Advantech vulnerabilities, page 5

433 vulnerabilities

Known vulnerabilities in Advantech products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 93 products.

7.7HighCVE-2021-21920advantech · r-seenetadvantech r-seenetA specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability at ‘surname_filter’ parameter with the administrative account or through cross-site request forgery.EPSS1.17%7.7HighCVE-2021-21935advantech · r-seenetadvantech r-seenetA specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability at ‘host_alt_filter2’ parameter. This can be done as any authenticated user or through cross-site request forgery.EPSS1.18%7.7HighCVE-2021-21925advantech · r-seenetadvantech r-seenetA specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger these vulnerabilities. This can be done as any authenticated user or through cross-site request forgery at ‘firm_filter’ parameter.EPSS1.18%7.7HighCVE-2021-21922advantech · r-seenetadvantech r-seenetA specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability at ‘username_filter’ parameter with the administrative account or through cross-site request forgery.EPSS1.18%7.7HighCVE-2021-21927advantech · r-seenetadvantech r-seenetA specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger these vulnerabilities. This can be done as any authenticated user or through cross-site request forgery at ‘loc_filter’ parameter.EPSS1.18%7.7HighCVE-2021-21924advantech · r-seenetadvantech r-seenetA specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger these vulnerabilities. This can be done as any authenticated user or through cross-site request forgery at ‘desc_filter’ parameter.EPSS20.16%7.7HighCVE-2021-21932advantech · r-seenetadvantech r-seenetA specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this at ‘name_filter’ parameter. This can be done as any authenticated user or through cross-site request forgery.EPSS1.18%7.7HighCVE-2021-21919advantech · r-seenetadvantech r-seenetA specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability at ord’ parameter. However, the high privilege super-administrator account needs to be used to achieve exploitation without cross-site request forgery attack.EPSS1.17%8.8HighCVE-2021-21916advantech · r-seenetadvantech r-seenetAn exploitable SQL injection vulnerability exist in the ‘group_list’ page of the Advantech R-SeeNet 2.4.15 (30.07.2021). A specially-crafted HTTP request at 'description_filter’ parameter. An attacker can make authenticated HTTP requests to trigger this vulnerability. This can be done as any authenticated user or through cross-site request forgery.EPSS1.43%8.8HighCVE-2021-40396advantech · deviceon\/iserviceadvantech deviceon\/iserviceA privilege escalation vulnerability exists in the installation of Advantech DeviceOn/iService 1.1.7. A specially-crafted file can be replaced in the system to escalate privileges to NT SYSTEM authority. An attacker can provide a malicious file to trigger this vulnerability.EPSS0.36%9.3CriticalCVE-2021-40397advantech · wise-paas\/otaadvantech wise-paas\/otaA privilege escalation vulnerability exists in the installation of Advantech WISE-PaaS/OTA Server 3.0.9. A specially-crafted file can be replaced in the system to escalate privileges to NT SYSTEM authority. An attacker can provide a malicious file to trigger this vulnerability.EPSS0.87%8.8HighCVE-2021-40389advantech · deviceon\/iedgeadvantech deviceon\/iedgeA privilege escalation vulnerability exists in the installation of Advantech DeviceOn/iEdge Server 1.0.2. A specially-crafted file can be replaced in the system to escalate privileges to NT SYSTEM authority. An attacker can provide a malicious file to trigger this vulnerability.EPSS0.36%8.8HighCVE-2021-40388advantech · sq_manageradvantech sq_managerA privilege escalation vulnerability exists in Advantech SQ Manager Server 1.0.6. A specially-crafted file can be replaced in the system to escalate privileges to NT SYSTEM authority. An attacker can provide a malicious file to trigger this vulnerability.EPSS0.36%7.8HighCVE-2021-42706advantech · hmi designer +1 moreAzeoTech DAQFactoryThis vulnerability could allow an attacker to disclose information and execute arbitrary code on affected installations of WebAccess/MHI DesignerEPSS0.29%6.1MediumCVE-2021-42703advantech · hmi designer +1 moreAzeoTech DAQFactoryThis vulnerability could allow an attacker to send malicious Javascript code resulting in hijacking of the user’s cookie/session tokens, redirecting the user to a malicious webpage, and performing unintended browser action.EPSS0.64%9.1CriticalCVE-2021-27437advantech · wise-paas\/rmmadvantech wise-paas\/rmmThe affected product allows attackers to obtain sensitive information from the WISE-PaaS dashboard. The system contains a hard-coded administrator username and password that can be used to query Grafana APIs. Authentication is not required for exploitation on the WISE-PaaS/RMM (versions prior to 9.0.1).EPSS1.24%6.1MediumCVE-2021-27436advantech · webaccess\/scadaadvantech webaccess\/scadaWebAccess/SCADA Versions 9.0 and prior is vulnerable to cross-site scripting, which may allow an attacker to send malicious JavaScript code to an unsuspecting user, which could result in hijacking of the user’s cookie/session tokens, redirecting the user to a malicious webpage and performing unintended browser actions.EPSS0.71%4.3MediumCVE-2021-38431advantech · webaccess_scadaAdvantech WebAccess SCADAAn authenticated user using Advantech WebAccess SCADA in versions 9.0.3 and prior can use API functions to disclose project names and paths from other users.EPSS0.70%9.8CriticalCVE-2021-38408advantech · webaccessadvantech webaccessA stack-based buffer overflow vulnerability in Advantech WebAccess Versions 9.02 and prior caused by a lack of proper validation of the length of user-supplied data may allow remote code execution.EPSS11.57%9.8CriticalCVE-2021-38389advantech · webaccessAdvantech WebAccessAdvantech WebAccess versions 9.02 and prior are vulnerable to a stack-based buffer overflow, which may allow an attacker to remotely execute code.EPSS10.37%