CVE-2011-4522: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in bwerrdn.asp in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters...

CVE-2012-1234: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Advantech/BroadWin WebAccess 7.0 allows remote authenticated users to execute arbitrary SQL commands via a malformed URL. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0234...

CVE-2011-4525: Undefined Security Weakness

Advantech/BroadWin WebAccess before 7.0 allows remote attackers to trigger the extraction of arbitrary web content into a batch file on a client system, and execute this batch file, via unspecified vectors...

CVE-2012-0241: Improper Restriction of Operations within the Bounds of a Memory Buffer

Advantech/BroadWin WebAccess before 7.0 allows remote attackers to cause a denial of service memory corruption via a modified stream identifier to a function...

CVE-2012-0238: Improper Restriction of Operations within the Bounds of a Memory Buffer

Stack-based buffer overflow in opcImg.asp in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary code via unspecified vectors...

CVE-2012-0239: Improper Authentication

uaddUpAdmin.asp in Advantech/BroadWin WebAccess before 7.0 does not properly perform authentication, which allows remote attackers to modify an administrative password via a password-change request...

CVE-2011-4521: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary SQL commands via crafted string input...

CVE-2012-1235: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in Advantech/BroadWin WebAccess 7.0 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0235...

CVE-2011-4526: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in an ActiveX control in Advantech/BroadWin WebAccess before 7.0 might allow remote attackers to execute arbitrary code via a long string value in unspecified parameters...

CVE-2012-0244: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Advantech/BroadWin WebAccess before 7.0 allow remote attackers to execute arbitrary SQL commands via crafted string input...

CVE-2012-0237: Improper Restriction of Operations within the Bounds of a Memory Buffer

Advantech/BroadWin WebAccess before 7.0 allows remote attackers to 1 enable date and time syncing or 2 disable date and time syncing via a crafted URL...

CVE-2012-0235: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

CVE-2011-4041

webvrpcs.exe in Advantech/BroadWin WebAccess allows remote attackers to execute arbitrary code or obtain a security-code value via a long string in an RPC request to TCP port 4592...

Code injection

webvrpcs.exe in Advantech/BroadWin WebAccess allows remote attackers to execute arbitrary code or obtain a security-code value via a long string in an RPC request to TCP port 4592...

CVE-2011-4041

The CVE-2011-4041 issue affects Advantech/BroadWin WebAccess WebAccess Network Service (RPC on TCP 4592). A long string in an RPC request can lead to remote code execution or the disclosure of the security-code value. Public exploit code has been posted; the vulnerability applies to all WebAccess...

CVE-2011-4041

webvrpcs.exe in Advantech/BroadWin WebAccess allows remote attackers to execute arbitrary code or obtain a security-code value via a long string in an RPC request to TCP port 4592...

CVE-2011-4041: Improper Control of Generation of Code

webvrpcs.exe in Advantech/BroadWin WebAccess allows remote attackers to execute arbitrary code or obtain a security-code value via a long string in an RPC request to TCP port 4592...

Broadwin WebAccess Client Bwocxrun ActiveX OcxSpool Format String

A format string vulnerability has been reported in an ActiveX component of Broadwin WebAccess...

BroadWin WebAccess SCADA Client ActiveX Format String

Added: 12/12/2011 OSVDB: 74897 Background BroadWin WebAccess is a web-based SCADA reporting and control solution. Problem BroadWin WebAccess installs an ActiveX Control in the user's browser. The OcxSpool function of this control accepts a parameter that is evaluated using a format string. A form...

BroadWin WebAccess SCADA Client ActiveX Format String

Added: 12/12/2011 OSVDB: 74897 Background BroadWin WebAccess is a web-based SCADA reporting and control solution. Problem BroadWin WebAccess installs an ActiveX Control in the user's browser. The OcxSpool function of this control accepts a parameter that is evaluated using a format string. A form...