50 matches found
CVE-2012-0239: Improper Authentication
uaddUpAdmin.asp in Advantech/BroadWin WebAccess before 7.0 does not properly perform authentication, which allows remote attackers to modify an administrative password via a password-change request...
CVE-2012-0238: Improper Restriction of Operations within the Bounds of a Memory Buffer
Stack-based buffer overflow in opcImg.asp in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary code via unspecified vectors...
CVE-2011-4521: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary SQL commands via crafted string input...
CVE-2012-1235: Cross-Site Request Forgery (CSRF)
Cross-site request forgery CSRF vulnerability in Advantech/BroadWin WebAccess 7.0 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0235...
CVE-2011-4526: Improper Restriction of Operations within the Bounds of a Memory Buffer
Buffer overflow in an ActiveX control in Advantech/BroadWin WebAccess before 7.0 might allow remote attackers to execute arbitrary code via a long string value in unspecified parameters...
CVE-2012-0244: Improper Neutralization of Special Elements used in an SQL Command
Multiple SQL injection vulnerabilities in Advantech/BroadWin WebAccess before 7.0 allow remote attackers to execute arbitrary SQL commands via crafted string input...
CVE-2012-0237: Improper Restriction of Operations within the Bounds of a Memory Buffer
Advantech/BroadWin WebAccess before 7.0 allows remote attackers to 1 enable date and time syncing or 2 disable date and time syncing via a crafted URL...
CVE-2012-0235: Cross-Site Request Forgery (CSRF)
Cross-site request forgery CSRF vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...
CVE-2011-4041: Improper Control of Generation of Code
webvrpcs.exe in Advantech/BroadWin WebAccess allows remote attackers to execute arbitrary code or obtain a security-code value via a long string in an RPC request to TCP port 4592...
