CVSS: 10.0EPSS: 4%CPEs: 1EXPL: 1CVE-2018-6911 – Advantech WebAccess 8.3.0 - Remote Code Execution
https://notcve.org/view.php?id=CVE-2018-6911
The VBWinExec function in Node\AspVBObj.dll in Advantech WebAccess 8.3.0 allows remote attackers to execute arbitrary OS commands via a single argument (aka the command parameter). La función VBWinExec en Node\AspVBObj.dll en Advantech WebAccess 8.3.0 permite que atacantes remotos ejecuten comandos arbitrarios del sistema operativo mediante un único argumento (también conocido como parámetro command). Advantech WebAccess Node version 8.3.0 suffers from an AspVBObj.dll code execution dll hijacking vulnerability. • https://www.exploit-db.com/exploits/44031 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2017-16736
https://notcve.org/view.php?id=CVE-2017-16736
An Unrestricted Upload Of File With Dangerous Type issue was discovered in Advantech WebAccess versions prior to 8.3. WebAccess allows a remote attacker to upload arbitrary files. Se ha descubierto un problema de subida no restringida de archivos con tipo peligroso en Advantech WebAccess en versiones anteriores a la 8.3. WebAccess permite que un atacante remoto ejecute código arbitrario. • https://ics-cert.us-cert.gov/advisories/ICSA-18-004-02A • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2017-16732
https://notcve.org/view.php?id=CVE-2017-16732
A use-after-free issue was discovered in Advantech WebAccess versions prior to 8.3. WebAccess allows an unauthenticated attacker to specify an arbitrary address. Se ha descubierto un problema de uso de memoria previamente liberada en Advantech WebAccess en versiones anteriores a la 8.3. WebAccess permite que un atacante no autenticado especifique una dirección arbitraria. • https://ics-cert.us-cert.gov/advisories/ICSA-18-004-02A • CWE-416: Use After Free •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2017-16753
https://notcve.org/view.php?id=CVE-2017-16753
An Improper Input Validation issue was discovered in Advantech WebAccess versions prior to 8.3. WebAccess allows some inputs that may cause the program to crash. Se ha descubierto un problema de validación incorrecta de entradas en Advantech WebAccess en versiones anteriores a la 8.3. WebAccess permite algunas entradas que podrían provocar que el programa se cierre inesperadamente. • http://www.securityfocus.com/bid/102424 https://ics-cert.us-cert.gov/advisories/ICSA-18-004-02 • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-16724 – Advantech WebAccess BwSyncDb Stack-based Buffer Overflow Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2017-16724
A Stack-based Buffer Overflow issue was discovered in Advantech WebAccess versions prior to 8.3. There are multiple instances of a vulnerability that allows too much data to be written to a location on the stack. Se ha descubierto un problema de desbordamiento de búfer basado en pila en Advantech WebAccess en versiones anteriores a la 8.3. Existen múltiples instancias de una vulnerabilidad que permiten que demasiados datos se escriban en una ubicación de la pila. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Advantech WebAccess. • http://www.securityfocus.com/bid/102424 https://ics-cert.us-cert.gov/advisories/ICSA-18-004-02 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-121: Stack-based Buffer Overflow •