CVE-2015-3948

Cross-site scripting XSS vulnerability in Advantech WebAccess before 8.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-6467

Advantech WebAccess before 8.1 allows remote attackers to execute arbitrary code via vectors involving a browser plugin...

CVE-2015-3943

Advantech WebAccess CVE-2015-3943: An information-disclosure vulnerability in WebAccess versions before 8.1 allows remote attackers to read cleartext data from e-mail project accounts. Connected sources (ICS-CERT advisory ICSA-16-014-01, CNVD entries, NVD record) confirm the root cause involves i...

CVE-2015-6467

CVE-2015-6467 affects Advantech WebAccess (HMI/SCADA) prior to version 8.1. The vulnerability is a remote code execution via a browser plugin, allowing an attacker to run arbitrary code on the target. Connected sources confirm a remote-exploit scenario and that Advantech released WebAccess 8.1 to...

CVE-2016-0854

Affected product: Advantech WebAccess, specifically the Dashboard Viewer component of WebAccess prior to version 8.1. Vulnerability summary: Unrestricted upload of a file with dangerous type via the UploadAjaxAction script (uploadImageCommon/uploadFile/uploadBannerImage paths) in the WebAccess Da...

CVE-2015-3946

CVE-2015-3946 (Advantech WebAccess) : A CSRF vulnerability exists in WebAccess prior to version 8.1 that can allow remote attackers to hijack user authentication. Affected product: Advantech WebAccess (HMI/SCADA software). Root cause: cross-site request forgery enabling unauthorized actions in au...

CVE-2016-0855

CVE-2016-0855 concerns Advantech WebAccess (pre-8.1). The vulnerability is a directory traversal in the WebAccess Dashboard/Viewer that could allow remote attackers to list arbitrary files in a virtual directory via unspecified vectors. Public references from ZDI describe related dashboard viewer...

CVE-2015-3947

Advantech WebAccess (before 8.1) is affected by a SQL Injection vulnerability (CWE-89) that allows remote authenticated users to execute arbitrary SQL commands, potentially modifying web server settings, accounts, and projects. Root cause details are described in PT-2016-03: SQL Injection in WebA...

CVE-2015-3947

SQL injection vulnerability in Advantech WebAccess before 8.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors...

CVE-2016-0856

CVE-2016-0856 affects Advantech WebAccess (pre-8.1). The root cause is a stack-based buffer overflow in the bwconn.dll RpcWebClientConnect path (IoRequest structure) that can be triggered remotely to execute arbitrary code. Public PoCs and PoC-style repositories on Gitee describe a Python/ctypes-...

CVE-2015-3948

Summary : CVE-2015-3948 is a cross-site scripting (XSS) vulnerability in Advantech WebAccess prior to 8.1. The issue allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. According to NVD, the CVSS base score (v3) is 5.4 (Medium) with network access, lo...

PT-2016-4421

Name of the Vulnerable Software and Affected Versions Advantech WebAccess versions prior to 8.1 Description The issue allows remote attackers to obtain sensitive information via crafted input. Recommendations For versions prior to 8.1, update to version 8.1 or later to resolve the issue...

CVE-2016-0851: Improper Restriction of Operations within the Bounds of a Memory Buffer

Advantech WebAccess before 8.1 allows remote attackers to cause a denial of service out-of-bounds memory access via unspecified vectors...

CVE-2016-0856: Improper Restriction of Operations within the Bounds of a Memory Buffer

Multiple stack-based buffer overflows in Advantech WebAccess before 8.1 allow remote attackers to execute arbitrary code via unspecified vectors...

CVE-2016-0860: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in the BwpAlarm subsystem in Advantech WebAccess before 8.1 allows remote attackers to cause a denial of service via a crafted RPC request...

CVE-2015-3946: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in Advantech WebAccess before 8.1 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

CVE-2015-3947: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Advantech WebAccess before 8.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors...

CVE-2016-0852: Undefined Security Weakness

Advantech WebAccess before 8.1 allows remote attackers to bypass an intended administrative requirement and obtain file or folder access via unspecified vectors...

CVE-2016-0859: Undefined Security Weakness

Integer overflow in the Kernel service in Advantech WebAccess before 8.1 allows remote attackers to execute arbitrary code or cause a denial of service stack-based buffer overflow via a crafted RPC request...

CVE-2016-0855: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in Advantech WebAccess before 8.1 allows remote attackers to list arbitrary virtual-directory files via unspecified vectors...