Stack overflow

Multiple stack-based buffer overflows in Advantech WebAccess before 8.1 allow remote attackers to execute arbitrary code via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in Advantech WebAccess before 8.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

Design/Logic Flaw

Advantech WebAccess before 8.1 allows remote attackers to read sensitive cleartext information about e-mail project accounts via unspecified vectors...

Input validation

Advantech WebAccess before 8.1 allows remote attackers to obtain sensitive information via crafted input...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Advantech WebAccess before 8.1 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

Out-of-bounds

Advantech WebAccess before 8.1 allows remote attackers to cause a denial of service out-of-bounds memory access via unspecified vectors...

CVE-2015-3943

Advantech WebAccess before 8.1 allows remote attackers to read sensitive cleartext information about e-mail project accounts via unspecified vectors...

Buffer overflow

Buffer overflow in the BwpAlarm subsystem in Advantech WebAccess before 8.1 allows remote attackers to cause a denial of service via a crafted RPC request...

Directory traversal

Directory traversal vulnerability in Advantech WebAccess before 8.1 allows remote attackers to list arbitrary virtual-directory files via unspecified vectors...

Design/Logic Flaw

Advantech WebAccess before 8.1 allows remote attackers to bypass an intended administrative requirement and obtain file or folder access via unspecified vectors...

Sql injection

SQL injection vulnerability in Advantech WebAccess before 8.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors...

CVE-2016-0858

Race condition in Advantech WebAccess before 8.1 allows remote attackers to execute arbitrary code or cause a denial of service buffer overflow via a crafted request...

CVE-2016-0852

Advantech WebAccess before 8.1 allows remote attackers to bypass an intended administrative requirement and obtain file or folder access via unspecified vectors...

CVE-2016-0854

Unrestricted file upload vulnerability in the uploadImageCommon function in the UploadAjaxAction script in the WebAccess Dashboard Viewer in Advantech WebAccess before 8.1 allows remote attackers to write to files of arbitrary types via unspecified vectors...

CVE-2016-0854

Affected product: Advantech WebAccess, specifically the Dashboard Viewer component of WebAccess prior to version 8.1. Vulnerability summary: Unrestricted upload of a file with dangerous type via the UploadAjaxAction script (uploadImageCommon/uploadFile/uploadBannerImage paths) in the WebAccess Da...

CVE-2015-3948

Cross-site scripting XSS vulnerability in Advantech WebAccess before 8.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-3946

Cross-site request forgery CSRF vulnerability in Advantech WebAccess before 8.1 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

CVE-2016-0853

Advantech WebAccess before 8.1 allows remote attackers to obtain sensitive information via crafted input...

CVE-2016-0857

Multiple heap-based buffer overflows in Advantech WebAccess before 8.1 allow remote attackers to execute arbitrary code via unspecified vectors...

CVE-2016-0851

CVE-2016-0851 affects Advantech WebAccess prior to 8.1. The issue arises from a memory safety flaw (out-of-bounds access) that can be triggered remotely, leading to a denial of service. ZDI documents a separate vulnerable path in the BwOpcSvc.dll 0x13881 IOCTL implementation, described as an unco...