Advantech Webaccess vulnerabilities
53 vulnerabilities
Known vulnerabilities in Advantech Webaccess, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2018-14828advantechadvantech_webaccess+1
EPSS score0.41%
Advantech WebAccess 8.3.1 and earlier has an improper privilege management vulnerability, which may allow an attacker to access those files and perform actions at a system administrator level.CVE-2018-14816advantechadvantech_webaccess+1EPSS score4.13%
Advantech WebAccess 8.3.1 and earlier has several stack-based buffer overflow vulnerabilities that have been identified, which may allow an attacker to execute arbitrary code.CVE-2018-14806advantechadvantech_webaccess+1EPSS score4.78%
Advantech WebAccess 8.3.1 and earlier has a path traversal vulnerability which may allow an attacker to execute arbitrary code.CVE-2018-14820advantechadvantech_webaccess+1EPSS score2.20%
Advantech WebAccess 8.3.1 and earlier has a .dll component that is susceptible to external control of file name or path vulnerability, which may allow an arbitrary file deletion when processing.CVE-2018-15707advantechadvantech_webaccess+1EPSS score1.88%
Advantech WebAccess 8.3.1 and 8.3.2 are vulnerable to cross-site scripting in the Bwmainleft.asp page. An attacker could leverage this vulnerability to disclose credentials amongst other things.CVE-2018-15705advantechadvantech_webaccess+1EPSS score12.24%
WADashboard API in Advantech WebAccess 8.3.1 and 8.3.2 allows remote authenticated attackers to write or overwrite any file on the filesystem due to a directory traversal vulnerability in the writeFile API. An attacker can use this vulnerability to remotely execute arbitrary code.CVE-2018-15703advantechadvantech_webaccess+1EPSS score0.88%
Advantech WebAccess 8.3.2 and below is vulnerable to multiple reflected cross site scripting vulnerabilities. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim to supply malicious HTML or JavaScript code to WebAccess, which is then reflected back to the victim and executed by the web browser.CVE-2018-15704advantechadvantech_webaccess+1EPSS score21.54%
Advantech WebAccess 8.3.2 and below is vulnerable to a stack buffer overflow vulnerability. A remote authenticated attacker could potentially exploit this vulnerability by sending a crafted HTTP request to broadweb/system/opcImg.asp.CVE-2018-15706advantechadvantech_webaccess+1EPSS score32.37%
WADashboard API in Advantech WebAccess 8.3.1 and 8.3.2 allows remote authenticated attackers to read any file on the filesystem due to a directory traversal vulnerability in the readFile API.CVE-2013-2299advantechadvantech_webaccessEPSS score1.44%
Cross-site scripting (XSS) vulnerability in Advantech WebAccess (formerly BroadWin WebAccess) before 7.1 2013.05.30 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.CVE-2014-2366advantechadvantech_webaccess+1EPSS score1.31%
upAdminPg.asp in Advantech WebAccess before 7.2 allows remote authenticated users to discover credentials by reading HTML source code.CVE-2014-2364advantechadvantech_webaccess+1EPSS score61.38%
Multiple stack-based buffer overflows in Advantech WebAccess before 7.2 allow remote attackers to execute arbitrary code via a long string in the (1) ProjectName, (2) SetParameter, (3) NodeName, (4) CCDParameter, (5) SetColor, (6) AlarmImage, (7) GetParameter, (8) GetColor, (9) ServerResponse, (10) SetBaud, or (11) IPAddress parameter to an ActiveX control in (a) webvact.ocx, (b) dvs.ocx, or (c) webdact.ocx.CVE-2014-2365advantechadvantech_webaccess+1EPSS score1.60%
Unspecified vulnerability in Advantech WebAccess before 7.2 allows remote authenticated users to create or delete arbitrary files via unknown vectors.CVE-2014-2368advantechadvantech_webaccess+1EPSS score1.71%
The BrowseFolder method in the bwocxrun ActiveX control in Advantech WebAccess before 7.2 allows remote attackers to read arbitrary files via a crafted call.CVE-2014-2367advantechadvantech_webaccess+1EPSS score1.55%
The ChkCookie subroutine in an ActiveX control in broadweb/include/gChkCook.asp in Advantech WebAccess before 7.2 allows remote attackers to read arbitrary files via a crafted call.CVE-2014-0992advantechadvantech_webaccessEPSS score2.57%
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the password parameter.CVE-2014-0989advantechadvantech_webaccessEPSS score2.57%
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the AccessCode2 parameter.CVE-2014-0766advantechadvantech_webaccess+1EPSS score2.67%
An attacker can exploit this vulnerability by copying an overly long
NodeName2 argument into a statically sized buffer on the stack to
overflow the static stack buffer. An attacker may use this vulnerability
to remotely execute arbitrary code.CVE-2014-0987advantechadvantech_webaccessEPSS score2.57%
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the NodeName2 parameter.CVE-2014-0768advantechadvantech_webaccess+1EPSS score2.67%
An attacker may pass an overly long value from the AccessCode2 argument
to the control to overflow the static stack buffer. The attacker may
then remotely execute arbitrary code.