CVE-2012-1234

CVE-2012-1234 describes an SQL injection in Advantech/BroadWin WebAccess 7.0 where remote authenticated users can execute arbitrary SQL via a malformed URL. The entry notes this vulnerability exists due to an incomplete fix for CVE-2012-0234. Connected records confirm affected product is Advantec...

CVE-2012-0237

Advantech/BroadWin WebAccess before 7.0 allows remote attackers to 1 enable date and time syncing or 2 disable date and time syncing via a crafted URL...

CVE-2011-4522

Cross-site scripting XSS vulnerability in bwerrdn.asp in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters...

PT-2012-1899

Name of the Vulnerable Software and Affected Versions Advantech/BroadWin WebAccess versions prior to 7.0 Description The issue allows remote attackers to execute arbitrary SQL commands via crafted string input, potentially leading to unauthorized data access or modification. Recommendations For...

CVE-2011-4521: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary SQL commands via crafted string input...

PT-2012-2432

Name of the Vulnerable Software and Affected Versions Advantech/BroadWin WebAccess versions prior to 7.0 Description The issue allows remote attackers to cause a denial of service, resulting in memory corruption, by modifying a stream identifier to a function. Recommendations For versions prior t...

PT-2012-1901

Name of the Vulnerable Software and Affected Versions Advantech/BroadWin WebAccess versions prior to 7.0 Description The issue is related to a cross-site scripting XSS vulnerability. This allows remote attackers to inject arbitrary web script or HTML via unspecified parameters in the bwview.asp...

PT-2012-1900

Name of the Vulnerable Software and Affected Versions Advantech/BroadWin WebAccess versions prior to 7.0 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via unspecified parameters in the bwerrdn.asp file. Recommendations For...

PT-2012-1902

Name of the Vulnerable Software and Affected Versions Advantech/BroadWin WebAccess versions prior to 7.0 Description The issue allows remote attackers to execute arbitrary code via a long string value in unspecified parameters. Recommendations For versions prior to 7.0, update to version 7.0 or...

PT-2012-2424

Name of the Vulnerable Software and Affected Versions Advantech/BroadWin WebAccess versions prior to 7.0 Description The issue is related to a cross-site scripting XSS vulnerability, which allows remote attackers to inject arbitrary web script or HTML via a malformed URL. Recommendations For...

PT-2012-2428

Name of the Vulnerable Software and Affected Versions Advantech/BroadWin WebAccess versions prior to 7.0 Description The issue allows remote attackers to either enable or disable date and time syncing by using a crafted URL. Recommendations For versions prior to 7.0, update to version 7.0 or late...

PT-2012-2426

Name of the Vulnerable Software and Affected Versions Advantech/BroadWin WebAccess versions prior to 7.0 Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of victims via unknown vectors. Recommendations For versions prior to 7.0, update to...

PT-2012-2433

Name of the Vulnerable Software and Affected Versions Advantech/BroadWin WebAccess versions prior to 7.0 Description The issue allows remote attackers to execute arbitrary code via format string specifiers in a message string. Recommendations For versions prior to 7.0, update to version 7.0 or...

CVE-2011-4526: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in an ActiveX control in Advantech/BroadWin WebAccess before 7.0 might allow remote attackers to execute arbitrary code via a long string value in unspecified parameters...

CVE-2012-0240: Improper Authentication

GbScriptAddUp.asp in Advantech/BroadWin WebAccess before 7.0 does not properly perform authentication, which allows remote attackers to execute arbitrary code via unspecified vectors...

CVE-2012-0244: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Advantech/BroadWin WebAccess before 7.0 allow remote attackers to execute arbitrary SQL commands via crafted string input...

CVE-2012-1234: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Advantech/BroadWin WebAccess 7.0 allows remote authenticated users to execute arbitrary SQL commands via a malformed URL. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0234...

CVE-2012-0242: Use of Externally-Controlled Format String

Format string vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary code via format string specifiers in a message string...

CVE-2012-0241: Improper Restriction of Operations within the Bounds of a Memory Buffer

Advantech/BroadWin WebAccess before 7.0 allows remote attackers to cause a denial of service memory corruption via a modified stream identifier to a function...

CVE-2012-0233: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to inject arbitrary web script or HTML via a malformed URL...