PT-2016-1125

Name of the Vulnerable Software and Affected Versions Advantech WebAccess versions prior to 8.1 Description The issue is caused by a buffer overflow in the BwpAlarm subsystem, allowing remote attackers to cause a denial of service via a crafted RPC request. This can be exploited by sending a...

PT-2016-1122

Name of the Vulnerable Software and Affected Versions Advantech WebAccess versions prior to 8.1 Description The issue is caused by multiple stack-based buffer overflows in Advantech WebAccess. Exploitation of these overflows may allow a remote attacker to execute arbitrary code. The overflows occ...

CVE-2015-3943: Exposure of Sensitive Information to an Unauthorized Actor

Advantech WebAccess before 8.1 allows remote attackers to read sensitive cleartext information about e-mail project accounts via unspecified vectors...

CVE-2016-0858: Improper Restriction of Operations within the Bounds of a Memory Buffer

Race condition in Advantech WebAccess before 8.1 allows remote attackers to execute arbitrary code or cause a denial of service buffer overflow via a crafted request...

CVE-2016-0857: Improper Restriction of Operations within the Bounds of a Memory Buffer

Multiple heap-based buffer overflows in Advantech WebAccess before 8.1 allow remote attackers to execute arbitrary code via unspecified vectors...

CVE-2016-0853: Exposure of Sensitive Information to an Unauthorized Actor

Advantech WebAccess before 8.1 allows remote attackers to obtain sensitive information via crafted input...

CVE-2016-0855: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in Advantech WebAccess before 8.1 allows remote attackers to list arbitrary virtual-directory files via unspecified vectors...

CVE-2016-0851: Improper Restriction of Operations within the Bounds of a Memory Buffer

Advantech WebAccess before 8.1 allows remote attackers to cause a denial of service out-of-bounds memory access via unspecified vectors...

CVE-2016-0856: Improper Restriction of Operations within the Bounds of a Memory Buffer

Multiple stack-based buffer overflows in Advantech WebAccess before 8.1 allow remote attackers to execute arbitrary code via unspecified vectors...

CVE-2015-3946: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in Advantech WebAccess before 8.1 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

CVE-2016-0860: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in the BwpAlarm subsystem in Advantech WebAccess before 8.1 allows remote attackers to cause a denial of service via a crafted RPC request...

CVE-2015-3947: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Advantech WebAccess before 8.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors...

CVE-2015-3948: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Advantech WebAccess before 8.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2016-0859: Undefined Security Weakness

Integer overflow in the Kernel service in Advantech WebAccess before 8.1 allows remote attackers to execute arbitrary code or cause a denial of service stack-based buffer overflow via a crafted RPC request...

CVE-2016-0852: Undefined Security Weakness

Advantech WebAccess before 8.1 allows remote attackers to bypass an intended administrative requirement and obtain file or folder access via unspecified vectors...

CVE-2015-6467: Undefined Security Weakness

Advantech WebAccess before 8.1 allows remote attackers to execute arbitrary code via vectors involving a browser plugin...

CVE-2016-0854: Undefined Security Weakness

Unrestricted file upload vulnerability in the uploadImageCommon function in the UploadAjaxAction script in the WebAccess Dashboard Viewer in Advantech WebAccess before 8.1 allows remote attackers to write to files of arbitrary types via unspecified vectors...

PT-2016-1121

Name of the Vulnerable Software and Affected Versions Advantech WebAccess versions prior to 8.1 Description The issue is related to an unrestricted file upload vulnerability. This vulnerability can be exploited by a remote attacker to modify files of any type. The vulnerability is associated with...

[SECURITY] Fedora 21 Update: zarafa-7.1.14-1.fc21

The Zarafa Collaboration Platform is a Microsoft Exchange replacement. The Open Source Collaboration provides an integration with your existing Linux mail server, native mobile phone support by ActiveSync compatibility and a webaccess with 'Look & Feel' similar to Outlook using Ajax. Including an...

Advantech WebAccess AspVCObj.AspDataDriven ActiveX GetWideStrCpy Stack Buffer Overflow (CVE-2014-9208)

A stack buffer overflow vulnerability exists in Advantech's WebAccess SCADA software. The vulnerability is due to insufficient input validation of an argument to GetWideStrCpy in the AspVCObj.AspDataDriven ActiveX control. A remote, unauthenticated attacker can exploit this vulnerability by...