CVE-2015-3946

Cross-site request forgery CSRF vulnerability in Advantech WebAccess before 8.1 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

CVE-2015-3948

Cross-site scripting XSS vulnerability in Advantech WebAccess before 8.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-6467

Advantech WebAccess before 8.1 allows remote attackers to execute arbitrary code via vectors involving a browser plugin...

CVE-2015-3943

Advantech WebAccess CVE-2015-3943: An information-disclosure vulnerability in WebAccess versions before 8.1 allows remote attackers to read cleartext data from e-mail project accounts. Connected sources (ICS-CERT advisory ICSA-16-014-01, CNVD entries, NVD record) confirm the root cause involves i...

CVE-2015-6467

CVE-2015-6467 affects Advantech WebAccess (HMI/SCADA) prior to version 8.1. The vulnerability is a remote code execution via a browser plugin, allowing an attacker to run arbitrary code on the target. Connected sources confirm a remote-exploit scenario and that Advantech released WebAccess 8.1 to...

CVE-2016-0854

Affected product: Advantech WebAccess, specifically the Dashboard Viewer component of WebAccess prior to version 8.1. Vulnerability summary: Unrestricted upload of a file with dangerous type via the UploadAjaxAction script (uploadImageCommon/uploadFile/uploadBannerImage paths) in the WebAccess Da...

CVE-2015-3946

CVE-2015-3946 (Advantech WebAccess) : A CSRF vulnerability exists in WebAccess prior to version 8.1 that can allow remote attackers to hijack user authentication. Affected product: Advantech WebAccess (HMI/SCADA software). Root cause: cross-site request forgery enabling unauthorized actions in au...

CVE-2016-0855

CVE-2016-0855 concerns Advantech WebAccess (pre-8.1). The vulnerability is a directory traversal in the WebAccess Dashboard/Viewer that could allow remote attackers to list arbitrary files in a virtual directory via unspecified vectors. Public references from ZDI describe related dashboard viewer...

CVE-2015-3947

Advantech WebAccess (before 8.1) is affected by a SQL Injection vulnerability (CWE-89) that allows remote authenticated users to execute arbitrary SQL commands, potentially modifying web server settings, accounts, and projects. Root cause details are described in PT-2016-03: SQL Injection in WebA...

CVE-2015-3947

SQL injection vulnerability in Advantech WebAccess before 8.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors...

CVE-2016-0853

Advantech WebAccess before 8.1 allows remote attackers to obtain sensitive information via crafted input...

CVE-2016-0856

CVE-2016-0856 affects Advantech WebAccess (pre-8.1). The root cause is a stack-based buffer overflow in the bwconn.dll RpcWebClientConnect path (IoRequest structure) that can be triggered remotely to execute arbitrary code. Public PoCs and PoC-style repositories on Gitee describe a Python/ctypes-...

CVE-2015-3948

Summary : CVE-2015-3948 is a cross-site scripting (XSS) vulnerability in Advantech WebAccess prior to 8.1. The issue allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. According to NVD, the CVSS base score (v3) is 5.4 (Medium) with network access, lo...

PT-2016-4420

Name of the Vulnerable Software and Affected Versions Advantech WebAccess versions prior to 8.1 Description The issue allows remote attackers to bypass an intended administrative requirement, which can lead to unauthorized access to files or folders. Recommendations For Advantech WebAccess versio...

PT-2016-1121

Name of the Vulnerable Software and Affected Versions Advantech WebAccess versions prior to 8.1 Description The issue is related to an unrestricted file upload vulnerability. This vulnerability can be exploited by a remote attacker to modify files of any type. The vulnerability is associated with...

PT-2016-4421

Name of the Vulnerable Software and Affected Versions Advantech WebAccess versions prior to 8.1 Description The issue allows remote attackers to obtain sensitive information via crafted input. Recommendations For versions prior to 8.1, update to version 8.1 or later to resolve the issue...

PT-2016-1124

Name of the Vulnerable Software and Affected Versions Advantech WebAccess versions prior to 8.1 Description The issue is caused by an integer overflow in the Kernel service of Advantech WebAccess. This can be exploited by a remote attacker using a specially crafted RPC request, potentially allowi...

PT-2016-4419

Name of the Vulnerable Software and Affected Versions Advantech WebAccess versions prior to 8.1 Description The issue allows remote attackers to cause a denial of service due to out-of-bounds memory access. Additionally, there is a remote code execution vulnerability via an uncontrolled format...

PT-2016-4423

Name of the Vulnerable Software and Affected Versions Advantech WebAccess versions prior to 8.1 Description The issue is related to a race condition that allows remote attackers to execute arbitrary code or cause a denial of service via a crafted request, potentially leading to a buffer overflow...

PT-2016-4422

Name of the Vulnerable Software and Affected Versions Advantech WebAccess versions prior to 8.1 Description The issue allows remote attackers to list arbitrary virtual-directory files via unspecified vectors. It also enables directory traversal, which can lead to arbitrary file deletion, denial o...