Advantech Webaccess vulnerabilities, page 5
118 vulnerabilities
Known vulnerabilities in Advantech Webaccess, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CriticalCVE-2017-16724advantech · webaccessadvantech webaccessA Stack-based Buffer Overflow issue was discovered in Advantech WebAccess versions prior to 8.3. There are multiple instances of a vulnerability that allows too much data to be written to a location on the stack.EPSS2.59%MediumCVE-2017-14016advantech · webaccessadvantech webaccessA Stack-based Buffer Overflow issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. The application lacks proper validation of the length of user-supplied data prior to copying it to a stack-based buffer, which could allow an attacker to execute arbitrary code under the context of the process.EPSS16.04%HighCVE-2017-7929advantech · webaccessadvantech webaccessAn Absolute Path Traversal issue was discovered in Advantech WebAccess Version 8.1 and prior. The absolute path traversal vulnerability has been identified, which may allow an attacker to traverse the file system to access restricted files or directories.EPSS1.54%CriticalCVE-2017-5154advantech · webaccessadvantech webaccessAn issue was discovered in Advantech WebAccess Version 8.1. To be able to exploit the SQL injection vulnerability, an attacker must supply malformed input to the WebAccess software. Successful attack could result in administrative access to the application and its data files.EPSS4.40%CriticalCVE-2017-5152advantech · webaccessadvantech webaccessAn issue was discovered in Advantech WebAccess Version 8.1. By accessing a specific uniform resource locator (URL) on the web server, a malicious user is able to access pages unrestricted (AUTHENTICATION BYPASS).EPSS3.77%HighCVE-2017-5175advantech · webaccess +1 moreadvantech webaccessAdvantech WebAccess 8.1 and earlier contains a DLL hijacking vulnerability which may allow an attacker to run a malicious DLL file within the search path resulting in execution of arbitrary code.EPSS1.56%HighCVE-2017-12710advantech · webaccessadvantech webaccessA SQL Injection issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. By submitting a specially crafted parameter, it is possible to inject arbitrary SQL statements that could allow an attacker to obtain sensitive information.EPSS2.21%HighCVE-2017-12719advantech · webaccessadvantech webaccessAn Untrusted Pointer Dereference issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. A remote attacker is able to execute code to dereference a pointer within the program causing the application to become unavailable.EPSS3.05%CriticalCVE-2017-12708advantech · webaccessadvantech webaccessAn Improper Restriction Of Operations Within The Bounds Of A Memory Buffer issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. Researchers have identified multiple vulnerabilities that allow invalid locations to be referenced for the memory buffer, which may allow an attacker to execute arbitrary code or cause the system to crash.EPSS3.38%HighCVE-2017-12713advantech · webaccessadvantech webaccessAn Incorrect Permission Assignment for Critical Resource issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. Multiple files and folders with ACLs that affect other users are allowed to be modified by non-administrator accounts.EPSS0.35%HighCVE-2017-12717advantech · webaccessadvantech webaccessAn Uncontrolled Search Path Element issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. A maliciously crafted dll file placed earlier in the search path may allow an attacker to execute code within the context of the application.EPSS2.44%HighCVE-2017-12711advantech · webaccessadvantech webaccessAn Incorrect Privilege Assignment issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. A built-in user account has been granted a sensitive privilege that may allow a user to elevate to administrative privileges.EPSS0.35%CriticalCVE-2017-12698advantech · webaccessadvantech webaccessAn Improper Authentication issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. Specially crafted requests allow a possible authentication bypass that could allow remote code execution.EPSS4.83%HighCVE-2017-12702advantech · webaccessadvantech webaccessAn Externally Controlled Format String issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. String format specifiers based on user provided input are not properly validated, which could allow an attacker to execute arbitrary code.EPSS2.29%CriticalCVE-2017-12706advantech · webaccessadvantech webaccessA stack-based buffer overflow issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. Researchers have identified multiple vulnerabilities where there is a lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer, which could allow an attacker to execute arbitrary code under the context of the process.EPSS3.17%HighCVE-2017-12704advantech · webaccessadvantech webaccessA heap-based buffer overflow issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. Researchers have identified multiple vulnerabilities where there is a lack of proper validation of the length of user-supplied data prior to copying it to the heap-based buffer, which could allow an attacker to execute arbitrary code under the context of the process.EPSS2.60%CriticalCVE-2019-13558advantech · webaccessadvantech webaccessIn WebAccess versions 8.4.1 and prior, an exploit executed over the network may cause improper control of generation of code, which may allow remote code execution, data exfiltration, or cause a system crash.EPSS2.86%HighCVE-2019-13556advantech · webaccessadvantech webaccessIn WebAccess versions 8.4.1 and prior, multiple stack-based buffer overflow vulnerabilities are caused by a lack of proper validation of the length of user-supplied data. Exploitation of these vulnerabilities may allow remote code execution.EPSS2.12%CriticalCVE-2019-13550advantech · webaccessadvantech webaccessIn WebAccess, versions 8.4.1 and prior, an improper authorization vulnerability may allow an attacker to disclose sensitive information, cause improper control of generation of code, which may allow remote code execution or cause a system crash.EPSS2.85%HighCVE-2019-13552advantech · webaccessadvantech webaccessIn WebAccess versions 8.4.1 and prior, multiple command injection vulnerabilities are caused by a lack of proper validation of user-supplied data and may allow arbitrary file deletion and remote code execution.EPSS2.66%