CVE-2012-0233: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to inject arbitrary web script or HTML via a malformed URL...

CVE-2012-0239: Improper Authentication

uaddUpAdmin.asp in Advantech/BroadWin WebAccess before 7.0 does not properly perform authentication, which allows remote attackers to modify an administrative password via a password-change request...

CVE-2012-1235: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in Advantech/BroadWin WebAccess 7.0 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0235...

CVE-2011-4522: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in bwerrdn.asp in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters...

CVE-2011-1914: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in the Advantech ADAM OLE for Process Control OPC Server ActiveX control in ADAM OPC Server before 3.01.012, Modbus RTU OPC Server before 3.01.010, and Modbus TCP OPC Server before 3.01.010 allows remote attackers to execute arbitrary code via unspecified vectors...

CVE-2012-0243: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in an ActiveX control in bwocxrun.ocx in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary code by leveraging the ability to write arbitrary content to any pathname...

CVE-2011-4523: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in bwview.asp in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters...

CVE-2011-4524: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary code via a long string value in unspecified parameters...

CVE-2011-4525: Undefined Security Weakness

Advantech/BroadWin WebAccess before 7.0 allows remote attackers to trigger the extraction of arbitrary web content into a batch file on a client system, and execute this batch file, via unspecified vectors...

CVE-2012-0234: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary SQL commands via a malformed URL...

CVE-2012-0235: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

CVE-2012-0236: Exposure of Sensitive Information to an Unauthorized Actor

Advantech/BroadWin WebAccess 7.0 and earlier allows remote attackers to obtain sensitive information via a direct request to a URL. NOTE: the vendor reportedly "does not consider it to be a security risk."...

PT-2012-3151

Name of the Vulnerable Software and Affected Versions Advantech/BroadWin WebAccess version 7.0 Description The issue allows remote authenticated users to execute arbitrary SQL commands via a malformed URL. This is due to an incomplete fix for a previous security issue. Recommendations For...

CVE-2012-0237: Improper Restriction of Operations within the Bounds of a Memory Buffer

Advantech/BroadWin WebAccess before 7.0 allows remote attackers to 1 enable date and time syncing or 2 disable date and time syncing via a crafted URL...

PT-2012-2435

Name of the Vulnerable Software and Affected Versions Advantech/BroadWin WebAccess versions prior to 7.0 Description The issue allows remote attackers to execute arbitrary SQL commands via crafted string input, potentially leading to unauthorized data access or modification. Recommendations For...

PT-2012-3152

Name of the Vulnerable Software and Affected Versions Advantech/BroadWin WebAccess version 7.0 Description A cross-site request forgery CSRF issue exists, allowing remote authenticated users to hijack the authentication of unspecified victims. This issue is a result of an incomplete fix for a...

PT-2012-1904

Name of the Vulnerable Software and Affected Versions Advantech/BroadWin WebAccess versions prior to 7.0 Description The issue is related to a buffer overflow in an ActiveX control. This might allow remote attackers to execute arbitrary code via a long string value in unspecified parameters...

PT-2012-1536

Name of the Vulnerable Software and Affected Versions Advantech ADAM OPC Server version 3.01.012 and earlier Advantech Modbus RTU OPC Server version 3.01.010 and earlier Advantech Modbus TCP OPC Server version 3.01.010 and earlier Description The issue is related to a buffer overflow in the Activ...

PT-2012-2429

Name of the Vulnerable Software and Affected Versions Advantech/BroadWin WebAccess versions prior to 7.0 Description The issue is a stack-based buffer overflow in the opcImg.asp file, which allows remote attackers to execute arbitrary code. The exact vectors used for the attack are not specified...

PT-2012-2434

Name of the Vulnerable Software and Affected Versions Advantech/BroadWin WebAccess versions prior to 7.0 Description The issue is related to a buffer overflow in an ActiveX control in bwocxrun.ocx. This allows remote attackers to execute arbitrary code by writing arbitrary content to any pathname...