Design/Logic Flaw

Advantech WebAccess before 8.1 allows remote attackers to bypass an intended administrative requirement and obtain file or folder access via unspecified vectors...

CVE-2016-0859

Summary: CVE-2016-0859 affects Advantech WebAccess before 8.1. The vulnerability is an integer overflow in the Kernel service that can be triggered by a crafted RPC request, leading to remote code execution or a denial of service (stack-based buffer overflow). Affected product/version: WebAccess ...

CVE-2016-0854

Affected product: Advantech WebAccess, specifically the Dashboard Viewer component of WebAccess prior to version 8.1. Vulnerability summary: Unrestricted upload of a file with dangerous type via the UploadAjaxAction script (uploadImageCommon/uploadFile/uploadBannerImage paths) in the WebAccess Da...

CVE-2016-0854

Unrestricted file upload vulnerability in the uploadImageCommon function in the UploadAjaxAction script in the WebAccess Dashboard Viewer in Advantech WebAccess before 8.1 allows remote attackers to write to files of arbitrary types via unspecified vectors...

CVE-2015-3946

Cross-site request forgery CSRF vulnerability in Advantech WebAccess before 8.1 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

CVE-2016-0857

CVE-2016-0857 maps to multiple heap-based buffer overflow issues in Advantech WebAccess prior to 8.1. Technical details in connected advisories specify vulnerable components and paths, including a heap-overflow in the BwpAlarm subsystem (BwpAlarm.dll) via a strcpy-based overflow, and related heap...

CVE-2015-6467

CVE-2015-6467 affects Advantech WebAccess (HMI/SCADA) prior to version 8.1. The vulnerability is a remote code execution via a browser plugin, allowing an attacker to run arbitrary code on the target. Connected sources confirm a remote-exploit scenario and that Advantech released WebAccess 8.1 to...

CVE-2016-0856

CVE-2016-0856 affects Advantech WebAccess (pre-8.1). The root cause is a stack-based buffer overflow in the bwconn.dll RpcWebClientConnect path (IoRequest structure) that can be triggered remotely to execute arbitrary code. Public PoCs and PoC-style repositories on Gitee describe a Python/ctypes-...

CVE-2015-3948

Cross-site scripting XSS vulnerability in Advantech WebAccess before 8.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2016-0851

CVE-2016-0851 affects Advantech WebAccess prior to 8.1. The issue arises from a memory safety flaw (out-of-bounds access) that can be triggered remotely, leading to a denial of service. ZDI documents a separate vulnerable path in the BwOpcSvc.dll 0x13881 IOCTL implementation, described as an unco...

CVE-2016-0858

Race condition in Advantech WebAccess before 8.1 allows remote attackers to execute arbitrary code or cause a denial of service buffer overflow via a crafted request...

CVE-2016-0860

CVE-2016-0860 describes a buffer overflow in the BwpAlarm subsystem of Advantech WebAccess prior to 8.1, allowing remote attackers to cause a denial of service via a crafted RPC request. Public docs confirm the affected product (Advantech WebAccess), version before 8.1, and remote-execution/DoS r...

CVE-2015-3947

SQL injection vulnerability in Advantech WebAccess before 8.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors...

CVE-2016-0855

CVE-2016-0855 concerns Advantech WebAccess (pre-8.1). The vulnerability is a directory traversal in the WebAccess Dashboard/Viewer that could allow remote attackers to list arbitrary files in a virtual directory via unspecified vectors. Public references from ZDI describe related dashboard viewer...

CVE-2015-3943

Advantech WebAccess CVE-2015-3943: An information-disclosure vulnerability in WebAccess versions before 8.1 allows remote attackers to read cleartext data from e-mail project accounts. Connected sources (ICS-CERT advisory ICSA-16-014-01, CNVD entries, NVD record) confirm the root cause involves i...

CVE-2016-0856

Multiple stack-based buffer overflows in Advantech WebAccess before 8.1 allow remote attackers to execute arbitrary code via unspecified vectors...

CVE-2016-0860

Buffer overflow in the BwpAlarm subsystem in Advantech WebAccess before 8.1 allows remote attackers to cause a denial of service via a crafted RPC request...

CVE-2015-3948

Summary : CVE-2015-3948 is a cross-site scripting (XSS) vulnerability in Advantech WebAccess prior to 8.1. The issue allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. According to NVD, the CVSS base score (v3) is 5.4 (Medium) with network access, lo...

CVE-2015-3947

Advantech WebAccess (before 8.1) is affected by a SQL Injection vulnerability (CWE-89) that allows remote authenticated users to execute arbitrary SQL commands, potentially modifying web server settings, accounts, and projects. Root cause details are described in PT-2016-03: SQL Injection in WebA...

CVE-2016-0859

Integer overflow in the Kernel service in Advantech WebAccess before 8.1 allows remote attackers to execute arbitrary code or cause a denial of service stack-based buffer overflow via a crafted RPC request...