Advantech
Page 4 of 4 — Advantech CVEs from a corpus of 388, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-12710 | High | 7.5 | 2017-08-30 | A SQL Injection issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. By submitting a specially crafted parameter, it is possible to inj… |
CVE-2017-12708 | Critical | 9.8 | 2017-08-30 | An Improper Restriction Of Operations Within The Bounds Of A Memory Buffer issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. Researc… |
CVE-2017-12706 | Critical | 9.8 | 2017-08-30 | A stack-based buffer overflow issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. Researchers have identified multiple vulnerabilities… |
CVE-2017-12704 | High | 8.8 | 2017-08-30 | A heap-based buffer overflow issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. Researchers have identified multiple vulnerabilities… |
CVE-2017-12702 | High | 8.8 | 2017-08-30 | An Externally Controlled Format String issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. String format specifiers based on user prov… |
CVE-2017-12698 | Critical | 9.8 | 2017-08-30 | An Improper Authentication issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. Specially crafted requests allow a possible authenticat… |
CVE-2017-7929 | High | 7.1 | 2017-05-06 | An Absolute Path Traversal issue was discovered in Advantech WebAccess Version 8.1 and prior. The absolute path traversal vulnerability has been identified, wh… |
CVE-2016-5810 | Medium | 4.9 | 2017-05-02 | upAdminPg.asp in Advantech WebAccess before 8.1_20160519 allows remote authenticated administrators to obtain sensitive password information via unspecified ve… |
CVE-2017-5154 | Critical | 9.8 | 2017-02-13 | An issue was discovered in Advantech WebAccess Version 8.1. To be able to exploit the SQL injection vulnerability, an attacker must supply malformed input to t… |
CVE-2017-5152 | Critical | 9.1 | 2017-02-13 | An issue was discovered in Advantech WebAccess Version 8.1. By accessing a specific uniform resource locator (URL) on the web server, a malicious user is able… |
CVE-2016-9353 | High | 7.8 | 2017-02-13 | An issue was discovered in Advantech SUISAccess Server Version 3.0 and prior. The admin password is stored in the system and is encrypted with a static key har… |
CVE-2016-9351 | High | 7.0 | 2017-02-13 | An issue was discovered in Advantech SUISAccess Server Version 3.0 and prior. The directory traversal/file upload error allows an attacker to upload and unpack… |
CVE-2016-9349 | High | 7.5 | 2017-02-13 | An issue was discovered in Advantech SUISAccess Server Version 3.0 and prior. An attacker could traverse the file system and extract files that can result in i… |
CVE-2016-4528 | Medium | 5.0 | 2016-06-25 | Buffer overflow in Advantech WebAccess before 8.1_20160519 allows local users to cause a denial of service via a crafted DLL file. |
CVE-2016-4525 | Medium | 6.6 | 2016-06-25 | Unspecified ActiveX controls in Advantech WebAccess before 8.1_20160519 allow remote authenticated users to obtain sensitive information or modify data via unk… |
CVE-2016-2275 | Critical | 9.8 | 2016-02-21 | The web interface on Advantech/B+B SmartWorx VESP211-EU devices with firmware 1.7.2 and VESP211-232 devices with firmware 1.5.1 and 1.7.2 relies on the client… |
CVE-2016-0860 | High | 7.5 | 2016-01-15 | Buffer overflow in the BwpAlarm subsystem in Advantech WebAccess before 8.1 allows remote attackers to cause a denial of service via a crafted RPC request. |
CVE-2016-0859 | Critical | 9.8 | 2016-01-15 | Integer overflow in the Kernel service in Advantech WebAccess before 8.1 allows remote attackers to execute arbitrary code or cause a denial of service (stack-… |
CVE-2016-0858 | High | 8.1 | 2016-01-15 | Race condition in Advantech WebAccess before 8.1 allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow) via a crafted… |
CVE-2016-0857 | Critical | 9.8 | 2016-01-15 | Multiple heap-based buffer overflows in Advantech WebAccess before 8.1 allow remote attackers to execute arbitrary code via unspecified vectors. |
CVE-2016-0856 | Critical | 9.8 | 2016-01-15 | Multiple stack-based buffer overflows in Advantech WebAccess before 8.1 allow remote attackers to execute arbitrary code via unspecified vectors. |
CVE-2016-0855 | High | 7.5 | 2016-01-15 | Directory traversal vulnerability in Advantech WebAccess before 8.1 allows remote attackers to list arbitrary virtual-directory files via unspecified vectors. |
CVE-2016-0854 | Critical | 9.8 | 2016-01-15 | Unrestricted file upload vulnerability in the uploadImageCommon function in the UploadAjaxAction script in the WebAccess Dashboard Viewer in Advantech WebAcces… |
CVE-2016-0853 | High | 7.5 | 2016-01-15 | Advantech WebAccess before 8.1 allows remote attackers to obtain sensitive information via crafted input. |
CVE-2016-0852 | High | 7.5 | 2016-01-15 | Advantech WebAccess before 8.1 allows remote attackers to bypass an intended administrative requirement and obtain file or folder access via unspecified vector… |
CVE-2016-0851 | High | 7.5 | 2016-01-15 | Advantech WebAccess before 8.1 allows remote attackers to cause a denial of service (out-of-bounds memory access) via unspecified vectors. |
CVE-2015-6467 | High | 8.1 | 2016-01-15 | Advantech WebAccess before 8.1 allows remote attackers to execute arbitrary code via vectors involving a browser plugin. |
CVE-2015-3948 | Medium | 5.4 | 2016-01-15 | Cross-site scripting (XSS) vulnerability in Advantech WebAccess before 8.1 allows remote authenticated users to inject arbitrary web script or HTML via unspeci… |
CVE-2015-3947 | High | 8.1 | 2016-01-15 | SQL injection vulnerability in Advantech WebAccess before 8.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors. |
CVE-2015-3946 | High | 8.8 | 2016-01-15 | Cross-site request forgery (CSRF) vulnerability in Advantech WebAccess before 8.1 allows remote attackers to hijack the authentication of unspecified victims v… |
CVE-2015-3943 | Medium | 5.3 | 2016-01-15 | Advantech WebAccess before 8.1 allows remote attackers to read sensitive cleartext information about e-mail project accounts via unspecified vectors. |
CVE-2015-7938 | Critical | 9.8 | 2016-01-09 | Advantech EKI-132x devices with firmware before 2015-12-31 allow remote attackers to bypass authentication via unspecified vectors. |
CVE-2015-6476 | | 2015-11-07 | Advantech EKI-122x-BE devices with firmware before 1.65, EKI-132x devices with firmware before 1.98, and EKI-136x devices with firmware before 1.27 have hardco… | |
CVE-2014-9202 | | 2015-09-28 | Multiple stack-based buffer overflows in an unspecified DLL file in Advantech WebAccess before 8.0_20150816 allow remote attackers to execute arbitrary code vi… | |
CVE-2014-9208 | | 2015-09-11 | Multiple stack-based buffer overflows in unspecified DLL files in Advantech WebAccess before 8.0.1 allow remote attackers to execute arbitrary code via unknown… | |
CVE-2014-8385 | | 2015-02-13 | Buffer overflow on Advantech EKI-1200 gateways with firmware before 1.63 allows remote attackers to execute arbitrary code via unspecified vectors. | |
CVE-2014-8386 | | 2015-01-20 | Multiple stack-based buffer overflows in Advantech AdamView 4.3 and earlier allow remote attackers to execute arbitrary code via a crafted (1) display properti… | |
CVE-2014-8388 | | 2014-11-21 | Stack-based buffer overflow in Advantech WebAccess, formerly BroadWin WebAccess, before 8.0 allows remote attackers to execute arbitrary code via a crafted ip_… | |
CVE-2014-8387 | | 2014-11-20 | cgi/utility.cgi in Advantech EKI-6340 2.05 Wi-Fi Mesh Access Point allows remote authenticated users to execute arbitrary commands via shell metacharacters in… | |
CVE-2014-0992 | | 2014-09-20 | Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the password paramet… | |
CVE-2014-0991 | | 2014-09-20 | Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the projectname para… | |
CVE-2014-0990 | | 2014-09-20 | Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the UserName paramet… | |
CVE-2014-0989 | | 2014-09-20 | Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the AccessCode2 para… | |
CVE-2014-0988 | | 2014-09-20 | Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the AccessCode param… | |
CVE-2014-0987 | | 2014-09-20 | Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the NodeName2 parame… | |
CVE-2014-0986 | | 2014-09-20 | Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the GotoCmd paramete… | |
CVE-2014-0985 | | 2014-09-20 | Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the NodeName paramet… | |
CVE-2014-2368 | | 2014-07-19 | The BrowseFolder method in the bwocxrun ActiveX control in Advantech WebAccess before 7.2 allows remote attackers to read arbitrary files via a crafted call. | |
CVE-2014-2367 | | 2014-07-19 | The ChkCookie subroutine in an ActiveX control in broadweb/include/gChkCook.asp in Advantech WebAccess before 7.2 allows remote attackers to read arbitrary fil… | |
CVE-2014-2366 | | 2014-07-19 | upAdminPg.asp in Advantech WebAccess before 7.2 allows remote authenticated users to discover credentials by reading HTML source code. | |
CVE-2014-2365 | | 2014-07-19 | Unspecified vulnerability in Advantech WebAccess before 7.2 allows remote authenticated users to create or delete arbitrary files via unknown vectors. | |
CVE-2014-2364 | | 2014-07-19 | Multiple stack-based buffer overflows in Advantech WebAccess before 7.2 allow remote attackers to execute arbitrary code via a long string in the (1) ProjectNa… | |
CVE-2014-0773 | | 2014-04-12 | The BWOCXRUN.BwocxrunCtrl.1 control contains a method named “CreateProcess.” This method contains validation to ensure an attacker cannot run arbitrary comma… | |
CVE-2014-0772 | | 2014-04-12 | The BWOCXRUN.BwocxrunCtrl.1 control contains a method named OpenUrlToBufferTimeout. This method takes a URL as a parameter and returns its contents to the ca… | |
CVE-2014-0771 | | 2014-04-12 | The BWOCXRUN.BwocxrunCtrl.1 control contains a method named “OpenUrlToBuffer.” This method takes a URL as a parameter and returns its contents to the caller… | |
CVE-2014-0770 | | 2014-04-12 | By providing an overly long string to the UserName parameter, an attacker may be able to overflow the static stack buffer. The attacker may then execute code… | |
CVE-2014-0768 | | 2014-04-12 | An attacker may pass an overly long value from the AccessCode2 argument to the control to overflow the static stack buffer. The attacker may then remotely ex… | |
CVE-2014-0767 | | 2014-04-12 | An attacker may exploit this vulnerability by passing an overly long value from the AccessCode argument to the control. This will overflow the static stack b… | |
CVE-2014-0766 | | 2014-04-12 | An attacker can exploit this vulnerability by copying an overly long NodeName2 argument into a statically sized buffer on the stack to overflow the static st… | |
CVE-2014-0765 | | 2014-04-12 | To exploit this vulnerability, the attacker sends data from the GotoCmd argument to control. If the value of the argument is overly long, the static stack bu… | |
CVE-2014-0764 | | 2014-04-12 | By providing an overly long string to the NodeName parameter, an attacker may be able to overflow the static stack buffer. The attacker may then execute code… | |
CVE-2014-0763 | | 2014-04-12 | An attacker using SQL injection may use arguments to construct queries without proper sanitization. The DBVisitor.dll is exposed through SOAP interfaces, and… | |
CVE-2013-2299 | | 2013-08-22 | Cross-site scripting (XSS) vulnerability in Advantech WebAccess (formerly BroadWin WebAccess) before 7.1 2013.05.30 allows remote authenticated users to inject… | |
CVE-2013-1627 | | 2013-03-11 | Absolute path traversal vulnerability in NTWebServer.exe in Indusoft Studio 7.0 and earlier and Advantech Studio 7.0 and earlier allows remote attackers to rea… | |
CVE-2012-1235 | | 2012-02-21 | Cross-site request forgery (CSRF) vulnerability in Advantech/BroadWin WebAccess 7.0 allows remote authenticated users to hijack the authentication of unspecifi… | |
CVE-2012-1234 | | 2012-02-21 | SQL injection vulnerability in Advantech/BroadWin WebAccess 7.0 allows remote authenticated users to execute arbitrary SQL commands via a malformed URL. NOTE… | |
CVE-2012-0244 | | 2012-02-21 | Multiple SQL injection vulnerabilities in Advantech/BroadWin WebAccess before 7.0 allow remote attackers to execute arbitrary SQL commands via crafted string i… | |
CVE-2012-0243 | | 2012-02-21 | Buffer overflow in an ActiveX control in bwocxrun.ocx in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary code by leveragin… | |
CVE-2012-0242 | | 2012-02-21 | Format string vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary code via format string specifiers in a mess… | |
CVE-2012-0241 | | 2012-02-21 | Advantech/BroadWin WebAccess before 7.0 allows remote attackers to cause a denial of service (memory corruption) via a modified stream identifier to a function. | |
CVE-2012-0240 | | 2012-02-21 | GbScriptAddUp.asp in Advantech/BroadWin WebAccess before 7.0 does not properly perform authentication, which allows remote attackers to execute arbitrary code… | |
CVE-2012-0239 | | 2012-02-21 | uaddUpAdmin.asp in Advantech/BroadWin WebAccess before 7.0 does not properly perform authentication, which allows remote attackers to modify an administrative… | |
CVE-2012-0238 | | 2012-02-21 | Stack-based buffer overflow in opcImg.asp in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary code via unspecified vectors. | |
CVE-2012-0237 | | 2012-02-21 | Advantech/BroadWin WebAccess before 7.0 allows remote attackers to (1) enable date and time syncing or (2) disable date and time syncing via a crafted URL. | |
CVE-2012-0236 | | 2012-02-21 | Advantech/BroadWin WebAccess 7.0 and earlier allows remote attackers to obtain sensitive information via a direct request to a URL. NOTE: the vendor reportedl… | |
CVE-2012-0235 | | 2012-02-21 | Cross-site request forgery (CSRF) vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to hijack the authentication of unspecified… | |
CVE-2012-0234 | | 2012-02-21 | SQL injection vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary SQL commands via a malformed URL. | |
CVE-2012-0233 | | 2012-02-21 | Cross-site scripting (XSS) vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to inject arbitrary web script or HTML via a malfor… | |
CVE-2011-4526 | | 2012-02-21 | Buffer overflow in an ActiveX control in Advantech/BroadWin WebAccess before 7.0 might allow remote attackers to execute arbitrary code via a long string value… | |
CVE-2011-4525 | | 2012-02-21 | Advantech/BroadWin WebAccess before 7.0 allows remote attackers to trigger the extraction of arbitrary web content into a batch file on a client system, and ex… | |
CVE-2011-4524 | | 2012-02-21 | Buffer overflow in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary code via a long string value in unspecified parameters. | |
CVE-2011-4523 | | 2012-02-21 | Cross-site scripting (XSS) vulnerability in bwview.asp in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to inject arbitrary web script or HTM… | |
CVE-2011-4522 | | 2012-02-21 | Cross-site scripting (XSS) vulnerability in bwerrdn.asp in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to inject arbitrary web script or HT… | |
CVE-2011-4521 | | 2012-02-21 | SQL injection vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary SQL commands via crafted string input. | |
CVE-2011-1914 | | 2012-02-21 | Buffer overflow in the Advantech ADAM OLE for Process Control (OPC) Server ActiveX control in ADAM OPC Server before 3.01.012, Modbus RTU OPC Server before 3.0… | |
CVE-2011-0340 | | 2011-05-04 | Multiple buffer overflows in the ISSymbol ActiveX control in ISSymbol.ocx 61.6.0.0 and 301.1009.2904.0 in the ISSymbol virtual machine, as distributed in Advan… | |
CVE-2011-0488 | | 2011-01-18 | Stack-based buffer overflow in NTWebServer.exe in the test web service in InduSoft NTWebServer, as distributed in Advantech Studio 6.1 and InduSoft Web Studio… | |
CVE-2008-5848 | | 2009-01-06 | The Advantech ADAM-6000 module has 00000000 as its default password, which makes it easier for remote attackers to obtain access through an HTTP session, and (… |