CVE-2011-4522

Cross-site scripting XSS vulnerability in bwerrdn.asp in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters...

CVE-2012-0237

Advantech/BroadWin WebAccess before 7.0 allows remote attackers to 1 enable date and time syncing or 2 disable date and time syncing via a crafted URL...

CVE-2011-4525

Advantech/BroadWin WebAccess before 7.0 allows remote attackers to trigger the extraction of arbitrary web content into a batch file on a client system, and execute this batch file, via unspecified vectors...

CVE-2012-0234

SQL injection vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary SQL commands via a malformed URL...

CVE-2012-0239

uaddUpAdmin.asp in Advantech/BroadWin WebAccess before 7.0 does not properly perform authentication, which allows remote attackers to modify an administrative password via a password-change request...

CVE-2012-0244

Multiple SQL injection vulnerabilities in Advantech/BroadWin WebAccess before 7.0 allow remote attackers to execute arbitrary SQL commands via crafted string input...

CVE-2012-0238

CVE-2012-0238 affects Advantech/BroadWin WebAccess prior to 7.0. A stack-based buffer overflow in opcImg.asp could allow a remote attacker to execute arbitrary code. ICS-CERT notes multiple vulnerabilities in WebAccess 7.0 era; public exploits exist for these issues. Mitigation: Advantech release...

CVE-2012-0237

Advantech/BroadWin WebAccess before version 7.0 is affected by CVE-2012-0237, a remote vulnerability that allows an unauthenticated attacker to enable or disable date/time syncing via a crafted URL. The NVD entry (CVSS2 base score 6.4, Network vector, no authentication, partial integrity/availabi...

CVE-2012-0234

Summary (useful, grounded in provided docs): CVE-2012-0234 (and related entries) describe an SQL injection flaw in Advantech/BroadWin WebAccess prior to 7.0, exploitable by remote authenticated users via a malformed URL to execute arbitrary SQL commands. Connected materials confirm WebAccess 7.0 ...

CVE-2011-4526

Advantech/BroadWin WebAccess prior to version 7.0 is affected by a vulnerability in an ActiveX control that can cause a stack/heap buffer overflow when processing a long string value in unspecified parameters. This could allow remote code execution on the server by an attacker sending a crafted r...

CVE-2011-4523

The CVE-2011-4523 issue affects Advantech/BroadWin WebAccess prior to version 7.0, where bwview.asp is vulnerable to cross-site scripting (XSS) via unspecified parameters, allowing remote attackers to inject arbitrary script or HTML. Public advisories describe the vulnerability class as XSS in th...

CVE-2011-4522

CVE-2011-4522 is a Cross-site Scripting (XSS) vulnerability in Advantech/BroadWin WebAccess prior to version 7.0, affecting the file bwerrdn.asp. The issue allows remote attackers to inject arbitrary web script or HTML via unspecified parameters. Multiple connected sources document this XSS vulne...

CVE-2012-0235

Cross-site request forgery CSRF vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

CVE-2012-0241

Advantech/BroadWin WebAccess prior to version 7.0 is affected by CVE-2012-0241, where a remote attacker can trigger memory corruption by supplying a modified stream identifier to a function, resulting in denial of service. The vulnerability is part of a broader set described in ICS-CERT advisorie...

CVE-2011-4523

Cross-site scripting XSS vulnerability in bwview.asp in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters...

CVE-2012-0240

CVE-2012-0240 affects Advantech/BroadWin WebAccess prior to version 7.0. The vulnerability is in GbScriptAddUp.asp where authentication is not performed properly, allowing remote attackers to execute arbitrary code via unspecified vectors. The issue is remotely exploitable and public exploits are...

CVE-2011-4521

CVE-2011-4521 describes an SQL injection vulnerability in Advantech/BroadWin WebAccess prior to version 7.0, allowing remote attackers to execute arbitrary SQL commands via crafted string input. Affected product: Advantech/BroadWin WebAccess (pre-7.0). Root cause centers on unsanitized input hand...

CVE-2012-1235

CVE-2012-1235 affects Advantech/BroadWin WebAccess 7.0 with a Cross-Site Request Forgery (CSRF) flaw that can allow remote authenticated users to hijack the authentication of unspecified victims, stemming from an incomplete fix for CVE-2012-0235. The ICS-CERT advisory notes that Advantech release...

CVE-2012-1234

CVE-2012-1234 describes an SQL injection in Advantech/BroadWin WebAccess 7.0 where remote authenticated users can execute arbitrary SQL via a malformed URL. The entry notes this vulnerability exists due to an incomplete fix for CVE-2012-0234. Connected records confirm affected product is Advantec...

CVE-2012-0242

CVE-2012-0242 : A format-string vulnerability in Advantech/BroadWin WebAccess prior to 7.0 allows remote execution of arbitrary code via a crafted message string. Public advisories note that attacks can be remote and exploitable for full control. ICS-CERT summarizes the impact as bypassing authen...