2966 matches found
CVE-2012-0236
CVE-2012-0236 affects Advantech/BroadWin WebAccess ≤7.0, where an unauthenticated user can access restricted information via a direct URL request (information exposure). The vendor reportedly does not consider it a security risk. Public advisories indicate multiple vulnerabilities were reported i...
CVE-2012-0239
Summary: CVE-2012-0239 affects Advantech/BroadWin WebAccess prior to version 7.0. The issue is an authentication vulnerability in uaddUpAdmin.asp that allows remote, unauthenticated changes to the administrator password. Impact (as stated): attacker can modify an admin password remotely. Affected...
CVE-2012-0244
Advantech/BroadWin WebAccess prior to version 7.0 contains multiple SQL injection vulnerabilities (CVE-2012-0244) that allow remote attackers to execute arbitrary SQL commands via crafted input. Affected product: Advantech/BroadWin WebAccess; vulnerability class: SQL Injection in user-supplied st...
CVE-2012-0235
CVE-2012-0235 is a CSRF vulnerability affecting Advantech/BroadWin WebAccess (7.0 and prior). The issue arises from an incomplete fix for CVE-2012-0235, enabling an attacker (often a remote, authenticated user) to hijack the victim’s session via unspecified vectors. Public references and Red Hat/...
CVE-2011-4523
The CVE-2011-4523 issue affects Advantech/BroadWin WebAccess prior to version 7.0, where bwview.asp is vulnerable to cross-site scripting (XSS) via unspecified parameters, allowing remote attackers to inject arbitrary script or HTML. Public advisories describe the vulnerability class as XSS in th...
CVE-2011-4525
Advantech/BroadWin WebAccess before 7.0 allows remote attackers to trigger the extraction of arbitrary web content into a batch file on a client system, and execute this batch file, via unspecified vectors...
CVE-2011-4526
Buffer overflow in an ActiveX control in Advantech/BroadWin WebAccess before 7.0 might allow remote attackers to execute arbitrary code via a long string value in unspecified parameters...
CVE-2012-0238
Stack-based buffer overflow in opcImg.asp in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary code via unspecified vectors...
CVE-2012-0238
CVE-2012-0238 affects Advantech/BroadWin WebAccess prior to 7.0. A stack-based buffer overflow in opcImg.asp could allow a remote attacker to execute arbitrary code. ICS-CERT notes multiple vulnerabilities in WebAccess 7.0 era; public exploits exist for these issues. Mitigation: Advantech release...
CVE-2012-0237
Advantech/BroadWin WebAccess before 7.0 allows remote attackers to 1 enable date and time syncing or 2 disable date and time syncing via a crafted URL...
CVE-2012-0236
Advantech/BroadWin WebAccess 7.0 and earlier allows remote attackers to obtain sensitive information via a direct request to a URL. NOTE: the vendor reportedly "does not consider it to be a security risk."...
CVE-2012-0234
Summary (useful, grounded in provided docs): CVE-2012-0234 (and related entries) describe an SQL injection flaw in Advantech/BroadWin WebAccess prior to 7.0, exploitable by remote authenticated users via a malformed URL to execute arbitrary SQL commands. Connected materials confirm WebAccess 7.0 ...
CVE-2012-0234
SQL injection vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary SQL commands via a malformed URL...
CVE-2011-4526
Advantech/BroadWin WebAccess prior to version 7.0 is affected by a vulnerability in an ActiveX control that can cause a stack/heap buffer overflow when processing a long string value in unspecified parameters. This could allow remote code execution on the server by an attacker sending a crafted r...
CVE-2011-4522
CVE-2011-4522 is a Cross-site Scripting (XSS) vulnerability in Advantech/BroadWin WebAccess prior to version 7.0, affecting the file bwerrdn.asp. The issue allows remote attackers to inject arbitrary web script or HTML via unspecified parameters. Multiple connected sources document this XSS vulne...
CVE-2012-0239
uaddUpAdmin.asp in Advantech/BroadWin WebAccess before 7.0 does not properly perform authentication, which allows remote attackers to modify an administrative password via a password-change request...
CVE-2011-4521
SQL injection vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary SQL commands via crafted string input...
CVE-2012-0237
Advantech/BroadWin WebAccess before version 7.0 is affected by CVE-2012-0237, a remote vulnerability that allows an unauthenticated attacker to enable or disable date/time syncing via a crafted URL. The NVD entry (CVSS2 base score 6.4, Network vector, no authentication, partial integrity/availabi...