AW
Product
Advantech Webaccess
44
CVEs
0
On KEV
–
Max CVSS
0
New 30D
Severity mix
Critical 0High 0Medium 0Low 0
Watch
Add Advantech Webaccess to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2014-0992 | – | Sep 20 | Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the password parameter Affected: 7.2 |
| CVE-2014-0991 | – | Sep 20 | Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the projectname parameter Affected: 7.2 |
| CVE-2014-0990 | – | Sep 20 | Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the UserName parameter Affected: 7.2 |
| CVE-2014-0989 | – | Sep 20 | Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the AccessCode2 parameter Affected: 7.2 |
| CVE-2014-0988 | – | Sep 20 | Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the AccessCode parameter Affected: 7.2 |
| CVE-2014-0987 | – | Sep 20 | Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the NodeName2 parameter Affected: 7.2 |
| CVE-2014-0986 | – | Sep 20 | Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the GotoCmd parameter Affected: 7.2 |
| CVE-2014-0985 | – | Sep 20 | Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the NodeName parameter Affected: 7.2 |
| CVE-2014-2368 | – | Jul 19 | The BrowseFolder method in the bwocxrun ActiveX control in Advantech WebAccess before 7.2 allows remote attackers to read arbitrary files via a crafted call Affected: through 7.1; 5.0; 6.0; 7.0 |
| CVE-2014-2367 | – | Jul 19 | The ChkCookie subroutine in an ActiveX control in broadweb/include/gChkCook.asp in Advantech WebAccess before 7.2 allows remote attackers to read arbitrary files via a crafted… Affected: through 7.1; 5.0; 6.0; 7.0 |
| CVE-2014-2366 | – | Jul 19 | upAdminPg.asp in Advantech WebAccess before 7.2 allows remote authenticated users to discover credentials by reading HTML source code Affected: through 7.1; 5.0; 6.0; 7.0 |
| CVE-2014-2365 | – | Jul 19 | Unspecified vulnerability in Advantech WebAccess before 7.2 allows remote authenticated users to create or delete arbitrary files via unknown vectors Affected: through 7.1; 5.0; 6.0; 7.0 |
| CVE-2014-2364 | – | Jul 19 | Multiple stack-based buffer overflows in Advantech WebAccess before 7.2 allow remote attackers to execute arbitrary code via a long string in the (1) ProjectName, (2)… Affected: through 7.1; 5.0; 6.0; 7.0 |
| CVE-2014-0773 | – | Apr 12 | The BWOCXRUN.BwocxrunCtrl.1 control contains a method named “CreateProcess.” This method contains validation to ensure an attacker cannot run arbitrary command lines Affected: through 7.1; 5.0; 6.0; 7.0 |
| CVE-2014-0772 | – | Apr 12 | The BWOCXRUN.BwocxrunCtrl.1 control contains a method named OpenUrlToBufferTimeout Affected: through 7.1; 5.0; 6.0; 7.0 |
| CVE-2014-0771 | – | Apr 12 | The BWOCXRUN.BwocxrunCtrl.1 control contains a method named “OpenUrlToBuffer.” This method takes a URL as a parameter and returns its contents to the caller in JavaScript Affected: through 7.1; 5.0; 6.0; 7.0 |
| CVE-2014-0770 | – | Apr 12 | By providing an overly long string to the UserName parameter, an attacker may be able to overflow the static stack buffer Affected: through 7.1; 5.0; 6.0; 7.0 |
| CVE-2014-0768 | – | Apr 12 | An attacker may pass an overly long value from the AccessCode2 argument to the control to overflow the static stack buffer Affected: through 7.1; 5.0; 6.0; 7.0 |
| CVE-2014-0767 | – | Apr 12 | An attacker may exploit this vulnerability by passing an overly long value from the AccessCode argument to the control Affected: through 7.1; 5.0; 6.0; 7.0 |
| CVE-2014-0766 | – | Apr 12 | An attacker can exploit this vulnerability by copying an overly long NodeName2 argument into a statically sized buffer on the stack to overflow the static stack buffer Affected: through 7.1; 5.0; 6.0; 7.0 |
| CVE-2014-0765 | – | Apr 12 | To exploit this vulnerability, the attacker sends data from the GotoCmd argument to control Affected: through 7.1; 5.0; 6.0; 7.0 |
| CVE-2014-0764 | – | Apr 12 | By providing an overly long string to the NodeName parameter, an attacker may be able to overflow the static stack buffer Affected: through 7.1; 5.0; 6.0; 7.0 |
| CVE-2014-0763 | – | Apr 12 | An attacker using SQL injection may use arguments to construct queries without proper sanitization Affected: through 7.1; 5.0; 6.0; 7.0 |
| CVE-2013-2299 | – | Aug 22 | Cross-site scripting (XSS) vulnerability in Advantech WebAccess (formerly BroadWin WebAccess) before 7.1 2013.05.30 allows remote authenticated users to inject arbitrary web… Affected: through 7.0; 5.0; 6.0 |
| CVE-2012-1235 | – | Feb 21 | Cross-site request forgery (CSRF) vulnerability in Advantech/BroadWin WebAccess 7.0 allows remote authenticated users to hijack the authentication of unspecified victims via… Affected: through 6.0; 5.0 |
| CVE-2012-1234 | – | Feb 21 | SQL injection vulnerability in Advantech/BroadWin WebAccess 7.0 allows remote authenticated users to execute arbitrary SQL commands via a malformed URL Affected: through 6.0; 5.0 |
| CVE-2012-0244 | – | Feb 21 | Multiple SQL injection vulnerabilities in Advantech/BroadWin WebAccess before 7.0 allow remote attackers to execute arbitrary SQL commands via crafted string input Affected: through 6.0; 5.0 |
| CVE-2012-0243 | – | Feb 21 | Buffer overflow in an ActiveX control in bwocxrun.ocx in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary code by leveraging the ability to… Affected: through 6.0; 5.0 |
| CVE-2012-0242 | – | Feb 21 | Format string vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary code via format string specifiers in a message string Affected: through 6.0; 5.0 |
| CVE-2012-0241 | – | Feb 21 | Advantech/BroadWin WebAccess before 7.0 allows remote attackers to cause a denial of service (memory corruption) via a modified stream identifier to a function Affected: through 6.0; 5.0 |
| CVE-2012-0240 | – | Feb 21 | GbScriptAddUp.asp in Advantech/BroadWin WebAccess before 7.0 does not properly perform authentication, which allows remote attackers to execute arbitrary code via unspecified… Affected: through 6.0; 5.0 |
| CVE-2012-0239 | – | Feb 21 | uaddUpAdmin.asp in Advantech/BroadWin WebAccess before 7.0 does not properly perform authentication, which allows remote attackers to modify an administrative password via a… Affected: through 6.0; 5.0 |
| CVE-2012-0238 | – | Feb 21 | Stack-based buffer overflow in opcImg.asp in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary code via unspecified vectors Affected: through 6.0; 5.0 |
| CVE-2012-0237 | – | Feb 21 | Advantech/BroadWin WebAccess before 7.0 allows remote attackers to (1) enable date and time syncing or (2) disable date and time syncing via a crafted URL Affected: through 6.0; 5.0 |
| CVE-2012-0236 | – | Feb 21 | Advantech/BroadWin WebAccess 7.0 and earlier allows remote attackers to obtain sensitive information via a direct request to a URL Affected: through 6.0; 5.0 |
| CVE-2012-0235 | – | Feb 21 | Cross-site request forgery (CSRF) vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to hijack the authentication of unspecified victims via unknown… Affected: through 6.0; 5.0 |
| CVE-2012-0234 | – | Feb 21 | SQL injection vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary SQL commands via a malformed URL Affected: through 6.0; 5.0 |
| CVE-2012-0233 | – | Feb 21 | Cross-site scripting (XSS) vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to inject arbitrary web script or HTML via a malformed URL Affected: through 6.0; 5.0 |
| CVE-2011-4526 | – | Feb 21 | Buffer overflow in an ActiveX control in Advantech/BroadWin WebAccess before 7.0 might allow remote attackers to execute arbitrary code via a long string value in unspecified… Affected: through 6.0; 5.0 |
| CVE-2011-4525 | – | Feb 21 | Advantech/BroadWin WebAccess before 7.0 allows remote attackers to trigger the extraction of arbitrary web content into a batch file on a client system, and execute this batch… Affected: through 6.0; 5.0 |
| CVE-2011-4524 | – | Feb 21 | Buffer overflow in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary code via a long string value in unspecified parameters Affected: through 6.0; 5.0 |
| CVE-2011-4523 | – | Feb 21 | Cross-site scripting (XSS) vulnerability in bwview.asp in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified… Affected: through 6.0; 5.0 |
| CVE-2011-4522 | – | Feb 21 | Cross-site scripting (XSS) vulnerability in bwerrdn.asp in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified… Affected: through 6.0; 5.0 |
| CVE-2011-4521 | – | Feb 21 | SQL injection vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary SQL commands via crafted string input Affected: through 6.0; 5.0 |
Showing 44