Cross site scripting

Advantech WebAccess 8.3.1 and 8.3.2 are vulnerable to cross-site scripting in the Bwmainleft.asp page. An attacker could leverage this vulnerability to disclose credentials amongst other things...

CVE-2018-15707

Advantech WebAccess 8.3.1 and 8.3.2 are vulnerable to cross-site scripting in the Bwmainleft.asp page. An attacker could leverage this vulnerability to disclose credentials amongst other things...

CVE-2018-15706

WADashboard API in Advantech WebAccess 8.3.1 and 8.3.2 allows remote authenticated attackers to read any file on the filesystem due to a directory traversal vulnerability in the readFile API...

CVE-2018-15707

Advantech WebAccess 8.3.1 and 8.3.2 are vulnerable to cross-site scripting in the Bwmainleft.asp page. An attacker could leverage this vulnerability to disclose credentials amongst other things...

CVE-2018-15706

WADashboard API in Advantech WebAccess 8.3.1 and 8.3.2 allows remote authenticated attackers to read any file on the filesystem due to a directory traversal vulnerability in the readFile API...

Directory traversal

WADashboard API in Advantech WebAccess 8.3.1 and 8.3.2 allows remote authenticated attackers to read any file on the filesystem due to a directory traversal vulnerability in the readFile API...

CVE-2018-15707

Advantech WebAccess 8.3.1 and 8.3.2 are vulnerable to cross-site scripting in the Bwmainleft.asp page. An attacker could leverage this vulnerability to disclose credentials amongst other things...

CVE-2018-15707

Advantech WebAccess 8.3.1/8.3.2 are affected by a Bwmainleft.asp cross-site scripting vulnerability (CVE-2018-15707). The XSS can disclose credentials among other data. Connected sources include exploit listings and writeups illustrating the vulnerability and, in at least one reference, that user...

CVE-2018-15705

Summary: CVE-2018-15705 is a directory traversal vulnerability in Advantech WebAccess WADashboard API (writeFile) that allows remote authenticated attackers to write/overwrite arbitrary files and potentially execute arbitrary code. Affected versions include 8.3.1 and 8.3.2. The root cause is inad...

CVE-2018-15706

WADashboard API in Advantech WebAccess 8.3.1 and 8.3.2 allows remote authenticated attackers to read any file on the filesystem due to a directory traversal vulnerability in the readFile API...

CVE-2018-15706

The CVE-2018-15706 vulnerability affects Advantech WebAccess WADashboard API (versions 8.3.1 and 8.3.2). The readFile API is vulnerable to a directory traversal flaw that allows remote authenticated attackers to read arbitrary files on the server filesystem. The issue is caused by insufficient va...

Advantech WebAccess Node Improper Access Control Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on vulnerable installations of Advantech WebAccess Node. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the access...

Advantech WebAccess Client bwswfcfg Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Advantech WebAccess Client. Authentication is not required to exploit this vulnerability. The specific flaw exists within bwswfcfg.exe, which is accessed through the 0x2711 IOCTL in the webvrpcs...

Advantech WebAccess stack buffer overflow vulnerability (CNVD-2018-21937)

Advantech WebAccess software is the core of Advantech's IoT application platform solution, providing users with a user interface based on HTML5 technology for a cross-platform, cross-browser data access experience. A stack buffer overflow vulnerability exists in Advantech WebAccess. The...

Advantech WebAccess Improper Access Control Vulnerability

Advantech WebAccess software is the core of Advantech's IoT application platform solution, providing users with a user interface based on HTML5 technology for a cross-platform, cross-browser data access experience. An improper access control vulnerability exists in Advantech WebAccess. The...

Advantech WebAccess

1. EXECUTIVE SUMMARY CVSS v3 8.4 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Advantech Equipment: WebAccess Vulnerabilities: Improper Access Control, Stack-based Buffer Overflow 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow for arbitrary...

Advantech WebAccess Node Product Installation File Access Control Modification Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on vulnerable installations of Advantech WebAccess Node. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the acces...

Advantech WebAccess Node webvrpcs ViewDll1 Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Advantech WebAccess Node. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the 0x138bd IOCTL in the webvrpcs process. The issue...

Advantech WebAccess Client bwwebv Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Advantech WebAccess Node. Authentication is not required to exploit this vulnerability. The specific flaw exists within bwwebv.exe, which is accessed through the 0x2711 IOCTL in the webvrpcs proces...

Advantech WebAccess Client bwclrptw Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Advantech WebAccess Node. Authentication is not required to exploit this vulnerability. The specific flaw exists within BwCLRptw.exe, which is accessed through the 0x2711 IOCTL in the webvrpcs...