CVE-2014-0767

CVE-2014-0767 is a buffer overflow in Advantech WebAccess’ webvact.ocx ActiveX control, triggered by an overly long AccessCode argument, enabling remote code execution via a crafted webpage. Affected product: Advantech WebAccess (WebAccess Webvact OCX). Root cause: stack-based overflow due to ins...

CVE-2014-0763 Advantech WebAccess SQL Injection

An attacker using SQL injection may use arguments to construct queries without proper sanitization. The DBVisitor.dll is exposed through SOAP interfaces, and the exposed functions are vulnerable to SOAP injection. This may allow unexpected SQL action and access to records in the table of the...

CVE-2014-0763

Summary of CVE-2014-0763 (Advantech WebAccess) : The vulnerability affects Advantech WebAccess (7.1 and earlier) in the DBVisitor.dll component exposed via SOAP interfaces, where SOAP injection enables SQL injection through the ChartThemeConfig/service vectors. This may allow an attacker to perfo...

CVE-2014-0768 Advantech WebAccess Stack-based Buffer Overflow

An attacker may pass an overly long value from the AccessCode2 argument to the control to overflow the static stack buffer. The attacker may then remotely execute arbitrary code...

CVE-2014-0766

Advantech WebAccess vulnerable to a stack-based buffer overflow in the webvact.ocx NodeName2 parameter, enabling remote code execution. Affected: WebAccess 7.2 and older; vulnerability described as CWE-121 in Core/ICS advisories. Mitigation via WebAccess version 7.2 or newer updates from Advantec...

CVE-2014-0772

Advantech WebAccess is affected by CVE-2014-0772 in the bwocxrun.ocx ActiveX control (BwocxrunCtrl.1). The OpenUrlToBufferTimeout method accepts a URL and returns its contents to JavaScript, executing in the current browser session context. The vulnerability arises from lack of URL validation, al...

CVE-2014-0765

CVE-2014-0765 affects Advantech WebAccess (Webvact OCX) where the GotoCmd parameter can overflow a static stack buffer, enabling remote code execution. Multiple documents corroborate a stack-based overflow causing arbitrary code execution, with advisories attributing the issue to Advantech WebAcc...

Advantech WebAccess webvact.ocx AccessCode Stack Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Advantech WebAccess. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Advantech WebAccess webvact.ocx GotoCmd Stack Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Advantech WebAccess. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Advantech WebAccess webvact.ocx NodeName2 Stack Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Advantech WebAccess. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Advantech WebAccess DBVisitor.dll SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Advantech WebAccess. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DBVisitor.dll component. Multiple SOAP requests implemented by the component a...

Advantech WebAccess webvact.ocx NodeName Stack Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Advantech WebAccess. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Advantech WebAccess DBVisitor.dll ChartThemeConfig SQL Injection

This module exploits a SQL injection vulnerability found in Advantech WebAccess 7.1. The vulnerability exists in the DBVisitor.dll component, and can be abused through malicious requests to the ChartThemeConfig web service. This module can be used to extract the site and project usernames and...

[SECURITY] Fedora 19 Update: zarafa-7.1.8-1.fc19

The Zarafa Collaboration Platform is a Microsoft Exchange replacement. The Open Source Collaboration provides an integration with your existing Linux mail server, native mobile phone support by ActiveSync compatibility and a webaccess with 'Look & Feel' similar to Outlook using Ajax. Including an...

elproLOG MONITOR Webaccess 2.1 - Multiple Vulnerabilities

elproLOG MONITOR Webaccess 2.1 - Multiple Vulnerabilities Title: ====== elproLOG MONITOR WebAccess 2.1 - Multiple Vulnerabilities Date: ===== 2013-09-24 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1086 VL-ID: ===== 1086 Common Vulnerability Scoring System:...

elproLOG MONITOR WebAccess 2.1 - Multiple Web Vulnerabilities

Title: ====== elproLOG MONITOR WebAccess 2.1 - Multiple Vulnerabilities Date: ===== 2013-09-24 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1086 VL-ID: ===== 1086 Common Vulnerability Scoring System: ==================================== 6.7 Introduction: ============...

elproLOG MONITOR WebAccess 2.1 XSS / SQL Injection

Title: ====== elproLOG MONITOR WebAccess 2.1 - Multiple Vulnerabilities Date: ===== 2013-09-24 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1086 VL-ID: ===== 1086 Common Vulnerability Scoring System: ==================================== 6.7 Introduction: ============...

elproLOG WebAccess 2.1 - Multiple Vulnerabilities

Document Title: =============== elproLOG WebAccess 2.1 - Multiple Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1086 Release Date: ============= 2013-09-23 Vulnerability Laboratory ID VL-ID: ==================================== 1086...

CVE-2013-2299

Cross-site scripting XSS vulnerability in Advantech WebAccess formerly BroadWin WebAccess before 7.1 2013.05.30 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in Advantech WebAccess formerly BroadWin WebAccess before 7.1 2013.05.30 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...