PT-2016-1122

Name of the Vulnerable Software and Affected Versions Advantech WebAccess versions prior to 8.1 Description The issue is caused by multiple stack-based buffer overflows in Advantech WebAccess. Exploitation of these overflows may allow a remote attacker to execute arbitrary code. The overflows occ...

CVE-2015-3943: Exposure of Sensitive Information to an Unauthorized Actor

Advantech WebAccess before 8.1 allows remote attackers to read sensitive cleartext information about e-mail project accounts via unspecified vectors...

CVE-2016-0858: Improper Restriction of Operations within the Bounds of a Memory Buffer

Race condition in Advantech WebAccess before 8.1 allows remote attackers to execute arbitrary code or cause a denial of service buffer overflow via a crafted request...

CVE-2016-0857: Improper Restriction of Operations within the Bounds of a Memory Buffer

Multiple heap-based buffer overflows in Advantech WebAccess before 8.1 allow remote attackers to execute arbitrary code via unspecified vectors...

CVE-2016-0853: Exposure of Sensitive Information to an Unauthorized Actor

Advantech WebAccess before 8.1 allows remote attackers to obtain sensitive information via crafted input...

CVE-2016-0855: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in Advantech WebAccess before 8.1 allows remote attackers to list arbitrary virtual-directory files via unspecified vectors...

CVE-2016-0851: Improper Restriction of Operations within the Bounds of a Memory Buffer

Advantech WebAccess before 8.1 allows remote attackers to cause a denial of service out-of-bounds memory access via unspecified vectors...

CVE-2016-0856: Improper Restriction of Operations within the Bounds of a Memory Buffer

Multiple stack-based buffer overflows in Advantech WebAccess before 8.1 allow remote attackers to execute arbitrary code via unspecified vectors...

CVE-2015-3946: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in Advantech WebAccess before 8.1 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

CVE-2016-0860: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in the BwpAlarm subsystem in Advantech WebAccess before 8.1 allows remote attackers to cause a denial of service via a crafted RPC request...

CVE-2015-3947: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Advantech WebAccess before 8.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors...

CVE-2015-3948: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Advantech WebAccess before 8.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2016-0859: Undefined Security Weakness

Integer overflow in the Kernel service in Advantech WebAccess before 8.1 allows remote attackers to execute arbitrary code or cause a denial of service stack-based buffer overflow via a crafted RPC request...

CVE-2016-0852: Undefined Security Weakness

Advantech WebAccess before 8.1 allows remote attackers to bypass an intended administrative requirement and obtain file or folder access via unspecified vectors...

CVE-2015-6467: Undefined Security Weakness

Advantech WebAccess before 8.1 allows remote attackers to execute arbitrary code via vectors involving a browser plugin...

CVE-2016-0854: Undefined Security Weakness

Unrestricted file upload vulnerability in the uploadImageCommon function in the UploadAjaxAction script in the WebAccess Dashboard Viewer in Advantech WebAccess before 8.1 allows remote attackers to write to files of arbitrary types via unspecified vectors...

Advantech WebAccess AspVCObj.AspDataDriven ActiveX GetWideStrCpy Stack Buffer Overflow (CVE-2014-9208)

A stack buffer overflow vulnerability exists in Advantech's WebAccess SCADA software. The vulnerability is due to insufficient input validation of an argument to GetWideStrCpy in the AspVCObj.AspDataDriven ActiveX control. A remote, unauthenticated attacker can exploit this vulnerability by...

Advantech WebAccess < 8.0.2015.08.16 Unspecified DLL String Handling Arbitrary Code Execution

Binary data scadaadvantechwebaccess820150816.nbin...

Advantech WebAccess AspVCObj.AspDataDriven ActiveX Stack Buffer Overflow (CVE-2014-9208)

A stack buffer overflow vulnerability exists in Advantech's WebAccess SCADA software. The vulnerability is due to insufficient input validation of an argument of multiple functions in the AspVCObj ActiveX control. A remote, unauthenticated attacker can exploit this vulnerability by enticing a...

Stack overflow

Multiple stack-based buffer overflows in an unspecified DLL file in Advantech WebAccess before 8.020150816 allow remote attackers to execute arbitrary code via a crafted file that triggers long string arguments to functions...