WE
Product
Webaccess
103
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 41High 46Medium 13Low 0
Watch
Add Webaccess to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2016-0858 | 8.1 | Jan 15 | Race condition in Advantech WebAccess before 8.1 allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow) via a crafted request Affected: through 8.0 |
| CVE-2015-6467 | 8.1 | Jan 15 | Advantech WebAccess before 8.1 allows remote attackers to execute arbitrary code via vectors involving a browser plugin Affected: through 8.0 |
| CVE-2015-3947 | 8.1 | Jan 15 | SQL injection vulnerability in Advantech WebAccess before 8.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors Affected: through 8.0 |
| CVE-2023-2866 | 7.8 | Jun 7 | If an attacker can trick an authenticated user into loading a maliciously crafted .zip file onto Advantech WebAccess version 8.4.5, a web shell could be used to give the attacker… Affected: 8.4.5 |
| CVE-2020-16202 | 7.8 | Sep 22 | WebAccess Node (All versions prior to 9.0.1) has incorrect permissions set for resources used by specific services, which may allow code execution with system privileges Affected: before 9.0.1 |
| CVE-2018-17910 | 7.8 | Oct 29 | WebAccess Versions 8.3.2 and prior Affected: through 8.3.2 |
| CVE-2018-17908 | 7.8 | Oct 29 | WebAccess Versions 8.3.2 and prior Affected: through 8.3.2 |
| CVE-2018-14828 | 7.8 | Oct 23 | Advantech WebAccess 8.3.1 and earlier has an improper privilege management vulnerability, which may allow an attacker to access those files and perform actions at a system… Affected: through 8.3.1 |
| CVE-2018-8841 | 7.8 | May 15 | In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada Node versions prior… Affected: through 8.2_20170817; through 8.3.0 |
| CVE-2017-5175 | 7.8 | May 9 | Advantech WebAccess 8.1 and earlier contains a DLL hijacking vulnerability which may allow an attacker to run a malicious DLL file within the search path resulting in execution of… Affected: through 8.1 |
| CVE-2017-12717 | 7.8 | Aug 30 | An Uncontrolled Search Path Element issue was discovered in Advantech WebAccess versions prior to V8.2_20170817 Affected: through 8.2 |
| CVE-2017-12713 | 7.8 | Aug 30 | An Incorrect Permission Assignment for Critical Resource issue was discovered in Advantech WebAccess versions prior to V8.2_20170817 Affected: through 8.2 |
| CVE-2017-12711 | 7.8 | Aug 30 | An Incorrect Privilege Assignment issue was discovered in Advantech WebAccess versions prior to V8.2_20170817 Affected: through 8.2 |
| CVE-2023-4215 | 7.5 | Oct 17 | Advantech WebAccess version 9.1.3 contains an exposure of sensitive information to an unauthorized actor vulnerability that could leak user credentials Affected: 9.1.3 |
| CVE-2020-12018 | 7.5 | May 8 | Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0 Affected: through 8.4.4; 9.0.0 |
| CVE-2020-12014 | 7.5 | May 8 | Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0 Affected: through 8.4.4; 9.0.0 |
| CVE-2019-3942 | 7.5 | Apr 1 | Advantech WebAccess 8.3.4 does not properly restrict an RPC call that allows unauthenticated, remote users to read files Affected: 8.3.4 |
| CVE-2019-10983 | 7.5 | Jun 28 | In WebAccess/SCADA Versions 8.3.5 and prior, an out-of-bounds read vulnerability is caused by a lack of proper validation of user-supplied data Affected: through 8.3.5 |
| CVE-2019-3941 | 7.5 | Apr 9 | Advantech WebAccess 8.3.4 allows unauthenticated, remote attackers to delete arbitrary files via IOCTL 10005 RPC Affected: 8.3.4 |
| CVE-2019-6554 | 7.5 | Apr 5 | Advantech WebAccess/SCADA, Versions 8.3.5 and prior Affected: through 8.3.5 |
| CVE-2018-14820 | 7.5 | Oct 23 | Advantech WebAccess 8.3.1 and earlier has a .dll component that is susceptible to external control of file name or path vulnerability, which may allow an arbitrary file deletion… Affected: through 8.3.1 |
| CVE-2018-7503 | 7.5 | May 15 | In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada Node versions prior… Affected: through 8.2_20170817; through 8.3.0 |
| CVE-2018-7501 | 7.5 | May 15 | In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada Node versions prior… Affected: through 8.2_20170817; through 8.3.0 |
| CVE-2018-7495 | 7.5 | May 15 | In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada Node versions prior… Affected: through 8.2_20170817; through 8.3.0 |
| CVE-2018-10590 | 7.5 | May 15 | In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada Node versions prior… Affected: through 8.2_20170817; through 8.3.0 |
| CVE-2017-16736 | 7.5 | Jan 12 | An Unrestricted Upload Of File With Dangerous Type issue was discovered in Advantech WebAccess versions prior to 8.3 Affected: before 8.3 |
| CVE-2017-16753 | 7.5 | Jan 5 | An Improper Input Validation issue was discovered in Advantech WebAccess versions prior to 8.3 Affected: before 8.3 |
| CVE-2017-16728 | 7.5 | Jan 5 | An Untrusted Pointer Dereference issue was discovered in Advantech WebAccess versions prior to 8.3 Affected: before 8.3 |
| CVE-2017-12719 | 7.5 | Nov 6 | An Untrusted Pointer Dereference issue was discovered in Advantech WebAccess versions prior to V8.2_20170817 Affected: before 8.2_20170817 |
| CVE-2017-12710 | 7.5 | Aug 30 | A SQL Injection issue was discovered in Advantech WebAccess versions prior to V8.2_20170817 Affected: through 8.2 |
| CVE-2016-0860 | 7.5 | Jan 15 | Buffer overflow in the BwpAlarm subsystem in Advantech WebAccess before 8.1 allows remote attackers to cause a denial of service via a crafted RPC request Affected: through 8.0 |
| CVE-2016-0855 | 7.5 | Jan 15 | Directory traversal vulnerability in Advantech WebAccess before 8.1 allows remote attackers to list arbitrary virtual-directory files via unspecified vectors Affected: through 8.0 |
| CVE-2016-0853 | 7.5 | Jan 15 | Advantech WebAccess before 8.1 allows remote attackers to obtain sensitive information via crafted input Affected: through 8.0 |
| CVE-2016-0852 | 7.5 | Jan 15 | Advantech WebAccess before 8.1 allows remote attackers to bypass an intended administrative requirement and obtain file or folder access via unspecified vectors Affected: through 8.0 |
| CVE-2016-0851 | 7.5 | Jan 15 | Advantech WebAccess before 8.1 allows remote attackers to cause a denial of service (out-of-bounds memory access) via unspecified vectors Affected: through 8.0 |
| CVE-2020-12010 | 7.1 | May 8 | Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0 Affected: through 8.4.4; 9.0.0 |
| CVE-2017-7929 | 7.1 | May 6 | An Absolute Path Traversal issue was discovered in Advantech WebAccess Version 8.1 and prior Affected: through 8.1 |
| CVE-2016-4525 | 6.6 | Jun 25 | Unspecified ActiveX controls in Advantech WebAccess before 8.1_20160519 allow remote authenticated users to obtain sensitive information or modify data via unknown vectors,… Affected: through 8.1 |
| CVE-2018-15706 | 6.5 | Oct 31 | WADashboard API in Advantech WebAccess 8.3.1 and 8.3.2 allows remote authenticated attackers to read any file on the filesystem due to a directory traversal vulnerability in the… Affected: 8.3.1; 8.3.2 |
| CVE-2018-15705 | 6.5 | Oct 31 | WADashboard API in Advantech WebAccess 8.3.1 and 8.3.2 allows remote authenticated attackers to write or overwrite any file on the filesystem due to a directory traversal… Affected: 8.3.1; 8.3.2 |
| CVE-2017-16732 | 6.5 | Jan 12 | A use-after-free issue was discovered in Advantech WebAccess versions prior to 8.3 Affected: before 8.3 |
| CVE-2017-14016 | 6.3 | Nov 6 | A Stack-based Buffer Overflow issue was discovered in Advantech WebAccess versions prior to V8.2_20170817 Affected: before 8.2_20170817 |
| CVE-2021-34540 | 6.1 | Jun 11 | Advantech WebAccess 8.4.2 and 8.4.4 allows XSS via the username column of the bwRoot.asp page of WADashboard Affected: 8.4.2; 8.4.4 |
| CVE-2018-15703 | 6.1 | Oct 22 | Advantech WebAccess 8.3.2 and below is vulnerable to multiple reflected cross site scripting vulnerabilities Affected: through 8.3.2 |
| CVE-2018-10591 | 6.1 | May 15 | In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada Node versions prior… Affected: through 8.2_20170817; through 8.3.0 |
| CVE-2018-15707 | 5.4 | Oct 31 | Advantech WebAccess 8.3.1 and 8.3.2 are vulnerable to cross-site scripting in the Bwmainleft.asp page Affected: 8.3.1; 8.3.2 |
| CVE-2015-3948 | 5.4 | Jan 15 | Cross-site scripting (XSS) vulnerability in Advantech WebAccess before 8.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors Affected: through 8.0 |
| CVE-2015-3943 | 5.3 | Jan 15 | Advantech WebAccess before 8.1 allows remote attackers to read sensitive cleartext information about e-mail project accounts via unspecified vectors Affected: through 8.0 |
| CVE-2016-4528 | 5.0 | Jun 25 | Buffer overflow in Advantech WebAccess before 8.1_20160519 allows local users to cause a denial of service via a crafted DLL file Affected: through 8.1 |
| CVE-2016-5810 | 4.9 | May 2 | upAdminPg.asp in Advantech WebAccess before 8.1_20160519 allows remote authenticated administrators to obtain sensitive password information via unspecified vectors Affected: through 8.1 |