3749 matches found
PT-2025-29187 · Advantech · Advantech Iview
Name of the Vulnerable Software and Affected Versions: Advantech iView affected versions not specified Description: A vulnerability exists in Advantech iView that allows for argument injection in the NetworkServlet.restoreDatabase function. An authenticated attacker with user-level privileges can...
PT-2025-29188 · Advantech · Advantech Iview
Name of the Vulnerable Software and Affected Versions: Advantech iView affected versions not specified Description: A vulnerability exists in Advantech iView that allows for SQL injection and remote code execution. The issue is located in the NetworkServlet.archiveTrap function and requires an...
PT-2025-29183 · Advantech · Advantech Iview
Name of the Vulnerable Software and Affected Versions: Advantech iView affected versions not specified Description: A vulnerability exists in Advantech iView that allows for argument injection in the NetworkServlet.backupDatabase function. An authenticated attacker with user-level privileges can...
PT-2025-29127 · Advantech · Iview
Name of the Vulnerable Software and Affected Versions: Advantech iView versions prior to 5.7.05 build 7057 Description: A flaw exists that could allow a reflected cross-site scripting XSS attack. Exploitation of this issue may allow an attacker to execute unauthorized scripts in the user's browse...
PT-2025-29175 · Advantech · Advantech Iview
Name of the Vulnerable Software and Affected Versions: Advantech iView versions prior to 5.7.05 build 7057 Description: A reflected cross-site scripting XSS issue exists. By manipulating certain input parameters, an attacker could execute unauthorized scripts in the user's browser, potentially...
PT-2025-29186 · Advantech · Advantech Iview
Name of the Vulnerable Software and Affected Versions: Advantech iView affected versions not specified Description: A vulnerability exists in Advantech iView that could allow for SQL injection and remote code execution. The issue resides in the NetworkServlet.getNextTrapPage function, where certa...
PT-2025-29177 · Advantech · Advantech Iview
Name of the Vulnerable Software and Affected Versions: Advantech iView affected versions not specified Description: A SQL injection issue exists in Advantech iView, potentially allowing an authenticated attacker with user-level privileges to disclose information or cause a denial-of-service...
PT-2025-29176 · Advantech · Advantech Iview
Name of the Vulnerable Software and Affected Versions: Advantech iView affected versions not specified Description: A directory traversal issue exists in the NetworkServlet.processImportRequest function. An authenticated attacker with user-level privileges can exploit this issue due to improper...
CVE-2024-37187
Advantech ADAM-5550 share user credentials with a low level of encryption, consisting of base 64 encoding...
CVE-2024-50377
A CWE-798 "Use of Hard-coded Credentials" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G = 1.6.3, EKI-6333AC-2GD = v1.6.3 and EKI-6333AC-1GPO = v1.2.1. The vulnerability is associated to the backup configuration functionality that by default encrypts the...
CVE-2023-2866
If an attacker can trick an authenticated user into loading a maliciously crafted .zip file onto Advantech WebAccess version 8.4.5, a web shell could be used to give the attacker full control of the SCADA server...
CVE-2023-5642
Advantech R-SeeNet v2.4.23 allows an unauthenticated remote attacker to read from and write to the snmpmon.ini file, which contains sensitive information...
CVE-2023-3983
An authenticated SQL injection vulnerability exists in Advantech iView versions prior to v5.7.4 build 6752. An authenticated remote attacker can bypass checks in com.imc.iview.utils.CUtils.checkSQLInjection to perform blind SQL injection...
CVE-2023-1437
All versions prior to 9.1.4 of Advantech WebAccess/SCADA are vulnerable to use of untrusted pointers. The RPC arguments the client sent could contain raw memory pointers for the server to use as-is. This could allow an attacker to gain access to the remote file system and the ability to execute...
CVE-2022-3323
An SQL injection vulnerability in Advantech iView 5.7.04.6469. The specific flaw exists within the ConfigurationServlet endpoint, which listens on TCP port 8080 by default. An unauthenticated remote attacker can craft a special columnvalue parameter in the setConfiguration action to bypass checks...
CVE-2021-21915
An exploitable SQL injection vulnerability exist in the ‘grouplist’ page of the Advantech R-SeeNet 2.4.15 30.07.2021. A specially-crafted HTTP request at ‘companyfilter’ parameter. An attacker can make authenticated HTTP requests to trigger this vulnerability. This can be done as any authenticate...
CVE-2021-21804
A local file inclusion LFI vulnerability exists in the options.php script functionality of Advantech R-SeeNet v 2.4.12 20.10.2020. A specially crafted HTTP request can lead to arbitrary PHP code execution. An attacker can send a crafted HTTP request to trigger this vulnerability...
CVE-2021-38408
A stack-based buffer overflow vulnerability in Advantech WebAccess Versions 9.02 and prior caused by a lack of proper validation of the length of user-supplied data may allow remote code execution...
CVE-2021-21911
A privilege escalation vulnerability exists in the Windows version of installation for Advantech R-SeeNet Advantech R-SeeNet 2.4.15 30.07.2021. A specially-crafted file can be replaced in the system to escalate privileges to NT SYSTEM authority. An attacker can provide a malicious file to trigger...