Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

257 results · page 4 of 6

Aug 30, 2017An Improper Authentication issue was discovered in Advantech WebAccess versions prior to V8.2_20170817.CVE-2017-12698 · Other software · Advantech · reported by ics-cert@hq.dhs.govCritical 9.8
An Improper Authentication issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. Specially crafted requests allow a possible authentication bypass that could allow remote code execution.
Product
Webaccess
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com ics-cert.us-cert.gov
May 5, 2017An Absolute Path Traversal issue was discovered in Advantech WebAccess Version 8.1 and prior.CVE-2017-7929 · Other software · Advantech · reported by ics-cert@hq.dhs.govHigh 7.1
An Absolute Path Traversal issue was discovered in Advantech WebAccess Version 8.1 and prior. The absolute path traversal vulnerability has been identified, which may allow an attacker to traverse the file system to access restricted files or directories.
Product
Webaccess
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com ics-cert.us-cert.gov
May 2, 2017upAdminPg.asp in Advantech WebAccess before 8.1_20160519 allows remote authenticated administrators to obtain sensitive password information via unspecified vecCVE-2016-5810 · Other software · Advantech · reported by ics-cert@hq.dhs.govMedium 4.9
upAdminPg.asp in Advantech WebAccess before 8.1_20160519 allows remote authenticated administrators to obtain sensitive password information via unspecified vectors.
Product
Webaccess
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zerodayinitiative.com ics-cert.us-cert.gov
Feb 13, 2017An issue was discovered in Advantech WebAccess Version 8.1.CVE-2017-5154 · Other software · Advantech · reported by ics-cert@hq.dhs.govCritical 9.8
An issue was discovered in Advantech WebAccess Version 8.1. To be able to exploit the SQL injection vulnerability, an attacker must supply malformed input to the WebAccess software. Successful attack could result in administrative access to the application and its data files.
Product
Webaccess
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com ics-cert.us-cert.gov
Feb 13, 2017An issue was discovered in Advantech WebAccess Version 8.1.CVE-2017-5152 · Other software · Advantech · reported by ics-cert@hq.dhs.govCritical 9.1
An issue was discovered in Advantech WebAccess Version 8.1. By accessing a specific uniform resource locator (URL) on the web server, a malicious user is able to access pages unrestricted (AUTHENTICATION BYPASS).
Product
Webaccess
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com ics-cert.us-cert.gov
Aug 22, 2016SQL injection vulnerability in news pages in Cargotec Navis WebAccess before 2016-08-10 allows remote attackers to execute arbitrary SQL commands via unspecifieCVE-2016-5817 · Other software · Navis · reported by ics-cert@hq.dhs.govCritical 9.8
SQL injection vulnerability in news pages in Cargotec Navis WebAccess before 2016-08-10 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Product
Webaccess
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ics-cert.us-cert.gov ics-cert.us-cert.gov
Jun 24, 2016Buffer overflow in Advantech WebAccess before 8.1_20160519 allows local users to cause a denial of service via a crafted DLL file.CVE-2016-4528 · Other software · Advantech · reported by ics-cert@hq.dhs.govMedium 5
Buffer overflow in Advantech WebAccess before 8.1_20160519 allows local users to cause a denial of service via a crafted DLL file.
Product
Webaccess
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ics-cert.us-cert.gov ics-cert.us-cert.gov
Jun 24, 2016Unspecified ActiveX controls in Advantech WebAccess before 8.1_20160519 allow remote authenticated users to obtain sensitive information or modify data via unknCVE-2016-4525 · Other software · Advantech · reported by ics-cert@hq.dhs.govMedium 6.6
Unspecified ActiveX controls in Advantech WebAccess before 8.1_20160519 allow remote authenticated users to obtain sensitive information or modify data via unknown vectors, related to the INTERFACESAFE_FOR_UNTRUSTED_CALLER (aka safe for scripting) flag.
Product
Webaccess
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ics-cert.us-cert.gov ics-cert.us-cert.gov
Jan 14, 2016Buffer overflow in the BwpAlarm subsystem in Advantech WebAccess before 8.1 allows remote attackers to cause a denial of service via a crafted RPC request.CVE-2016-0860 · Other software · Advantech · reported by ics-cert@hq.dhs.govHigh 7.5
Buffer overflow in the BwpAlarm subsystem in Advantech WebAccess before 8.1 allows remote attackers to cause a denial of service via a crafted RPC request.
Product
Webaccess
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zerodayinitiative.com zerodayinitiative.com
Jan 14, 2016Integer overflow in the Kernel service in Advantech WebAccess before 8.1 allows remote attackers to execute arbitrary code or cause a denial of service (stack-bCVE-2016-0859 · Other software · Advantech · reported by ics-cert@hq.dhs.govCritical 9.8
Integer overflow in the Kernel service in Advantech WebAccess before 8.1 allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted RPC request.
Product
Webaccess
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zerodayinitiative.com ics-cert.us-cert.gov
Jan 14, 2016Race condition in Advantech WebAccess before 8.1 allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow) via a crafted CVE-2016-0858 · Other software · Advantech · reported by ics-cert@hq.dhs.govHigh 8.1
Race condition in Advantech WebAccess before 8.1 allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow) via a crafted request.
Product
Webaccess
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zerodayinitiative.com ics-cert.us-cert.gov
Jan 14, 2016Multiple heap-based buffer overflows in Advantech WebAccess before 8.1 allow remote attackers to execute arbitrary code via unspecified vectors.CVE-2016-0857 · Other software · Advantech · reported by ics-cert@hq.dhs.govCritical 9.8
Multiple heap-based buffer overflows in Advantech WebAccess before 8.1 allow remote attackers to execute arbitrary code via unspecified vectors.
Product
Webaccess
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zerodayinitiative.com zerodayinitiative.com
Jan 14, 2016Multiple stack-based buffer overflows in Advantech WebAccess before 8.1 allow remote attackers to execute arbitrary code via unspecified vectors.CVE-2016-0856 · Other software · Advantech · reported by ics-cert@hq.dhs.govCritical 9.8
Multiple stack-based buffer overflows in Advantech WebAccess before 8.1 allow remote attackers to execute arbitrary code via unspecified vectors.
Product
Webaccess
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zerodayinitiative.com zerodayinitiative.com
Jan 14, 2016Directory traversal vulnerability in Advantech WebAccess before 8.1 allows remote attackers to list arbitrary virtual-directory files via unspecified vectors.CVE-2016-0855 · Other software · Advantech · reported by ics-cert@hq.dhs.govHigh 7.5
Directory traversal vulnerability in Advantech WebAccess before 8.1 allows remote attackers to list arbitrary virtual-directory files via unspecified vectors.
Product
Webaccess
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zerodayinitiative.com zerodayinitiative.com
Jan 14, 2016Unrestricted file upload vulnerability in the uploadImageCommon function in the UploadAjaxAction script in the WebAccess Dashboard Viewer in Advantech WebAccessCVE-2016-0854 · Other software · Advantech · reported by ics-cert@hq.dhs.govCritical 9.8
Unrestricted file upload vulnerability in the uploadImageCommon function in the UploadAjaxAction script in the WebAccess Dashboard Viewer in Advantech WebAccess before 8.1 allows remote attackers to write to files of arbitrary types via unspecified vectors.
Product
Webaccess
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rapid7.com zerodayinitiative.com
Jan 14, 2016Advantech WebAccess before 8.1 allows remote attackers to obtain sensitive information via crafted input.CVE-2016-0853 · Other software · Advantech · reported by ics-cert@hq.dhs.govHigh 7.5
Advantech WebAccess before 8.1 allows remote attackers to obtain sensitive information via crafted input.
Product
Webaccess
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ics-cert.us-cert.gov ics-cert.us-cert.gov
Jan 14, 2016Advantech WebAccess before 8.1 allows remote attackers to bypass an intended administrative requirement and obtain file or folder access via unspecified vectorsCVE-2016-0852 · Other software · Advantech · reported by ics-cert@hq.dhs.govHigh 7.5
Advantech WebAccess before 8.1 allows remote attackers to bypass an intended administrative requirement and obtain file or folder access via unspecified vectors.
Product
Webaccess
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ics-cert.us-cert.gov ics-cert.us-cert.gov
Jan 14, 2016Advantech WebAccess before 8.1 allows remote attackers to cause a denial of service (out-of-bounds memory access) via unspecified vectors.CVE-2016-0851 · Other software · Advantech · reported by ics-cert@hq.dhs.govHigh 7.5
Advantech WebAccess before 8.1 allows remote attackers to cause a denial of service (out-of-bounds memory access) via unspecified vectors.
Product
Webaccess
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ics-cert.us-cert.gov ics-cert.us-cert.gov
Jan 14, 2016Advantech WebAccess before 8.1 allows remote attackers to execute arbitrary code via vectors involving a browser plugin.CVE-2015-6467 · Other software · Advantech · reported by ics-cert@hq.dhs.govHigh 8.1
Advantech WebAccess before 8.1 allows remote attackers to execute arbitrary code via vectors involving a browser plugin.
Product
Webaccess
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ics-cert.us-cert.gov ics-cert.us-cert.gov
Jan 14, 2016Cross-site scripting (XSS) vulnerability in Advantech WebAccess before 8.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecifCVE-2015-3948 · Other software · Advantech · reported by ics-cert@hq.dhs.govMedium 5.4
Cross-site scripting (XSS) vulnerability in Advantech WebAccess before 8.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Product
Webaccess
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ics-cert.us-cert.gov ics-cert.us-cert.gov
Jan 14, 2016SQL injection vulnerability in Advantech WebAccess before 8.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.CVE-2015-3947 · Other software · Advantech · reported by ics-cert@hq.dhs.govHigh 8.1
SQL injection vulnerability in Advantech WebAccess before 8.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Product
Webaccess
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ics-cert.us-cert.gov ics-cert.us-cert.gov
Jan 14, 2016Cross-site request forgery (CSRF) vulnerability in Advantech WebAccess before 8.1 allows remote attackers to hijack the authentication of unspecified victims viCVE-2015-3946 · Other software · Advantech · reported by ics-cert@hq.dhs.govHigh 8.8
Cross-site request forgery (CSRF) vulnerability in Advantech WebAccess before 8.1 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Product
Webaccess
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ics-cert.us-cert.gov ics-cert.us-cert.gov
Jan 14, 2016Advantech WebAccess before 8.1 allows remote attackers to read sensitive cleartext information about e-mail project accounts via unspecified vectors.CVE-2015-3943 · Other software · Advantech · reported by ics-cert@hq.dhs.govMedium 5.3
Advantech WebAccess before 8.1 allows remote attackers to read sensitive cleartext information about e-mail project accounts via unspecified vectors.
Product
Webaccess
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ics-cert.us-cert.gov ics-cert.us-cert.gov
Sep 27, 2015Multiple stack-based buffer overflows in an unspecified DLL file in Advantech WebAccess before 8.0_20150816 allow remote attackers to execute arbitrary code viaCVE-2014-9202 · Other software · Advantech · reported by ics-cert@hq.dhs.govMedium 6.9
Multiple stack-based buffer overflows in an unspecified DLL file in Advantech WebAccess before 8.0_20150816 allow remote attackers to execute arbitrary code via a crafted file that triggers long string arguments to functions.
Product
Webaccess
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ics-cert.us-cert.gov ics-cert.us-cert.gov
Sep 11, 2015Multiple stack-based buffer overflows in unspecified DLL files in Advantech WebAccess before 8.0.1 allow remote attackers to execute arbitrary code via unknown CVE-2014-9208 · Other software · Advantech · reported by ics-cert@hq.dhs.govHigh 10
Multiple stack-based buffer overflows in unspecified DLL files in Advantech WebAccess before 8.0.1 allow remote attackers to execute arbitrary code via unknown vectors.
Product
Webaccess
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ics-cert.us-cert.gov exploit-db.com
Jul 22, 2015Multiple cross-site scripting (XSS) vulnerabilities in WebAccess in Novell GroupWise 2012 before Support Pack 4 and 2014 before Support Pack 2 allow remote attaCVE-2014-0611 · Other software · Novell · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in WebAccess in Novell GroupWise 2012 before Support Pack 4 and 2014 before Support Pack 2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Groupwise
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record novell.com securitytracker.com
Feb 19, 2015senddocument.php in Zarafa WebApp before 2.0 beta 3 and WebAccess in Zarafa Collaboration Platform (ZCP) 7.x before 7.1.12 beta 1 and 7.2.x before 7.2.0 beta 1 CVE-2014-9465 · Other software · Fedoraproject · reported by MITREMedium 5
senddocument.php in Zarafa WebApp before 2.0 beta 3 and WebAccess in Zarafa Collaboration Platform (ZCP) 7.x before 7.1.12 beta 1 and 7.2.x before 7.2.0 beta 1 allows remote attackers to cause a denial of service (/tmp disk consumption) by uploading a large number of files.
Product
Fedora
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisories.mageia.org download.zarafa.com
Nov 20, 2014Stack-based buffer overflow in Advantech WebAccess, formerly BroadWin WebAccess, before 8.0 allows remote attackers to execute arbitrary code via a crafted ip_aCVE-2014-8388 · Other software · Advantech · reported by MITREHigh 7.2
Stack-based buffer overflow in Advantech WebAccess, formerly BroadWin WebAccess, before 8.0 allows remote attackers to execute arbitrary code via a crafted ip_address parameter in an HTML document.
Product
Webaccess
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ics-cert.us-cert.gov ics-cert.us-cert.gov
Oct 20, 2014Zarafa WebAccess 4.1 and WebApp uses world-readable permissions for the files in their tmp directory, which allows local users to obtain sensitive information bCVE-2014-5449 · Other software · Zarafa · reported by MITRELow 2.1
Zarafa WebAccess 4.1 and WebApp uses world-readable permissions for the files in their tmp directory, which allows local users to obtain sensitive information by reading temporary session data.
Product
Webaccess
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisories.mageia.org seclists.org
Oct 20, 2014Zarafa WebAccess 7.1.10 and WebApp 1.6 beta uses weak permissions (644) for config.php, which allows local users to obtain sensitive information by reading the CVE-2014-5447 · Other software · Zarafa · reported by MITRELow 2.1
Zarafa WebAccess 7.1.10 and WebApp 1.6 beta uses weak permissions (644) for config.php, which allows local users to obtain sensitive information by reading the PHP session files. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0103.
Product
Webapp
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisories.mageia.org seclists.org
Sep 20, 2014Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the password parameteCVE-2014-0992 · Other software · Advantech · reported by MITREMedium 6.8
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the password parameter.
Product
Advantech Webaccess
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com ics-cert.us-cert.gov
Sep 20, 2014Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the projectname paramCVE-2014-0991 · Other software · Advantech · reported by MITREMedium 6.8
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the projectname parameter.
Product
Advantech Webaccess
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com ics-cert.us-cert.gov
Sep 20, 2014Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the UserName parameteCVE-2014-0990 · Other software · Advantech · reported by MITREMedium 6.8
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the UserName parameter.
Product
Advantech Webaccess
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com ics-cert.us-cert.gov
Sep 20, 2014Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the AccessCode2 paramCVE-2014-0989 · Other software · Advantech · reported by MITREMedium 6.8
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the AccessCode2 parameter.
Product
Advantech Webaccess
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com ics-cert.us-cert.gov
Sep 20, 2014Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the AccessCode parameCVE-2014-0988 · Other software · Advantech · reported by MITREMedium 6.8
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the AccessCode parameter.
Product
Advantech Webaccess
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com ics-cert.us-cert.gov
Sep 20, 2014Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the NodeName2 parametCVE-2014-0987 · Other software · Advantech · reported by MITREMedium 6.8
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the NodeName2 parameter.
Product
Advantech Webaccess
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com ics-cert.us-cert.gov
Sep 20, 2014Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the GotoCmd parameterCVE-2014-0986 · Other software · Advantech · reported by MITREMedium 6.8
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the GotoCmd parameter.
Product
Advantech Webaccess
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com ics-cert.us-cert.gov
Sep 20, 2014Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the NodeName parameteCVE-2014-0985 · Other software · Advantech · reported by MITREMedium 6.8
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the NodeName parameter.
Product
Advantech Webaccess
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com ics-cert.us-cert.gov
Jul 29, 2014WebAccess in Zarafa before 7.1.10 and WebApp before 1.6 stores credentials in cleartext, which allows local Apache users to obtain sensitive information by readCVE-2014-0103 · Other software · Zarafa · reported by Red HatLow 2.1
WebAccess in Zarafa before 7.1.10 and WebApp before 1.6 stores credentials in cleartext, which allows local Apache users to obtain sensitive information by reading the PHP session files.
Product
Webapp
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisories.mageia.org lists.fedoraproject.org
Jul 19, 2014The BrowseFolder method in the bwocxrun ActiveX control in Advantech WebAccess before 7.2 allows remote attackers to read arbitrary files via a crafted call.CVE-2014-2368 · Other software · Advantech · reported by ics-cert@hq.dhs.govHigh 7.5
The BrowseFolder method in the bwocxrun ActiveX control in Advantech WebAccess before 7.2 allows remote attackers to read arbitrary files via a crafted call.
Product
WebAccess
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record webaccess.advantech.com cisa.gov
Jul 19, 2014The ChkCookie subroutine in an ActiveX control in broadweb/include/gChkCook.asp in Advantech WebAccess before 7.2 allows remote attackers to read arbitrary fileCVE-2014-2367 · Other software · Advantech · reported by ics-cert@hq.dhs.govHigh 7.5
The ChkCookie subroutine in an ActiveX control in broadweb/include/gChkCook.asp in Advantech WebAccess before 7.2 allows remote attackers to read arbitrary files via a crafted call.
Product
WebAccess
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record webaccess.advantech.com cisa.gov
Jul 19, 2014upAdminPg.asp in Advantech WebAccess before 7.2 allows remote authenticated users to discover credentials by reading HTML source code.CVE-2014-2366 · Other software · Advantech · reported by ics-cert@hq.dhs.govHigh 9
upAdminPg.asp in Advantech WebAccess before 7.2 allows remote authenticated users to discover credentials by reading HTML source code.
Product
WebAccess
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record webaccess.advantech.com cisa.gov
Jul 19, 2014Unspecified vulnerability in Advantech WebAccess before 7.2 allows remote authenticated users to create or delete arbitrary files via unknown vectors.CVE-2014-2365 · Other software · Advantech · reported by ics-cert@hq.dhs.govMedium 6.5
Unspecified vulnerability in Advantech WebAccess before 7.2 allows remote authenticated users to create or delete arbitrary files via unknown vectors.
Product
WebAccess
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record webaccess.advantech.com cisa.gov
Jul 19, 2014Multiple stack-based buffer overflows in Advantech WebAccess before 7.2 allow remote attackers to execute arbitrary code via a long string in the (1) ProjectNamCVE-2014-2364 · Other software · Advantech · reported by ics-cert@hq.dhs.govHigh 7.5
Multiple stack-based buffer overflows in Advantech WebAccess before 7.2 allow remote attackers to execute arbitrary code via a long string in the (1) ProjectName, (2) SetParameter, (3) NodeName, (4) CCDParameter, (5) SetColor, (6) AlarmImage, (7) GetParameter, (8) GetColor, (9) ServerResponse, (10) SetBaud, or (11) IPAddress parameter to an ActiveX control in (a) webvact.ocx, (b) dvs.ocx, or (c) webdact.ocx.
Product
WebAccess
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com webaccess.advantech.com
Apr 12, 2014The BWOCXRUN.BwocxrunCtrl.1 control contains a method named “CreateProcess.” This method contains validation to ensure an attacker cannot run arbitrary commanCVE-2014-0773 · Other software · Advantech · reported by ics-cert@hq.dhs.govHigh 7.5
The BWOCXRUN.BwocxrunCtrl.1 control contains a method named “CreateProcess.” This method contains validation to ensure an attacker cannot run arbitrary command lines. After validation, the values supplied in the HTML are passed to the Windows CreateProcessA API. The validation can be bypassed allowing for running arbitrary command lines. The command line can specify running remote files (example: UNC command line). A function exists at offset 100019B0 of bwocxrun.ocx. Inside this function, there are 3 calls to strstr to check the contents of the user specified command line. If “\setup.exe,” “\bwvbprt.exe,” or “\bwvbprtl.exe” are contained in the command line (strstr returns nonzero value), the command line passes validation and is then passed to CreateProcessA.
Product
WebAccess
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record webaccess.advantech.com securityfocus.com
Apr 12, 2014The BWOCXRUN.BwocxrunCtrl.1 control contains a method named OpenUrlToBufferTimeout.CVE-2014-0772 · Other software · Advantech · reported by ics-cert@hq.dhs.govMedium 5
The BWOCXRUN.BwocxrunCtrl.1 control contains a method named OpenUrlToBufferTimeout. This method takes a URL as a parameter and returns its contents to the caller in JavaScript. The URLs are accessed in the security context of the current browser session. The control does not perform any URL validation and allows file:// URLs that access the local disk. The method can be used to open a URL (including file URLs) and read the URLs through JavaScript. This method could also be used to reach any arbitrary URL to which the browser has access.
Product
WebAccess
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record webaccess.advantech.com securityfocus.com
Apr 12, 2014The BWOCXRUN.BwocxrunCtrl.1 control contains a method named “OpenUrlToBuffer.” This method takes a URL as a parameter and returns its contents to the caller iCVE-2014-0771 · Other software · Advantech · reported by ics-cert@hq.dhs.govHigh 7.5
The BWOCXRUN.BwocxrunCtrl.1 control contains a method named “OpenUrlToBuffer.” This method takes a URL as a parameter and returns its contents to the caller in JavaScript. The URLs are accessed in the security context of the current browser session. The control does not perform any URL validation and allows “file://” URLs that access the local disk. The method can be used to open a URL (including file URLs) and read file URLs through JavaScript. This method could also be used to reach any arbitrary URL to which the browser has access.
Product
WebAccess
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record webaccess.advantech.com securityfocus.com
Apr 12, 2014By providing an overly long string to the UserName parameter, an attacker may be able to overflow the static stack buffer.CVE-2014-0770 · Other software · Advantech · reported by ics-cert@hq.dhs.govHigh 7.5
By providing an overly long string to the UserName parameter, an attacker may be able to overflow the static stack buffer. The attacker may then execute code on the target device remotely.
Product
WebAccess
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record webaccess.advantech.com securityfocus.com
Apr 12, 2014An attacker may pass an overly long value from the AccessCode2 argument to the control to overflow the static stack buffer.CVE-2014-0768 · Other software · Advantech · reported by ics-cert@hq.dhs.govHigh 7.5
An attacker may pass an overly long value from the AccessCode2 argument to the control to overflow the static stack buffer. The attacker may then remotely execute arbitrary code.
Product
WebAccess
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record webaccess.advantech.com securityfocus.com
Apr 12, 2014An attacker may exploit this vulnerability by passing an overly long value from the AccessCode argument to the control.CVE-2014-0767 · Other software · Advantech · reported by ics-cert@hq.dhs.govHigh 7.5
An attacker may exploit this vulnerability by passing an overly long value from the AccessCode argument to the control. This will overflow the static stack buffer. The attacker may then execute code on the target device remotely.
Product
WebAccess
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record webaccess.advantech.com securityfocus.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.