PT-2021-7267

Name of the Vulnerable Software and Affected Versions Advantech SQ Manager Server version 1.0.6 Description A privilege escalation issue exists due to incorrect default permission settings, allowing an attacker to elevate privileges to NT SYSTEM authority by replacing a specially-crafted file in...

CVE-2021-33023

Advantech WebAccess versions 9.02 and prior are vulnerable to a heap-based buffer overflow, which may allow an attacker to remotely execute code...

CVE-2021-38389

Advantech WebAccess versions 9.02 and prior are vulnerable to a stack-based buffer overflow, which may allow an attacker to remotely execute code...

CVE-2021-33023

Advantech WebAccess versions 9.02 and prior are vulnerable to a heap-based buffer overflow, which may allow an attacker to remotely execute code...

Stack overflow

Advantech WebAccess versions 9.02 and prior are vulnerable to a stack-based buffer overflow, which may allow an attacker to remotely execute code...

Heap overflow

Advantech WebAccess versions 9.02 and prior are vulnerable to a heap-based buffer overflow, which may allow an attacker to remotely execute code...

CVE-2021-38389

This CVE affects Advantech WebAccess (versions 9.02 and earlier). A stack-based buffer overflow vulnerability exists in the handling of IOCTL 0x1138B, allowing remote code execution with no authentication required. ZDI reports that the flaw can be exploited by remote attackers to execute code in ...

CVE-2021-38389 Advantech WebAccess

Advantech WebAccess versions 9.02 and prior are vulnerable to a stack-based buffer overflow, which may allow an attacker to remotely execute code...

CVE-2021-33023

Advantech WebAccess (HMI/SCADA) is affected by CVE-2021-33023: a heap-based buffer overflow in handling IOCTL 0x2722 can enable remote code execution. Affected products are WebAccess versions 9.02 and earlier. The vulnerability allows code execution with high privileges and requires no authentica...

CVE-2021-33023 Advantech WebAccess

Advantech WebAccess versions 9.02 and prior are vulnerable to a heap-based buffer overflow, which may allow an attacker to remotely execute code...

PT-2021-22103

Name of the Vulnerable Software and Affected Versions Advantech WebAccess versions 9.02 and prior Description The issue is a stack-based buffer overflow that may allow an attacker to remotely execute code. Recommendations For Advantech WebAccess versions 9.02 and prior, update to a version later...

CVE-2021-38389: Stack-based Buffer Overflow

Advantech WebAccess versions 9.02 and prior are vulnerable to a stack-based buffer overflow, which may allow an attacker to remotely execute code...

CVE-2021-33023: Heap-based Buffer Overflow

Advantech WebAccess versions 9.02 and prior are vulnerable to a heap-based buffer overflow, which may allow an attacker to remotely execute code...

PT-2021-20022

Name of the Vulnerable Software and Affected Versions Advantech WebAccess versions 9.02 and prior Description The issue is a heap-based buffer overflow that may allow an attacker to remotely execute code. Recommendations For Advantech WebAccess versions 9.02 and prior, update to a version later...

CVE-2021-38431

An authenticated user using Advantech WebAccess SCADA in versions 9.0.3 and prior can use API functions to disclose project names and paths from other users...

CVE-2021-38431

An authenticated user using Advantech WebAccess SCADA in versions 9.0.3 and prior can use API functions to disclose project names and paths from other users...

Design/Logic Flaw

An authenticated user using Advantech WebAccess SCADA in versions 9.0.3 and prior can use API functions to disclose project names and paths from other users...

CVE-2021-38431

CVE-2021-38431 affects Advantech WebAccess SCADA (WebAccess/SCADA) versions 9.0.3 and earlier. An authenticated user can use API functions to disclose project names and paths from other users due to a missing authorization issue (CWE-862). The CVSS v3 base score is 4.3 (Network, Low attack comple...

CVE-2021-38431: Missing Authorization

An authenticated user using Advantech WebAccess SCADA in versions 9.0.3 and prior can use API functions to disclose project names and paths from other users...

PT-2021-22124

Name of the Vulnerable Software and Affected Versions Advantech WebAccess SCADA versions 9.0.3 and prior Description The issue allows an authenticated user to disclose project names and paths from other users using API functions. Recommendations For Advantech WebAccess SCADA versions 9.0.3 and...