Advantech WebAccess Client bwswfcfg Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Advantech WebAccess Client. Authentication is not required to exploit this vulnerability. The specific flaw exists within bwswfcfg.exe, which is accessed through the 0x2711 IOCTL in the webvrpcs...

CVE-2018-15706: Improper Limitation of a Pathname to a Restricted Directory

WADashboard API in Advantech WebAccess 8.3.1 and 8.3.2 allows remote authenticated attackers to read any file on the filesystem due to a directory traversal vulnerability in the readFile API...

PT-2018-3084

Name of the Vulnerable Software and Affected Versions Advantech WebAccess versions 8.3.1 through 8.3.2 Description The issue concerns a directory traversal vulnerability in the readFile API of the WADashboard component. This vulnerability allows remote authenticated attackers to read any file on...

CVE-2018-15705: Improper Limitation of a Pathname to a Restricted Directory

WADashboard API in Advantech WebAccess 8.3.1 and 8.3.2 allows remote authenticated attackers to write or overwrite any file on the filesystem due to a directory traversal vulnerability in the writeFile API. An attacker can use this vulnerability to remotely execute arbitrary code...

CVE-2018-15707: Improper Neutralization of Input During Web Page Generation

Advantech WebAccess 8.3.1 and 8.3.2 are vulnerable to cross-site scripting in the Bwmainleft.asp page. An attacker could leverage this vulnerability to disclose credentials amongst other things...

CVE-2018-17908

WebAccess Versions 8.3.2 and prior. During installation, the application installer disables user access control and does not re-enable it after the installation is complete. This could allow an attacker to run elevated arbitrary code...

CVE-2018-17910

WebAccess Versions 8.3.2 and prior. The application fails to properly validate the length of user-supplied data, causing a buffer overflow condition that allows for arbitrary remote code execution...

CVE-2018-17908

WebAccess Versions 8.3.2 and prior. During installation, the application installer disables user access control and does not re-enable it after the installation is complete. This could allow an attacker to run elevated arbitrary code...

CVE-2018-17910

WebAccess Versions 8.3.2 and prior. The application fails to properly validate the length of user-supplied data, causing a buffer overflow condition that allows for arbitrary remote code execution...

Buffer overflow

WebAccess Versions 8.3.2 and prior. The application fails to properly validate the length of user-supplied data, causing a buffer overflow condition that allows for arbitrary remote code execution...

CVE-2018-17908

CVE-2018-17908 affects Advantech WebAccess (versions 8.3.2 and prior). The root cause is improper access control: the installer disables User Account Control and does not re-enable it after installation, allowing local privilege escalation to the Administrator context. Connected advisories confir...