Advantech WebAccess Cross-Site Scripting Vulnerability (CNVD-2021-42395)

Advantech WebAccess is a set of HMI/SCADA software based on browser architecture from Advantech, Taiwan, China. The software supports dynamic graphic display and real-time data control, and provides remote control and management of automation equipment. A security vulnerability exists in Advantec...

Advantech WebAccess/SCADA 路径遍历漏洞

Advantech WebAccess/SCADA is a suite of SCADA software from Advantech based on a browser architecture. The software supports dynamic graphical displays and real-time data control, and provides the ability to remotely control and manage automation equipment. A relative path traversal vulnerability...

Advantech WebAccess/SCADA 输入验证错误漏洞

Advantech WebAccess/SCADA is a suite of SCADA software from Advantech based on a browser architecture. The software supports dynamic graphical displays and real-time data control, and provides the ability to remotely control and manage automation equipment. An open redirection vulnerability exist...

Advantech WebAccess/SCADA (Update A)

1. EXECUTIVE SUMMARY CVSS v3 7.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Advantech Equipment: WebAccess/SCADA Vulnerabilities: Open Redirect, Relative Path Traversal 2. UPDATE INFORMATION This updated advisory is a follow-up to the original advisory titled ICSA-21-168-03...

CVE-2021-34540

Advantech WebAccess 8.4.2 and 8.4.4 allows XSS via the username column of the bwRoot.asp page of WADashboard...

CVE-2021-34540

Advantech WebAccess 8.4.2 and 8.4.4 allows XSS via the username column of the bwRoot.asp page of WADashboard...

CVE-2021-34540

Advantech WebAccess 8.4.2 and 8.4.4 allows XSS via the username column of the bwRoot.asp page of WADashboard...

Cross site scripting

Advantech WebAccess 8.4.2 and 8.4.4 allows XSS via the username column of the bwRoot.asp page of WADashboard...

CVE-2021-34540

Advantech WebAccess 8.4.2 and 8.4.4 allows XSS via the username column of the bwRoot.asp page of WADashboard...

CVE-2021-34540

Affected software: Advantech WebAccess 8.4.2 and 8.4.4. Vulnerability: Cross-site scripting (XSS) via the username field on the bwRoot.asp page of the WADashboard. Root cause/condition: reflected/injected XSS context is implied by the description, but explicit technical details about the root cau...

PT-2021-20537

Name of the Vulnerable Software and Affected Versions: Advantech WebAccess versions 8.4.2 through 8.4.4 Description: The issue allows for cross-site scripting XSS attacks via the username column of the "bwRoot.asp" page of WADashboard. This occurs because the application does not properly validat...

CVE-2021-34540: Improper Neutralization of Input During Web Page Generation

Advantech WebAccess 8.4.2 and 8.4.4 allows XSS via the username column of the bwRoot.asp page of WADashboard...

Advantech WebAccess 跨站脚本漏洞

Advantech WebAccess is a set of HMI/SCADA software based on browser architecture from Advantech, Taiwan, China. The software supports dynamic graphic display and real-time data control, and provides remote control and management of automation equipment. A security vulnerability exists in Advantec...

PT-2021-19978

Name of the Vulnerable Software and Affected Versions Advantech iView versions prior to v5.7.03.6182 Description The issue is related to missing authentication in the configuration of the affected product, potentially allowing an attacker to modify configurations and execute arbitrary code...

PT-2021-19980

Name of the Vulnerable Software and Affected Versions Advantech iView versions prior to v5.7.03.6182 Description The issue allows an unauthorized attacker to disclose information due to a SQL injection vulnerability. It affects various functions, including findUpdateDeviceListDetails,...

Advantech iView getInventoryReportData SQL Injection Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech iView. Authentication is not required to exploit this vulnerability. The specific flaw exists within the getInventoryReportData action of NetworkServlet, which listens on TCP port...

Advantech iView saveZtpConfig SQL Injection Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech iView. Authentication is not required to exploit this vulnerability. The specific flaw exists within the saveZtpConfig action of NetworkServlet, which listens on TCP port 8080 by...

Advantech iView NetworkServlet getPSInventoryInfo SQL Injection Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech iView. Authentication is not required to exploit this vulnerability. The specific flaw exists within the NetworkServlet class. The issue results from the lack of proper validation o...

Advantech iView getAllActiveTraps SQL Injection Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech iView. Authentication is not required to exploit this vulnerability. The specific flaw exists within the getAllActiveTraps action of NetworkServlet, which listens on TCP port 8080 b...

Advantech iView setDeviceAuthentication SQL Injection Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech iView. Authentication is not required to exploit this vulnerability. The specific flaw exists within the setDeviceAuthentication action of NetworkServlet, which listens on TCP port...