CVE-2014-2364 Advantech WebAccess Stack-Based Buffer Overflow

Multiple stack-based buffer overflows in Advantech WebAccess before 7.2 allow remote attackers to execute arbitrary code via a long string in the 1 ProjectName, 2 SetParameter, 3 NodeName, 4 CCDParameter, 5 SetColor, 6 AlarmImage, 7 GetParameter, 8 GetColor, 9 ServerResponse, 10 SetBaud, or 11...

CVE-2014-2365 Advantech WebAccess Improper Access Control

Unspecified vulnerability in Advantech WebAccess before 7.2 allows remote authenticated users to create or delete arbitrary files via unknown vectors...

CVE-2014-2366 Advantech WebAccess Cleartext Storage of Sensitive Information in Memory

upAdminPg.asp in Advantech WebAccess before 7.2 allows remote authenticated users to discover credentials by reading HTML source code...

CVE-2014-2367 Advantech WebAccess Authentication Bypass Issues

The ChkCookie subroutine in an ActiveX control in broadweb/include/gChkCook.asp in Advantech WebAccess before 7.2 allows remote attackers to read arbitrary files via a crafted call...

CVE-2014-2364

Advantech WebAccess before version 7.2 is affected by multiple stack-based buffer overflows in the webvact.ocx, dvs.ocx, and webdact.ocx ActiveX controls. The vulnerability is triggered by overly long strings passed to parameters such as ProjectName, SetParameter, NodeName, CCDParameter, SetColor...

CVE-2014-2365

CVE-2014-2365 affects Advantech WebAccess before 7.2. An improper access control/flaw in WebAccess components allowed a remote attacker (in some docs, authenticated) to create or delete arbitrary files; ZDI notes a remote code execution path via gmicons.asp and file operations, with exploits publ...

CVE-2014-2366

CVE-2014-2366 affects Advantech WebAccess prior to 7.2, where upAdminPg.asp can disclose credentials to remote authenticated users by exposing them in the HTML source. Evidence from NVD/NIST and multiple advisories confirms the vulnerable component and the credential disclosure flaw, with a high ...

CVE-2014-2368

The CVE-2014-2368 issue affects Advantech WebAccess (prior to 7.2) via the bwocxrun ActiveX control. The BrowseFolder method can be abused to read arbitrary files, enabling remote read access. Root cause: Unsafe ActiveX control that allows navigation from the Internet to local files. Exploitation...

CVE-2014-2364: Stack-based Buffer Overflow

Multiple stack-based buffer overflows in Advantech WebAccess before 7.2 allow remote attackers to execute arbitrary code via a long string in the 1 ProjectName, 2 SetParameter, 3 NodeName, 4 CCDParameter, 5 SetColor, 6 AlarmImage, 7 GetParameter, 8 GetColor, 9 ServerResponse, 10 SetBaud, or 11...

CVE-2014-2367: DEPRECATED: Authentication Bypass Issues

The ChkCookie subroutine in an ActiveX control in broadweb/include/gChkCook.asp in Advantech WebAccess before 7.2 allows remote attackers to read arbitrary files via a crafted call...

CVE-2014-2366: Cleartext Storage of Sensitive Information in Memory

upAdminPg.asp in Advantech WebAccess before 7.2 allows remote authenticated users to discover credentials by reading HTML source code...

CVE-2014-2368: Unsafe ActiveX Control Marked Safe For Scripting

The BrowseFolder method in the bwocxrun ActiveX control in Advantech WebAccess before 7.2 allows remote attackers to read arbitrary files via a crafted call...

CVE-2014-2365: Improper Access Control

Unspecified vulnerability in Advantech WebAccess before 7.2 allows remote authenticated users to create or delete arbitrary files via unknown vectors...

PT-2014-4655

Name of the Vulnerable Software and Affected Versions Advantech WebAccess versions prior to 7.2 Description The issue allows remote attackers to read arbitrary files via a crafted call to the ChkCookie subroutine in an ActiveX control. This is due to a flaw in the broadweb/include/gChkCook.asp...

PT-2014-4653

Name of the Vulnerable Software and Affected Versions Advantech WebAccess versions prior to 7.2 Description The issue allows remote authenticated users to create or delete arbitrary files. Recommendations For versions prior to 7.2, update to version 7.2 or later to resolve the issue...

PT-2014-4654

Name of the Vulnerable Software and Affected Versions Advantech WebAccess versions prior to 7.2 Description The issue allows remote authenticated users to discover credentials by reading the HTML source code of the upAdminPg.asp page. Recommendations For versions prior to 7.2, update to version 7...

PT-2014-4652

Name of the Vulnerable Software and Affected Versions Advantech WebAccess versions prior to 7.2 Description The issue is related to multiple stack-based buffer overflows in Advantech WebAccess. Remote attackers can execute arbitrary code via a long string in various parameters to ActiveX controls...

PT-2014-4656

Name of the Vulnerable Software and Affected Versions Advantech WebAccess versions prior to 7.2 Description The issue allows remote attackers to read arbitrary files via a crafted call to the BrowseFolder method in the bwocxrun ActiveX control. Recommendations For versions prior to 7.2, update to...

Advantech WebAccess dvs.ocx AlarmImage Stack Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Advantech WebAccess. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Advantech WebAccess dvs.ocx GetColor Stack Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Advantech WebAccess. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...