CVE-2012-0241

Advantech/BroadWin WebAccess before 7.0 allows remote attackers to cause a denial of service memory corruption via a modified stream identifier to a function...

CVE-2012-1235

Cross-site request forgery CSRF vulnerability in Advantech/BroadWin WebAccess 7.0 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0235...

CVE-2012-0233

Cross-site scripting XSS vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to inject arbitrary web script or HTML via a malformed URL...

CVE-2012-0244

Advantech/BroadWin WebAccess prior to version 7.0 contains multiple SQL injection vulnerabilities (CVE-2012-0244) that allow remote attackers to execute arbitrary SQL commands via crafted input. Affected product: Advantech/BroadWin WebAccess; vulnerability class: SQL Injection in user-supplied st...

CVE-2012-0239

Summary: CVE-2012-0239 affects Advantech/BroadWin WebAccess prior to version 7.0. The issue is an authentication vulnerability in uaddUpAdmin.asp that allows remote, unauthenticated changes to the administrator password. Impact (as stated): attacker can modify an admin password remotely. Affected...

CVE-2012-0235

CVE-2012-0235 is a CSRF vulnerability affecting Advantech/BroadWin WebAccess (7.0 and prior). The issue arises from an incomplete fix for CVE-2012-0235, enabling an attacker (often a remote, authenticated user) to hijack the victim’s session via unspecified vectors. Public references and Red Hat/...

CVE-2012-0243

The CVE-2012-0243 issue affects Advantech/BroadWin WebAccess prior to 7.0, where a stack/ActiveX buffer overflow in bwocxrun.ocx enables remote arbitrary-code execution by writing content to arbitrary pathnames. The vulnerability stems from input handling in the ActiveX control, allowing an attac...

CVE-2012-0236

CVE-2012-0236 affects Advantech/BroadWin WebAccess ≤7.0, where an unauthenticated user can access restricted information via a direct URL request (information exposure). The vendor reportedly does not consider it a security risk. Public advisories indicate multiple vulnerabilities were reported i...

CVE-2012-0233

CVE-2012-0233 affects Advantech/BroadWin WebAccess before 7.0. The vulnerability is Cross-Site Scripting (CWE-79) via a malformed URL, enabling remote attackers to inject arbitrary web script or HTML. The NVD entry lists a MEDIUM (4.3) base score; exploitation status is noted as publicly known in...

CVE-2012-0234

SQL injection vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary SQL commands via a malformed URL...

CVE-2012-1234

SQL injection vulnerability in Advantech/BroadWin WebAccess 7.0 allows remote authenticated users to execute arbitrary SQL commands via a malformed URL. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0234...

CVE-2011-4522

Cross-site scripting XSS vulnerability in bwerrdn.asp in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters...

CVE-2012-0239

uaddUpAdmin.asp in Advantech/BroadWin WebAccess before 7.0 does not properly perform authentication, which allows remote attackers to modify an administrative password via a password-change request...

CVE-2012-0244

Multiple SQL injection vulnerabilities in Advantech/BroadWin WebAccess before 7.0 allow remote attackers to execute arbitrary SQL commands via crafted string input...

CVE-2012-0238

Stack-based buffer overflow in opcImg.asp in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary code via unspecified vectors...

CVE-2011-4521

SQL injection vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary SQL commands via crafted string input...

CVE-2011-4526

Buffer overflow in an ActiveX control in Advantech/BroadWin WebAccess before 7.0 might allow remote attackers to execute arbitrary code via a long string value in unspecified parameters...

CVE-2011-4523

The CVE-2011-4523 issue affects Advantech/BroadWin WebAccess prior to version 7.0, where bwview.asp is vulnerable to cross-site scripting (XSS) via unspecified parameters, allowing remote attackers to inject arbitrary script or HTML. Public advisories describe the vulnerability class as XSS in th...

CVE-2012-0237

Advantech/BroadWin WebAccess before 7.0 allows remote attackers to 1 enable date and time syncing or 2 disable date and time syncing via a crafted URL...

CVE-2012-0234

Summary (useful, grounded in provided docs): CVE-2012-0234 (and related entries) describe an SQL injection flaw in Advantech/BroadWin WebAccess prior to 7.0, exploitable by remote authenticated users via a malformed URL to execute arbitrary SQL commands. Connected materials confirm WebAccess 7.0 ...