Advantech Webaccess vulnerabilities, page 3
118 vulnerabilities
Known vulnerabilities in Advantech Webaccess, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CriticalCVE-2016-0859advantech · webaccessadvantech webaccessInteger overflow in the Kernel service in Advantech WebAccess before 8.1 allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted RPC request.EPSS7.57%HighCVE-2016-0853advantech · webaccessadvantech webaccessAdvantech WebAccess before 8.1 allows remote attackers to obtain sensitive information via crafted input.EPSS2.26%MediumCVE-2016-4525advantech · webaccessadvantech webaccessUnspecified ActiveX controls in Advantech WebAccess before 8.1_20160519 allow remote authenticated users to obtain sensitive information or modify data via unknown vectors, related to the INTERFACESAFE_FOR_UNTRUSTED_CALLER (aka safe for scripting) flag.EPSS0.45%MediumCVE-2016-4528advantech · webaccessadvantech webaccessBuffer overflow in Advantech WebAccess before 8.1_20160519 allows local users to cause a denial of service via a crafted DLL file.EPSS0.68%MediumCVE-2016-5810advantech · webaccessadvantech webaccessupAdminPg.asp in Advantech WebAccess before 8.1_20160519 allows remote authenticated administrators to obtain sensitive password information via unspecified vectors.EPSS15.36%HighCVE-2020-16202advantech · webaccessadvantech webaccessWebAccess Node (All versions prior to 9.0.1) has incorrect permissions set for resources used by specific services, which may allow code execution with system privileges.EPSS0.38%CriticalCVE-2020-10638advantech · webaccessadvantech webaccessAdvantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple heap-based buffer overflow vulnerabilities exist caused by a lack of proper validation of the length of user-supplied data, which may allow remote code execution.EPSS7.06%HighCVE-2020-10607advantech · webaccessadvantech webaccessIn Advantech WebAccess, Versions 8.4.2 and prior. A stack-based buffer overflow vulnerability caused by a lack of proper validation of the length of user-supplied data may allow remote code execution.EPSS2.12%HighCVE-2020-12014advantech · webaccessadvantech webaccessAdvantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Input is not properly sanitized and may allow an attacker to inject SQL commands.EPSS1.53%HighCVE-2020-12010advantech · webaccessadvantech webaccessAdvantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple relative path traversal vulnerabilities exist that may allow an authenticated user to use a specially crafted file to delete files outside the application’s control.EPSS1.03%CriticalCVE-2020-12022advantech · webaccessadvantech webaccessAdvantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. An improper validation vulnerability exists that could allow an attacker to inject specially crafted input into memory where it can be executed.EPSS1.67%CriticalCVE-2020-12006advantech · webaccessadvantech webaccessAdvantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple relative path traversal vulnerabilities exist that may allow a low privilege user to overwrite files outside the application’s control.EPSS3.69%HighCVE-2020-12018advantech · webaccessadvantech webaccessAdvantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. An out-of-bounds vulnerability exists that may allow access to unauthorized data.EPSS1.53%CriticalCVE-2020-12019advantech · webaccessadvantech webaccessWebAccess Node Version 8.4.4 and prior is vulnerable to a stack-based buffer overflow, which may allow an attacker to remotely execute arbitrary code.EPSS2.17%CriticalCVE-2020-12002advantech · webaccessadvantech webaccessAdvantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple stack-based buffer overflow vulnerabilities exist caused by a lack of proper validation of the length of user-supplied data, which may allow remote code execution.EPSS9.08%HighCVE-2020-12026advantech · webaccessadvantech webaccessAdvantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple relative path traversal vulnerabilities exist that may allow a low privilege user to overwrite files outside the application’s control.EPSS2.31%CriticalCVE-2014-2366advantech · advantech_webaccess +1 moreAdvantech WebAccess Cleartext Storage of Sensitive Information in MemoryupAdminPg.asp in Advantech WebAccess before 7.2 allows remote authenticated users to discover credentials by reading HTML source code.EPSS1.31%HighCVE-2014-2364advantech · advantech_webaccess +1 moreAdvantech WebAccess Stack-Based Buffer OverflowMultiple stack-based buffer overflows in Advantech WebAccess before 7.2 allow remote attackers to execute arbitrary code via a long string in the (1) ProjectName, (2) SetParameter, (3) NodeName, (4) CCDParameter, (5) SetColor, (6) AlarmImage, (7) GetParameter, (8) GetColor, (9) ServerResponse, (10) SetBaud, or (11) IPAddress parameter to an ActiveX control in (a) webvact.ocx, (b) dvs.ocx, or (c) webdact.ocx.EPSS61.38%MediumCVE-2014-2365advantech · advantech_webaccess +1 moreAdvantech WebAccess Improper Access ControlUnspecified vulnerability in Advantech WebAccess before 7.2 allows remote authenticated users to create or delete arbitrary files via unknown vectors.EPSS1.60%HighCVE-2014-2368advantech · advantech_webaccess +1 moreAdvantech WebAccess Unsafe ActiveX Control Marked Safe For ScriptingThe BrowseFolder method in the bwocxrun ActiveX control in Advantech WebAccess before 7.2 allows remote attackers to read arbitrary files via a crafted call.EPSS1.71%