CVE-2014-0763

Summary of CVE-2014-0763 (Advantech WebAccess) : The vulnerability affects Advantech WebAccess (7.1 and earlier) in the DBVisitor.dll component exposed via SOAP interfaces, where SOAP injection enables SQL injection through the ChartThemeConfig/service vectors. This may allow an attacker to perfo...

CVE-2014-0764

Advantech WebAccess is affected by CVE-2014-0764 due to a stack-based buffer overflow in the NodeName parameter parsing of the webvact.ocx ActiveX control. The advisory material from Core Security (CORE-2014-0005) and related sources indicate the vulnerability could allow remote code execution wh...

CVE-2014-0766

Advantech WebAccess vulnerable to a stack-based buffer overflow in the webvact.ocx NodeName2 parameter, enabling remote code execution. Affected: WebAccess 7.2 and older; vulnerability described as CWE-121 in Core/ICS advisories. Mitigation via WebAccess version 7.2 or newer updates from Advantec...

CVE-2014-0771

Advantech WebAccess BWOCXRUN.BwocxrunCtrl.1 OpenUrlToBuffer in bwocxrun.ocx allows reading arbitrary files via file:// URLs because there is no URL validation. This enables remote-access scenarios where an attacker could read local or reachable files through JavaScript, within the browser context...

CVE-2014-2364

Advantech WebAccess before version 7.2 is affected by multiple stack-based buffer overflows in the webvact.ocx, dvs.ocx, and webdact.ocx ActiveX controls. The vulnerability is triggered by overly long strings passed to parameters such as ProjectName, SetParameter, NodeName, CCDParameter, SetColor...

CVE-2014-0767

CVE-2014-0767 is a buffer overflow in Advantech WebAccess’ webvact.ocx ActiveX control, triggered by an overly long AccessCode argument, enabling remote code execution via a crafted webpage. Affected product: Advantech WebAccess (WebAccess Webvact OCX). Root cause: stack-based overflow due to ins...

CVE-2014-2367

CVE-2014-2367 – Advantech WebAccess (ActiveX error in gChkCook.asp) The vulnerability lies in the ChkCookie subroutine of the broadweb/include/gChkCook.asp ActiveX control used by Advantech WebAccess prior to version 7.2. A crafted call can cause the ActiveX to read arbitrary files on the local s...

CVE-2014-0765

CVE-2014-0765 affects Advantech WebAccess (Webvact OCX) where the GotoCmd parameter can overflow a static stack buffer, enabling remote code execution. Multiple documents corroborate a stack-based overflow causing arbitrary code execution, with advisories attributing the issue to Advantech WebAcc...

CVE-2014-0773

Advantech WebAccess BWOCXRUN.BwocxrunCtrl.1 ActiveX bwocxrun.ocx contains CreateProcess validation that can be bypassed by command lines containing \setup.exe, \bwvbprt.exe, or \bwvbprtl.exe, allowing arbitrary commands to execute via CreateProcessA. ZDI confirms remote code execution; exploitati...

CVE-2014-2368

The CVE-2014-2368 issue affects Advantech WebAccess (prior to 7.2) via the bwocxrun ActiveX control. The BrowseFolder method can be abused to read arbitrary files, enabling remote read access. Root cause: Unsafe ActiveX control that allows navigation from the Internet to local files. Exploitation...

CVE-2014-0770

Summary of CVE-2014-0770: Advantech WebAccess (SCADA/HMI) is affected by a stack-based buffer overflow in the webvact.ocx ActiveX control, triggered by an overly long string supplied to the UserName parameter. This vulnerability could allow remote code execution on the target machine, as describe...

CVE-2014-0768

The CVE-2014-0768 vulnerability affects Advantech WebAccess (SCADA/HMI WebAccess Client) via the webvact.ocx ActiveX control. It is caused by a stack-based buffer overflow when an overly long AccessCode2 parameter is supplied, allowing an attacker to remotely execute arbitrary code. Affected prod...

CVE-2012-0234

Summary (useful, grounded in provided docs): CVE-2012-0234 (and related entries) describe an SQL injection flaw in Advantech/BroadWin WebAccess prior to 7.0, exploitable by remote authenticated users via a malformed URL to execute arbitrary SQL commands. Connected materials confirm WebAccess 7.0 ...

CVE-2011-4521

CVE-2011-4521 describes an SQL injection vulnerability in Advantech/BroadWin WebAccess prior to version 7.0, allowing remote attackers to execute arbitrary SQL commands via crafted string input. Affected product: Advantech/BroadWin WebAccess (pre-7.0). Root cause centers on unsanitized input hand...

CVE-2012-0244

Advantech/BroadWin WebAccess prior to version 7.0 contains multiple SQL injection vulnerabilities (CVE-2012-0244) that allow remote attackers to execute arbitrary SQL commands via crafted input. Affected product: Advantech/BroadWin WebAccess; vulnerability class: SQL Injection in user-supplied st...