CVE-2012-1234

SQL injection vulnerability in Advantech/BroadWin WebAccess 7.0 allows remote authenticated users to execute arbitrary SQL commands via a malformed URL. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0234...

CVE-2012-1234

CVE-2012-1234 describes an SQL injection in Advantech/BroadWin WebAccess 7.0 where remote authenticated users can execute arbitrary SQL via a malformed URL. The entry notes this vulnerability exists due to an incomplete fix for CVE-2012-0234. Connected records confirm affected product is Advantec...

CVE-2012-0242

CVE-2012-0242 : A format-string vulnerability in Advantech/BroadWin WebAccess prior to 7.0 allows remote execution of arbitrary code via a crafted message string. Public advisories note that attacks can be remote and exploitable for full control. ICS-CERT summarizes the impact as bypassing authen...

CVE-2012-0242

Format string vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary code via format string specifiers in a message string...

CVE-2012-0241

Advantech/BroadWin WebAccess prior to version 7.0 is affected by CVE-2012-0241, where a remote attacker can trigger memory corruption by supplying a modified stream identifier to a function, resulting in denial of service. The vulnerability is part of a broader set described in ICS-CERT advisorie...

CVE-2012-1235

CVE-2012-1235 affects Advantech/BroadWin WebAccess 7.0 with a Cross-Site Request Forgery (CSRF) flaw that can allow remote authenticated users to hijack the authentication of unspecified victims, stemming from an incomplete fix for CVE-2012-0235. The ICS-CERT advisory notes that Advantech release...

CVE-2011-4524

The CVE-2011-4524 entry concerns Advantech/BroadWin WebAccess prior to version 7.0. The vulnerability is a buffer overflow triggered by a long string value in unspecified parameters, enabling remote code execution. Connected documents corroborate a family of vulnerabilities in WebAccess affecting...

CVE-2011-4525

CVE-2011-4525 affects Advantech/BroadWin WebAccess prior to 7.0. A remote attacker can cause the client to create and execute a batch file by injecting arbitrary web content, enabling potential remote code execution. ICS-CERT notes Advantech released WebAccess 7.0 to address most vulnerabilities;...

CVE-2011-4521

CVE-2011-4521 describes an SQL injection vulnerability in Advantech/BroadWin WebAccess prior to version 7.0, allowing remote attackers to execute arbitrary SQL commands via crafted string input. Affected product: Advantech/BroadWin WebAccess (pre-7.0). Root cause centers on unsanitized input hand...

CVE-2012-0235

Cross-site request forgery CSRF vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

CVE-2012-0240

CVE-2012-0240 affects Advantech/BroadWin WebAccess prior to version 7.0. The vulnerability is in GbScriptAddUp.asp where authentication is not performed properly, allowing remote attackers to execute arbitrary code via unspecified vectors. The issue is remotely exploitable and public exploits are...

CVE-2011-4523

Cross-site scripting XSS vulnerability in bwview.asp in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters...

CVE-2012-0240: Improper Authentication

GbScriptAddUp.asp in Advantech/BroadWin WebAccess before 7.0 does not properly perform authentication, which allows remote attackers to execute arbitrary code via unspecified vectors...

CVE-2011-4524: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary code via a long string value in unspecified parameters...

CVE-2011-4523: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in bwview.asp in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters...

CVE-2012-0243: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in an ActiveX control in bwocxrun.ocx in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary code by leveraging the ability to write arbitrary content to any pathname...

CVE-2012-0242: Use of Externally-Controlled Format String

Format string vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary code via format string specifiers in a message string...

CVE-2012-0236: Exposure of Sensitive Information to an Unauthorized Actor

Advantech/BroadWin WebAccess 7.0 and earlier allows remote attackers to obtain sensitive information via a direct request to a URL. NOTE: the vendor reportedly "does not consider it to be a security risk."...

CVE-2012-0234: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary SQL commands via a malformed URL...

CVE-2012-0233: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to inject arbitrary web script or HTML via a malformed URL...