Advantech Webaccess vulnerabilities, page 2
118 vulnerabilities
Known vulnerabilities in Advantech Webaccess, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2018-6911advantechwebaccess
EPSS score12.80%
The VBWinExec function in Node\AspVBObj.dll in Advantech WebAccess 8.3.0 allows remote attackers to execute arbitrary OS commands via a single argument (aka the command parameter).CVE-2018-8841advantechwebaccess+3EPSS score0.36%
In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada Node versions prior to 8.3.1, and WebAccess/NMS 2.0.3 and prior, an improper privilege management vulnerability may allow an authenticated user to modify files when read access should only be given to the user.CVE-2018-8845advantechwebaccess+3EPSS score5.61%
In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada Node versions prior to 8.3.1, and WebAccess/NMS 2.0.3 and prior, a heap-based buffer overflow vulnerability has been identified, which may allow an attacker to execute arbitrary code.CVE-2021-38408advantechwebaccessEPSS score11.57%
A stack-based buffer overflow vulnerability in Advantech WebAccess Versions 9.02 and prior caused by a lack of proper validation of the length of user-supplied data may allow remote code execution.CVE-2021-38389advantechwebaccessEPSS score10.37%
Advantech WebAccess versions 9.02 and prior are vulnerable to a stack-based buffer overflow, which may allow an attacker to remotely execute code.CVE-2021-34540advantechwebaccessEPSS score0.87%
Advantech WebAccess 8.4.2 and 8.4.4 allows XSS via the username column of the bwRoot.asp page of WADashboard.CVE-2021-33023advantechwebaccessEPSS score2.35%
Advantech WebAccess versions 9.02 and prior are vulnerable to a heap-based buffer overflow, which may allow an attacker to remotely execute code.CVE-2015-6467advantechwebaccessEPSS score3.76%
Advantech WebAccess before 8.1 allows remote attackers to execute arbitrary code via vectors involving a browser plugin.CVE-2015-3946advantechwebaccessEPSS score0.90%
Cross-site request forgery (CSRF) vulnerability in Advantech WebAccess before 8.1 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.CVE-2015-3948advantechwebaccessEPSS score0.97%
Cross-site scripting (XSS) vulnerability in Advantech WebAccess before 8.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.CVE-2015-3947advantechwebaccessEPSS score1.69%
SQL injection vulnerability in Advantech WebAccess before 8.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.CVE-2015-3943advantechwebaccessEPSS score1.76%
Advantech WebAccess before 8.1 allows remote attackers to read sensitive cleartext information about e-mail project accounts via unspecified vectors.CVE-2016-0851advantechwebaccessEPSS score2.23%
Advantech WebAccess before 8.1 allows remote attackers to cause a denial of service (out-of-bounds memory access) via unspecified vectors.CVE-2016-0857advantechwebaccessEPSS score28.18%
Multiple heap-based buffer overflows in Advantech WebAccess before 8.1 allow remote attackers to execute arbitrary code via unspecified vectors.CVE-2016-0858advantechwebaccessEPSS score5.09%
Race condition in Advantech WebAccess before 8.1 allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow) via a crafted request.CVE-2016-0852advantechwebaccessEPSS score2.41%
Advantech WebAccess before 8.1 allows remote attackers to bypass an intended administrative requirement and obtain file or folder access via unspecified vectors.CVE-2016-0860advantechwebaccessEPSS score5.42%
Buffer overflow in the BwpAlarm subsystem in Advantech WebAccess before 8.1 allows remote attackers to cause a denial of service via a crafted RPC request.CVE-2016-0854advantechwebaccessEPSS score77.04%
Unrestricted file upload vulnerability in the uploadImageCommon function in the UploadAjaxAction script in the WebAccess Dashboard Viewer in Advantech WebAccess before 8.1 allows remote attackers to write to files of arbitrary types via unspecified vectors.CVE-2016-0855advantechwebaccessEPSS score4.69%
Directory traversal vulnerability in Advantech WebAccess before 8.1 allows remote attackers to list arbitrary virtual-directory files via unspecified vectors.CVE-2016-0856advantechwebaccessEPSS score16.66%
Multiple stack-based buffer overflows in Advantech WebAccess before 8.1 allow remote attackers to execute arbitrary code via unspecified vectors.