Page 14 of 89 results (0.006 seconds)

CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0

An Incorrect Permission Assignment for Critical Resource issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. Multiple files and folders with ACLs that affect other users are allowed to be modified by non-administrator accounts. Se descubrió una vulnerabilidad de asignación incorrecta de privilegios en Advantech WebAccess en versiones anteriores a la V8.2_20170817. Se permite que cuentas que no son administradores modifiquen múltiples archivos y carpetas con listas de control de acceso que afecten a otros usuarios. This vulnerability allows local attackers to escalate privilege on vulnerable installations of Advantech WebAccess. • http://www.securityfocus.com/bid/100526 https://ics-cert.us-cert.gov/advisories/ICSA-17-241-02 • CWE-732: Incorrect Permission Assignment for Critical Resource •

CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0

An Absolute Path Traversal issue was discovered in Advantech WebAccess Version 8.1 and prior. The absolute path traversal vulnerability has been identified, which may allow an attacker to traverse the file system to access restricted files or directories. Se detectó un problema de Salto de Ruta (Path) Absoluto en WebAccess Versión 8.1 y anteriores. Se ha identificado la vulnerabilidad de salto de ruta (path) absoluta, que puede permitir a un atacante atravesar el sistema de archivos para acceder a archivos o directorios restringidos. This vulnerability allows remote attackers to cause a denial of service condition on vulnerable installations of Advantech WebAccess. • http://www.securityfocus.com/bid/98311 https://ics-cert.us-cert.gov/advisories/ICSA-17-124-03 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-36: Absolute Path Traversal •

CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0

SQL injection vulnerability in news pages in Cargotec Navis WebAccess before 2016-08-10 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Vulnerabilidad de inyección SQL en páginas de noticias en Cargotec Navis WebAccess en versiones anteriores a 2016-08-10 permite a atacantes remotos ejecutar comandos SQL arbitrarios a través de vectores no especificados. • https://ics-cert.us-cert.gov/advisories/ICSA-16-231-01 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0

upAdminPg.asp in Advantech WebAccess before 8.1_20160519 allows remote authenticated administrators to obtain sensitive password information via unspecified vectors. UpAdminPg.asp en Advantech WebAccess versiones anteriores a 8.1_20160519 permite a los administradores autenticados remotos obtener información sensible de contraseñas a través de vectores no especificados. This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Advantech WebAccess. Authentication is required to exploit this vulnerability. The specific flaw exists within upAdminPg.asp. One project administrator can view other project administrators' passwords along with the system administrator's password. • http://www.zerodayinitiative.com/advisories/ZDI-16-429 https://ics-cert.us-cert.gov/advisories/ICSA-16-173-01 https://github.com/rapid7/metasploit-framework/pull/7859#issuecomment-274305229 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 6.6EPSS: 0%CPEs: 1EXPL: 0

Unspecified ActiveX controls in Advantech WebAccess before 8.1_20160519 allow remote authenticated users to obtain sensitive information or modify data via unknown vectors, related to the INTERFACESAFE_FOR_UNTRUSTED_CALLER (aka safe for scripting) flag. Controles ActiveX no especificados en Advantech WebAccess en versiones anteriores a 8.1_20160519 permiten a usuarios remotos autenticados obtener información sensible o modificar datos a través de vectores desconocidos, relacionado con el indicador INTERFACESAFE_FOR_UNTRUSTED_CALLER (también conocido como secuencias de comandos para guardar). • https://ics-cert.us-cert.gov/advisories/ICSA-16-173-01 •