Page 11 of 100 results (0.003 seconds)

CVSS: 9.8EPSS: 9%CPEs: 5EXPL: 0

In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada Node versions prior to 8.3.1, and WebAccess/NMS 2.0.3 and prior, several stack-based buffer overflow vulnerabilities have been identified, which may allow an attacker to execute arbitrary code. En Advantech WebAccess en versiones V8.2_20170817 y anteriores, WebAccess en versiones V8.3.0 y anteriores, WebAccess Dashboard en versiones V.2.0.15 y anteriores, WebAccess Scada Node en versiones anteriores a la 8.3.1 y WebAccess/NMS 2.0.3 y anteriores, se han identificado varias vulnerabilidades de desbordamiento de búfer que podrían permitir que un atacante ejecute código arbitrario. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Advantech WebAccess Node. Authentication is not required to exploit this vulnerability. The specific flaw exists within BwPSLinkZip.exe, which is accessed through the 0x2711 IOCTL in the webvrpcs process. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. • http://www.securityfocus.com/bid/104190 https://ics-cert.us-cert.gov/advisories/ICSA-18-135-01 • CWE-121: Stack-based Buffer Overflow CWE-787: Out-of-bounds Write •

CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0

In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada Node versions prior to 8.3.1, and WebAccess/NMS 2.0.3 and prior, an information exposure vulnerability through directory listing has been identified, which may allow an attacker to find important files that are not normally visible. En Advantech WebAccess en versiones V8.2_20170817 y anteriores, WebAccess en versiones V8.3.0 y anteriores, WebAccess Dashboard en versiones V.2.0.15 y anteriores, WebAccess Scada Node en versiones anteriores a la 8.3.1 y WebAccess/NMS 2.0.3 y anteriores, se ha identificado una vulnerabilidad de exposición de información mediante el listado de directorios que podría permitir que un atacante encuentre archivos importantes que normalmente no suelen estar visibles. • http://www.securityfocus.com/bid/104190 https://ics-cert.us-cert.gov/advisories/ICSA-18-135-01 • CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory CWE-548: Exposure of Information Through Directory Listing •

CVSS: 9.8EPSS: 0%CPEs: 5EXPL: 0

In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada Node versions prior to 8.3.1, and WebAccess/NMS 2.0.3 and prior, several untrusted pointer dereference vulnerabilities have been identified, which may allow an attacker to execute arbitrary code. En Advantech WebAccess en versiones V8.2_20170817 y anteriores, WebAccess en versiones V8.3.0 y anteriores, WebAccess Dashboard en versiones V.2.0.15 y anteriores, WebAccess Scada Node en versiones anteriores a la 8.3.1 y WebAccess/NMS 2.0.3 y anteriores, se han identificado varias vulnerabilidades de desreferencia de puntero no fiable que podrían permitir que un atacante ejecute código arbitrario. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Advantech WebAccess Node. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the 0x2776 IOCTL in the webvrpcs process. The issue results from the lack of proper validation of a user-supplied value prior to dereferencing it as a pointer. • http://www.securityfocus.com/bid/104190 https://ics-cert.us-cert.gov/advisories/ICSA-18-135-01 • CWE-476: NULL Pointer Dereference CWE-822: Untrusted Pointer Dereference •

CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0

In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada Node versions prior to 8.3.1, and WebAccess/NMS 2.0.3 and prior, an external control of file name or path vulnerability has been identified, which may allow an attacker to delete files. En Advantech WebAccess en versiones V8.2_20170817 y anteriores, WebAccess en versiones V8.3.0 y anteriores, WebAccess Dashboard en versiones V.2.0.15 y anteriores, WebAccess Scada Node en versiones anteriores a la 8.3.1 y WebAccess/NMS 2.0.3 y anteriores, se ha identificado una vulnerabilidad de control externo del nombre de archivo o ruta que podría permitir que un atacante elimine archivos. This vulnerability allows remote attackers to delete arbitrary files on vulnerable installations of Advantech WebAccess Node. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the 0x2715 IOCTL in the webvrpcs process. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. • http://www.securityfocus.com/bid/104190 https://ics-cert.us-cert.gov/advisories/ICSA-18-135-01 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-73: External Control of File Name or Path •

CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0

Advantech WebAccess 8.1 and earlier contains a DLL hijacking vulnerability which may allow an attacker to run a malicious DLL file within the search path resulting in execution of arbitrary code. Advantech WebAccess en versiones 8.1 y anteriores contiene una vulnerabilidad de secuestro de DLL, lo que podría permitir que un atacante ejecute un archivo DLL malicioso en la ruta de búsqueda, desembocando en la ejecución de código arbitrario. • http://www.securityfocus.com/bid/96210 https://ics-cert.us-cert.gov/advisories/ICSA-17-045-01 • CWE-427: Uncontrolled Search Path Element •