EUVD-2018-6700

Malware in sbrugna...

Directory traversal

WADashboard API in Advantech WebAccess 8.3.1 and 8.3.2 allows remote authenticated attackers to read any file on the filesystem due to a directory traversal vulnerability in the readFile API...

Arbitrary file deletion

Advantech WebAccess 8.3.1 and earlier has a .dll component that is susceptible to external control of file name or path vulnerability, which may allow an arbitrary file deletion when processing...

CVE-2018-14820

Advantech WebAccess 8.3.1 and earlier are affected by CVE-2018-14820 due to a .dll component that permits external control of file name or path, enabling arbitrary file deletion when processing. Exploitation is described as remote and unauthenticated in vendor advisories and ZDI reports, with the...

CVE-2018-14828

Advantech WebAccess 8.3.1 and earlier has an improper privilege management vulnerability, which may allow an attacker to access those files and perform actions at a system administrator level...