Lucene search
K
Database
Vendors
Products
Timeline
Vulnerabilities
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
AdvantechAdvantech Webaccess5.0

36 matches found

CVE
CVE•added 2014/04/12 4:37 a.m.•130 views

CVE-2014-0772

The OpenUrlToBufferTimeout method in the BWOCXRUN.BwocxrunCtrl.1 ActiveX control in bwocxrun.ocx in Advantech WebAccess before 7.2 allows remote attackers to read arbitrary files via a file: URL.

5CVSS6.5AI score0.00183EPSS
CVE
CVE•added 2014/04/12 4:37 a.m.•88 views

CVE-2014-0763

Multiple SQL injection vulnerabilities in DBVisitor.dll in Advantech WebAccess before 7.2 allow remote attackers to execute arbitrary SQL commands via SOAP requests to unspecified functions.

7.5CVSS8.6AI score0.31747EPSS
CVE
CVE•added 2012/02/21 1:31 p.m.•70 views

CVE-2012-0236

Advantech/BroadWin WebAccess 7.0 and earlier allows remote attackers to obtain sensitive information via a direct request to a URL. NOTE: the vendor reportedly "does not consider it to be a security risk."

5CVSS6.3AI score0.00236EPSS
CVE
CVE•added 2014/04/12 4:37 a.m.•64 views

CVE-2014-0764

Stack-based buffer overflow in Advantech WebAccess before 7.2 allows remote attackers to execute arbitrary code via a long NodeName parameter.

7.5CVSS8AI score0.01493EPSS
CVE
CVE•added 2014/07/19 5:9 a.m.•61 views

CVE-2014-2367

The ChkCookie subroutine in an ActiveX control in broadweb/include/gChkCook.asp in Advantech WebAccess before 7.2 allows remote attackers to read arbitrary files via a crafted call.

4.3CVSS6.7AI score0.00313EPSS
CVE
CVE•added 2014/04/12 4:37 a.m.•60 views

CVE-2014-0771

The OpenUrlToBuffer method in the BWOCXRUN.BwocxrunCtrl.1 ActiveX control in bwocxrun.ocx in Advantech WebAccess before 7.2 allows remote attackers to read arbitrary files via a file: URL.

5CVSS6.5AI score0.00183EPSS
CVE
CVE•added 2014/04/12 4:37 a.m.•58 views

CVE-2014-0767

Stack-based buffer overflow in Advantech WebAccess before 7.2 allows remote attackers to execute arbitrary code via a long AccessCode argument.

7.5CVSS8AI score0.01493EPSS
CVE
CVE•added 2012/02/21 1:31 p.m.•57 views

CVE-2011-4523

Cross-site scripting (XSS) vulnerability in bwview.asp in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.

4.3CVSS5.8AI score0.00199EPSS
CVE
CVE•added 2014/04/12 4:37 a.m.•57 views

CVE-2014-0766

Stack-based buffer overflow in Advantech WebAccess before 7.2 allows remote attackers to execute arbitrary code via a long NodeName2 argument.

7.5CVSS8AI score0.01493EPSS
CVE
CVE•added 2014/07/19 5:9 a.m.•55 views

CVE-2014-2368

The BrowseFolder method in the bwocxrun ActiveX control in Advantech WebAccess before 7.2 allows remote attackers to read arbitrary files via a crafted call.

5CVSS6.7AI score0.00289EPSS
CVE
CVE•added 2014/04/12 4:37 a.m.•54 views

CVE-2014-0765

Stack-based buffer overflow in Advantech WebAccess before 7.2 allows remote attackers to execute arbitrary code via a long GotoCmd argument.

7.5CVSS8AI score0.01493EPSS
CVE
CVE•added 2014/04/12 4:37 a.m.•54 views

CVE-2014-0773

The CreateProcess method in the BWOCXRUN.BwocxrunCtrl.1 ActiveX control in bwocxrun.ocx in Advantech WebAccess before 7.2 allows remote attackers to execute (1) setup.exe, (2) bwvbprt.exe, and (3) bwvbprtl.exe programs from arbitrary pathnames via a crafted argument, as demonstrated by a UNC share ...

7.5CVSS6.9AI score0.00239EPSS
CVE
CVE•added 2014/07/19 5:9 a.m.•54 views

CVE-2014-2364

Multiple stack-based buffer overflows in Advantech WebAccess before 7.2 allow remote attackers to execute arbitrary code via a long string in the (1) ProjectName, (2) SetParameter, (3) NodeName, (4) CCDParameter, (5) SetColor, (6) AlarmImage, (7) GetParameter, (8) GetColor, (9) ServerResponse, (10)...

7.5CVSS7.6AI score0.39104EPSS
CVE
CVE•added 2014/04/12 4:37 a.m.•53 views

CVE-2014-0768

Stack-based buffer overflow in Advantech WebAccess before 7.2 allows remote attackers to execute arbitrary code via a long AccessCode2 argument.

7.5CVSS8AI score0.01493EPSS
CVE
CVE•added 2014/04/12 4:37 a.m.•53 views

CVE-2014-0770

Stack-based buffer overflow in Advantech WebAccess before 7.2 allows remote attackers to execute arbitrary code via a long UserName parameter.

7.5CVSS8AI score0.00917EPSS
CVE
CVE•added 2012/02/21 1:31 p.m.•51 views

CVE-2012-1234

SQL injection vulnerability in Advantech/BroadWin WebAccess 7.0 allows remote authenticated users to execute arbitrary SQL commands via a malformed URL. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0234.

6.5CVSS8.1AI score0.00228EPSS
CVE
CVE•added 2012/02/21 1:31 p.m.•50 views

CVE-2011-4524

Buffer overflow in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary code via a long string value in unspecified parameters.

10CVSS8.1AI score0.02392EPSS
CVE
CVE•added 2012/02/21 1:31 p.m.•50 views

CVE-2012-0241

Advantech/BroadWin WebAccess before 7.0 allows remote attackers to cause a denial of service (memory corruption) via a modified stream identifier to a function.

5CVSS6.8AI score0.10618EPSS
CVE
CVE•added 2012/02/21 1:31 p.m.•50 views

CVE-2012-0242

Format string vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary code via format string specifiers in a message string.

10CVSS7.8AI score0.14087EPSS
CVE
CVE•added 2012/02/21 1:31 p.m.•50 views

CVE-2012-0243

Buffer overflow in an ActiveX control in bwocxrun.ocx in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary code by leveraging the ability to write arbitrary content to any pathname.

10CVSS8.1AI score0.02392EPSS
CVE
CVE•added 2014/07/19 5:9 a.m.•50 views

CVE-2014-2366

upAdminPg.asp in Advantech WebAccess before 7.2 allows remote authenticated users to discover credentials by reading HTML source code.

4CVSS6.2AI score0.00246EPSS
CVE
CVE•added 2012/02/21 1:31 p.m.•49 views

CVE-2012-0233

Cross-site scripting (XSS) vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to inject arbitrary web script or HTML via a malformed URL.

4.3CVSS5.7AI score0.00228EPSS
CVE
CVE•added 2012/02/21 1:31 p.m.•49 views

CVE-2012-0234

SQL injection vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary SQL commands via a malformed URL.

7.5CVSS8.4AI score0.00163EPSS
CVE
CVE•added 2012/02/21 1:31 p.m.•48 views

CVE-2011-4522

Cross-site scripting (XSS) vulnerability in bwerrdn.asp in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.

4.3CVSS5.8AI score0.00199EPSS
CVE
CVE•added 2012/02/21 1:31 p.m.•48 views

CVE-2011-4525

Advantech/BroadWin WebAccess before 7.0 allows remote attackers to trigger the extraction of arbitrary web content into a batch file on a client system, and execute this batch file, via unspecified vectors.

10CVSS7.1AI score0.00344EPSS
CVE
CVE•added 2012/02/21 1:31 p.m.•47 views

CVE-2011-4521

SQL injection vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary SQL commands via crafted string input.

7.5CVSS8.6AI score0.00163EPSS
CVE
CVE•added 2012/02/21 1:31 p.m.•47 views

CVE-2012-0237

Advantech/BroadWin WebAccess before 7.0 allows remote attackers to (1) enable date and time syncing or (2) disable date and time syncing via a crafted URL.

6.4CVSS6.7AI score0.00241EPSS
CVE
CVE•added 2012/02/21 1:31 p.m.•46 views

CVE-2012-0235

Cross-site request forgery (CSRF) vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.

6CVSS7.1AI score0.00069EPSS
CVE
CVE•added 2014/07/19 5:9 a.m.•45 views

CVE-2014-2365

Unspecified vulnerability in Advantech WebAccess before 7.2 allows remote authenticated users to create or delete arbitrary files via unknown vectors.

5.5CVSS6.4AI score0.00275EPSS
CVE
CVE•added 2012/02/21 1:31 p.m.•44 views

CVE-2012-0240

GbScriptAddUp.asp in Advantech/BroadWin WebAccess before 7.0 does not properly perform authentication, which allows remote attackers to execute arbitrary code via unspecified vectors.

10CVSS7.9AI score0.00927EPSS
CVE
CVE•added 2012/02/21 1:31 p.m.•44 views

CVE-2012-0244

Multiple SQL injection vulnerabilities in Advantech/BroadWin WebAccess before 7.0 allow remote attackers to execute arbitrary SQL commands via crafted string input.

7.5CVSS8.7AI score0.00163EPSS
CVE
CVE•added 2012/02/21 1:31 p.m.•43 views

CVE-2011-4526

Buffer overflow in an ActiveX control in Advantech/BroadWin WebAccess before 7.0 might allow remote attackers to execute arbitrary code via a long string value in unspecified parameters.

10CVSS8.1AI score0.02497EPSS
CVE
CVE•added 2012/02/21 1:31 p.m.•42 views

CVE-2012-0238

Stack-based buffer overflow in opcImg.asp in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary code via unspecified vectors.

10CVSS8.3AI score0.02392EPSS
CVE
CVE•added 2013/08/22 5:34 a.m.•42 views

CVE-2013-2299

Cross-site scripting (XSS) vulnerability in Advantech WebAccess (formerly BroadWin WebAccess) before 7.1 2013.05.30 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

3.5CVSS5.3AI score0.00288EPSS
CVE
CVE•added 2012/02/21 1:31 p.m.•39 views

CVE-2012-0239

uaddUpAdmin.asp in Advantech/BroadWin WebAccess before 7.0 does not properly perform authentication, which allows remote attackers to modify an administrative password via a password-change request.

5CVSS6.9AI score0.00175EPSS
CVE
CVE•added 2012/02/21 1:31 p.m.•39 views

CVE-2012-1235

Cross-site request forgery (CSRF) vulnerability in Advantech/BroadWin WebAccess 7.0 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0235.

6CVSS6.8AI score0.00069EPSS