Advantech
Page 3 of 4 — Advantech CVEs from a corpus of 388, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-16207 | High | 7.8 | 2020-08-06 | Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior. Multiple heap-based buffer overflow vulnerabilities may be exploited by opening specially crafte… |
CVE-2020-14503 | Critical | 9.8 | 2020-07-15 | Advantech iView, versions 5.6 and prior, has an improper input validation vulnerability. Successful exploitation of this vulnerability could allow an attacker… |
CVE-2020-14501 | Critical | 9.8 | 2020-07-15 | Advantech iView, versions 5.6 and prior, has an improper authentication for critical function (CWE-306) issue. Successful exploitation of this vulnerability ma… |
CVE-2020-14499 | High | 7.5 | 2020-07-15 | Advantech iView, versions 5.6 and prior, has an improper access control vulnerability. Successful exploitation of this vulnerability may allow an attacker to o… |
CVE-2020-14507 | Critical | 9.8 | 2020-07-15 | Advantech iView, versions 5.6 and prior, is vulnerable to multiple path traversal vulnerabilities that could allow an attacker to create/download arbitrary fil… |
CVE-2020-14505 | Critical | 9.8 | 2020-07-15 | Advantech iView, versions 5.6 and prior, has an improper neutralization of special elements used in a command (“command injection”) vulnerability. Successful e… |
CVE-2020-14497 | Critical | 9.8 | 2020-07-15 | Advantech iView, versions 5.6 and prior, contains multiple SQL injection vulnerabilities that are vulnerable to the use of an attacker-controlled string in the… |
CVE-2020-12019 | Critical | 9.8 | 2020-06-15 | WebAccess Node Version 8.4.4 and prior is vulnerable to a stack-based buffer overflow, which may allow an attacker to remotely execute arbitrary code. |
CVE-2020-12026 | High | 8.8 | 2020-05-08 | Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple relative path traversal vulnerabilities exist that may allow a low privilege user to… |
CVE-2020-12022 | Critical | 9.8 | 2020-05-08 | Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. An improper validation vulnerability exists that could allow an attacker to inject specially… |
CVE-2020-12018 | High | 7.5 | 2020-05-08 | Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. An out-of-bounds vulnerability exists that may allow access to unauthorized data. |
CVE-2020-12014 | High | 7.5 | 2020-05-08 | Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Input is not properly sanitized and may allow an attacker to inject SQL commands. |
CVE-2020-12010 | High | 7.1 | 2020-05-08 | Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple relative path traversal vulnerabilities exist that may allow an authenticated user t… |
CVE-2020-12006 | Critical | 9.8 | 2020-05-08 | Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple relative path traversal vulnerabilities exist that may allow a low privilege user to… |
CVE-2020-12002 | Critical | 9.8 | 2020-05-08 | Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple stack-based buffer overflow vulnerabilities exist caused by a lack of proper validat… |
CVE-2020-10638 | Critical | 9.8 | 2020-05-08 | Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple heap-based buffer overflow vulnerabilities exist caused by a lack of proper validati… |
CVE-2020-10631 | Critical | 9.8 | 2020-04-09 | An attacker could use a specially crafted URL to delete or read files outside the WebAccess/NMS's (versions prior to 3.0.2) control. |
CVE-2020-10629 | High | 7.5 | 2020-04-09 | WebAccess/NMS (versions prior to 3.0.2) does not sanitize XML input. Specially crafted XML input could allow an attacker to read sensitive files. |
CVE-2020-10625 | Critical | 9.8 | 2020-04-09 | WebAccess/NMS (versions prior to 3.0.2) allows an unauthenticated remote user to create a new admin account. |
CVE-2020-10623 | Medium | 6.5 | 2020-04-09 | Multiple vulnerabilities could allow an attacker with low privileges to perform SQL injection on WebAccess/NMS (versions prior to 3.0.2) to gain access to sens… |
CVE-2020-10619 | Critical | 9.1 | 2020-04-09 | An attacker could use a specially crafted URL to delete files outside the WebAccess/NMS's (versions prior to 3.0.2) control. |
CVE-2020-10617 | High | 7.5 | 2020-04-09 | There are multiple ways an unauthenticated attacker could perform SQL injection on WebAccess/NMS (versions prior to 3.0.2) to gain access to sensitive informat… |
CVE-2020-10603 | High | 8.8 | 2020-04-09 | WebAccess/NMS (versions prior to 3.0.2) does not properly sanitize user input and may allow an attacker to inject system commands remotely. |
CVE-2020-10621 | Critical | 9.8 | 2020-04-09 | Multiple issues exist that allow files to be uploaded and executed on the WebAccess/NMS (versions prior to 3.0.2). |
CVE-2019-3942 | High | 7.5 | 2020-04-01 | Advantech WebAccess 8.3.4 does not properly restrict an RPC call that allows unauthenticated, remote users to read files. An attacker can use this vulnerabilit… |
CVE-2020-10607 | High | 8.8 | 2020-03-27 | In Advantech WebAccess, Versions 8.4.2 and prior. A stack-based buffer overflow vulnerability caused by a lack of proper validation of the length of user-suppl… |
CVE-2019-18257 | Critical | 9.8 | 2019-12-17 | In Advantech DiagAnywhere Server, Versions 3.07.11 and prior, multiple stack-based buffer overflow vulnerabilities exist in the file transfer service listening… |
CVE-2019-3951 | Critical | 9.8 | 2019-12-12 | Advantech WebAccess before 8.4.3 allows unauthenticated remote attackers to execute arbitrary code or cause a denial of service (memory corruption) due to a st… |
CVE-2019-18229 | Medium | 6.5 | 2019-10-31 | Advantech WISE-PaaS/RMM, Versions 3.3.29 and prior. Lack of sanitization of user-supplied input cause SQL injection vulnerabilities. An attacker can leverage t… |
CVE-2019-18227 | High | 7.5 | 2019-10-31 | Advantech WISE-PaaS/RMM, Versions 3.3.29 and prior. XXE vulnerabilities exist that may allow disclosure of sensitive data. |
CVE-2019-13551 | Critical | 9.8 | 2019-10-31 | Advantech WISE-PaaS/RMM, Versions 3.3.29 and prior. Path traversal vulnerabilities are caused by a lack of proper validation of a user-supplied path prior to u… |
CVE-2019-13547 | Critical | 9.8 | 2019-10-31 | Advantech WISE-PaaS/RMM, Versions 3.3.29 and prior. There is an unsecured function that allows anyone who can access the IP address to use the function without… |
CVE-2019-16901 | High | 7.5 | 2019-09-26 | Advantech WebAccess/HMI Designer 2.1.9.31 has Exception Handler Chain corruption starting at Unknown Symbol @ 0x0000000000000000 called from ntdll!RtlRaiseStat… |
CVE-2019-16900 | High | 7.5 | 2019-09-26 | Advantech WebAccess/HMI Designer 2.1.9.31 has a User Mode Write AV starting at MSVCR90!memcpy+0x000000000000015c. |
CVE-2019-16899 | High | 7.5 | 2019-09-26 | In Advantech WebAccess/HMI Designer 2.1.9.31, Data from a Faulting Address controls Code Flow starting at PM_V3!CTagInfoThreadBase::GetNICInfo+0x00000000005129… |
CVE-2019-13558 | Critical | 9.8 | 2019-09-18 | In WebAccess versions 8.4.1 and prior, an exploit executed over the network may cause improper control of generation of code, which may allow remote code execu… |
CVE-2019-13556 | High | 8.8 | 2019-09-18 | In WebAccess versions 8.4.1 and prior, multiple stack-based buffer overflow vulnerabilities are caused by a lack of proper validation of the length of user-sup… |
CVE-2019-13552 | High | 8.8 | 2019-09-18 | In WebAccess versions 8.4.1 and prior, multiple command injection vulnerabilities are caused by a lack of proper validation of user-supplied data and may allow… |
CVE-2019-13550 | Critical | 9.8 | 2019-09-18 | In WebAccess, versions 8.4.1 and prior, an improper authorization vulnerability may allow an attacker to disclose sensitive information, cause improper control… |
CVE-2019-3975 | Critical | 9.8 | 2019-09-10 | Stack-based buffer overflow in Advantech WebAccess/SCADA 8.4.1 allows a remote, unauthenticated attacker to execute arbitrary code via a crafted IOCTL 70603 RP… |
CVE-2019-10961 | High | 8.8 | 2019-08-02 | In Advantech WebAccess HMI Designer Version 2.1.9.23 and prior, processing specially crafted MCR files lacking proper validation of user supplied data may caus… |
CVE-2019-10993 | Critical | 9.8 | 2019-06-28 | In WebAccess/SCADA Versions 8.3.5 and prior, multiple untrusted pointer dereference vulnerabilities may allow a remote attacker to execute arbitrary code. |
CVE-2019-10991 | Critical | 9.8 | 2019-06-28 | In WebAccess/SCADA, Versions 8.3.5 and prior, multiple stack-based buffer overflow vulnerabilities are caused by a lack of proper validation of the length of u… |
CVE-2019-10989 | Critical | 9.8 | 2019-06-28 | In WebAccess/SCADA Versions 8.3.5 and prior, multiple heap-based buffer overflow vulnerabilities are caused by a lack of proper validation of the length of use… |
CVE-2019-10987 | High | 8.8 | 2019-06-28 | In WebAccess/SCADA Versions 8.3.5 and prior, multiple out-of-bounds write vulnerabilities are caused by a lack of proper validation of the length of user-suppl… |
CVE-2019-10985 | Critical | 9.1 | 2019-06-28 | In WebAccess/SCADA, Versions 8.3.5 and prior, a path traversal vulnerability is caused by a lack of proper validation of a user-supplied path prior to use in f… |
CVE-2019-10983 | High | 7.5 | 2019-06-28 | In WebAccess/SCADA Versions 8.3.5 and prior, an out-of-bounds read vulnerability is caused by a lack of proper validation of user-supplied data. Exploitation o… |
CVE-2019-3954 | Critical | 9.8 | 2019-06-19 | Stack-based buffer overflow in Advantech WebAccess/SCADA 8.4.0 allows a remote, unauthenticated attacker to execute arbitrary code by sending a crafted IOCTL 8… |
CVE-2019-3953 | Critical | 9.8 | 2019-06-18 | Stack-based buffer overflow in Advantech WebAccess/SCADA 8.4.0 allows a remote, unauthenticated attacker to execute arbitrary code by sending a crafted IOCTL 1… |
CVE-2019-3941 | High | 7.5 | 2019-04-09 | Advantech WebAccess 8.3.4 allows unauthenticated, remote attackers to delete arbitrary files via IOCTL 10005 RPC. |
CVE-2019-3940 | Critical | 9.8 | 2019-04-09 | Advantech WebAccess 8.3.4 is vulnerable to file upload attacks via unauthenticated RPC call. An unauthenticated, remote attacker can use this vulnerability to… |
CVE-2019-6554 | High | 7.5 | 2019-04-05 | Advantech WebAccess/SCADA, Versions 8.3.5 and prior. An improper access control vulnerability may allow an attacker to cause a denial-of-service condition. |
CVE-2019-6552 | Critical | 9.8 | 2019-04-05 | Advantech WebAccess/SCADA, Versions 8.3.5 and prior. Multiple command injection vulnerabilities, caused by a lack of proper validation of user-supplied data, m… |
CVE-2019-6550 | Critical | 9.8 | 2019-04-05 | Advantech WebAccess/SCADA, Versions 8.3.5 and prior. Multiple stack-based buffer overflow vulnerabilities, caused by a lack of proper validation of the length… |
CVE-2019-6523 | Critical | 9.8 | 2019-02-05 | WebAccess/SCADA, Version 8.3. The software does not properly sanitize its inputs for SQL commands. |
CVE-2019-6521 | High | 8.6 | 2019-02-05 | WebAccess/SCADA, Version 8.3. Specially crafted requests could allow a possible authentication bypass that could allow an attacker to obtain and manipulate sen… |
CVE-2019-6519 | Critical | 9.8 | 2019-02-05 | WebAccess/SCADA, Version 8.3. An improper authentication vulnerability exists that could allow a possible authentication bypass allowing an attacker to upload… |
CVE-2018-18999 | High | 7.3 | 2018-12-19 | WebAccess/SCADA, WebAccess/SCADA Version 8.3.2 installed on Windows 2008 R2 SP1. Lack of proper validation of user supplied input may allow an attacker to caus… |
CVE-2018-15707 | Medium | 5.4 | 2018-10-31 | Advantech WebAccess 8.3.1 and 8.3.2 are vulnerable to cross-site scripting in the Bwmainleft.asp page. An attacker could leverage this vulnerability to disclos… |
CVE-2018-15706 | Medium | 6.5 | 2018-10-31 | WADashboard API in Advantech WebAccess 8.3.1 and 8.3.2 allows remote authenticated attackers to read any file on the filesystem due to a directory traversal vu… |
CVE-2018-15705 | Medium | 6.5 | 2018-10-31 | WADashboard API in Advantech WebAccess 8.3.1 and 8.3.2 allows remote authenticated attackers to write or overwrite any file on the filesystem due to a director… |
CVE-2018-17910 | High | 7.8 | 2018-10-29 | WebAccess Versions 8.3.2 and prior. The application fails to properly validate the length of user-supplied data, causing a buffer overflow condition that allow… |
CVE-2018-17908 | High | 7.8 | 2018-10-29 | WebAccess Versions 8.3.2 and prior. During installation, the application installer disables user access control and does not re-enable it after the installatio… |
CVE-2018-14828 | High | 7.8 | 2018-10-23 | Advantech WebAccess 8.3.1 and earlier has an improper privilege management vulnerability, which may allow an attacker to access those files and perform actions… |
CVE-2018-14820 | High | 7.5 | 2018-10-23 | Advantech WebAccess 8.3.1 and earlier has a .dll component that is susceptible to external control of file name or path vulnerability, which may allow an arbit… |
CVE-2018-14816 | Critical | 9.8 | 2018-10-23 | Advantech WebAccess 8.3.1 and earlier has several stack-based buffer overflow vulnerabilities that have been identified, which may allow an attacker to execute… |
CVE-2018-14806 | Critical | 9.8 | 2018-10-23 | Advantech WebAccess 8.3.1 and earlier has a path traversal vulnerability which may allow an attacker to execute arbitrary code. |
CVE-2018-15704 | High | 8.8 | 2018-10-22 | Advantech WebAccess 8.3.2 and below is vulnerable to a stack buffer overflow vulnerability. A remote authenticated attacker could potentially exploit this vuln… |
CVE-2018-15703 | Medium | 6.1 | 2018-10-22 | Advantech WebAccess 8.3.2 and below is vulnerable to multiple reflected cross site scripting vulnerabilities. A remote unauthenticated attacker could potential… |
CVE-2018-8845 | Critical | 9.8 | 2018-05-15 | In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada… |
CVE-2018-8841 | High | 7.8 | 2018-05-15 | In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada… |
CVE-2018-7505 | Critical | 9.8 | 2018-05-15 | In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada… |
CVE-2018-7503 | High | 7.5 | 2018-05-15 | In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada… |
CVE-2018-7501 | High | 7.5 | 2018-05-15 | In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada… |
CVE-2018-7499 | Critical | 9.8 | 2018-05-15 | In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada… |
CVE-2018-7497 | Critical | 9.8 | 2018-05-15 | In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada… |
CVE-2018-7495 | High | 7.5 | 2018-05-15 | In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada… |
CVE-2018-10591 | Medium | 6.1 | 2018-05-15 | In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada… |
CVE-2018-10590 | High | 7.5 | 2018-05-15 | In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada… |
CVE-2018-10589 | Critical | 9.8 | 2018-05-15 | In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada… |
CVE-2017-5175 | High | 7.8 | 2018-05-09 | Advantech WebAccess 8.1 and earlier contains a DLL hijacking vulnerability which may allow an attacker to run a malicious DLL file within the search path resul… |
CVE-2018-8837 | High | 7.8 | 2018-04-25 | Processing specially crafted .pm3 files in Advantech WebAccess HMI Designer 2.1.7.32 and prior may cause the system to write outside the intended buffer area a… |
CVE-2018-8835 | High | 7.8 | 2018-04-25 | Double free vulnerabilities in Advantech WebAccess HMI Designer 2.1.7.32 and prior caused by processing specially crafted .pm3 files may allow remote code exec… |
CVE-2018-8833 | High | 7.8 | 2018-04-25 | Heap-based buffer overflow vulnerabilities in Advantech WebAccess HMI Designer 2.1.7.32 and prior caused by processing specially crafted .pm3 files may allow r… |
CVE-2018-6911 | Critical | 9.8 | 2018-02-13 | The VBWinExec function in Node\AspVBObj.dll in Advantech WebAccess 8.3.0 allows remote attackers to execute arbitrary OS commands via a single argument (aka th… |
CVE-2018-5445 | Medium | 5.3 | 2018-01-25 | A Path Traversal issue was discovered in Advantech WebAccess/SCADA versions prior to V8.2_20170817. An attacker has read access to files within the directory s… |
CVE-2018-5443 | Medium | 5.3 | 2018-01-25 | A SQL Injection issue was discovered in Advantech WebAccess/SCADA versions prior to V8.2_20170817. WebAccess/SCADA does not properly sanitize its inputs for SQ… |
CVE-2017-16736 | High | 7.5 | 2018-01-12 | An Unrestricted Upload Of File With Dangerous Type issue was discovered in Advantech WebAccess versions prior to 8.3. WebAccess allows a remote attacker to upl… |
CVE-2017-16732 | Medium | 6.5 | 2018-01-12 | A use-after-free issue was discovered in Advantech WebAccess versions prior to 8.3. WebAccess allows an unauthenticated attacker to specify an arbitrary addres… |
CVE-2017-16753 | High | 7.5 | 2018-01-05 | An Improper Input Validation issue was discovered in Advantech WebAccess versions prior to 8.3. WebAccess allows some inputs that may cause the program to cras… |
CVE-2017-16728 | High | 7.5 | 2018-01-05 | An Untrusted Pointer Dereference issue was discovered in Advantech WebAccess versions prior to 8.3. There are multiple vulnerabilities that may allow an attack… |
CVE-2017-16724 | Critical | 9.8 | 2018-01-05 | A Stack-based Buffer Overflow issue was discovered in Advantech WebAccess versions prior to 8.3. There are multiple instances of a vulnerability that allows to… |
CVE-2017-16720 | Critical | 9.8 | 2018-01-05 | A Path Traversal issue was discovered in WebAccess versions 8.3.2 and earlier. An attacker has access to files within the directory structure of the target dev… |
CVE-2017-16716 | Critical | 9.8 | 2018-01-05 | A SQL Injection issue was discovered in WebAccess versions prior to 8.3. WebAccess does not properly sanitize its inputs for SQL commands. |
CVE-2017-14016 | Medium | 6.3 | 2017-11-06 | A Stack-based Buffer Overflow issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. The application lacks proper validation of the lengt… |
CVE-2017-12719 | High | 7.5 | 2017-11-06 | An Untrusted Pointer Dereference issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. A remote attacker is able to execute code to dere… |
CVE-2017-12705 | High | 7.8 | 2017-10-25 | A Heap-Based Buffer Overflow issue was discovered in Advantech WebOP. A maliciously crafted project file may be able to trigger a heap-based buffer overflow, w… |
CVE-2017-12717 | High | 7.8 | 2017-08-30 | An Uncontrolled Search Path Element issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. A maliciously crafted dll file placed earlier… |
CVE-2017-12713 | High | 7.8 | 2017-08-30 | An Incorrect Permission Assignment for Critical Resource issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. Multiple files and folder… |
CVE-2017-12711 | High | 7.8 | 2017-08-30 | An Incorrect Privilege Assignment issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. A built-in user account has been granted a sensi… |