CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-12713 – Advantech WebAccess Product Installation File Access Control Modification Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2017-12713
An Incorrect Permission Assignment for Critical Resource issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. Multiple files and folders with ACLs that affect other users are allowed to be modified by non-administrator accounts. Se descubrió una vulnerabilidad de asignación incorrecta de privilegios en Advantech WebAccess en versiones anteriores a la V8.2_20170817. Se permite que cuentas que no son administradores modifiquen múltiples archivos y carpetas con listas de control de acceso que afecten a otros usuarios. This vulnerability allows local attackers to escalate privilege on vulnerable installations of Advantech WebAccess. • http://www.securityfocus.com/bid/100526 https://ics-cert.us-cert.gov/advisories/ICSA-17-241-02 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2017-7929 – Advantech WebAccess odbcPg4 Absolute Path Traversal File Denial of Service Vulnerability
https://notcve.org/view.php?id=CVE-2017-7929
An Absolute Path Traversal issue was discovered in Advantech WebAccess Version 8.1 and prior. The absolute path traversal vulnerability has been identified, which may allow an attacker to traverse the file system to access restricted files or directories. Se detectó un problema de Salto de Ruta (Path) Absoluto en WebAccess Versión 8.1 y anteriores. Se ha identificado la vulnerabilidad de salto de ruta (path) absoluta, que puede permitir a un atacante atravesar el sistema de archivos para acceder a archivos o directorios restringidos. This vulnerability allows remote attackers to cause a denial of service condition on vulnerable installations of Advantech WebAccess. • http://www.securityfocus.com/bid/98311 https://ics-cert.us-cert.gov/advisories/ICSA-17-124-03 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-36: Absolute Path Traversal •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2017-5152 – Advantech WebAccess updateTemplate SQL Injection Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2017-5152
An issue was discovered in Advantech WebAccess Version 8.1. By accessing a specific uniform resource locator (URL) on the web server, a malicious user is able to access pages unrestricted (AUTHENTICATION BYPASS). Ha sido descubierto un problema en Advantech WebAccess Versión 8.1. Accediendo a un localizador de recursos uniforme (URL) específico en el servidor web, un usuario malicioso es capaz de acceder a páginas sin restricciones (ELUSIÓN DE AUTENTICACIÓN). This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Advantech WebAccess. • http://www.securityfocus.com/bid/95410 https://ics-cert.us-cert.gov/advisories/ICSA-17-012-01 https://www.tenable.com/security/research/tra-2017-04 • CWE-287: Improper Authentication •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-5154 – Advantech WebAccess updateTemplate SQL Injection Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2017-5154
An issue was discovered in Advantech WebAccess Version 8.1. To be able to exploit the SQL injection vulnerability, an attacker must supply malformed input to the WebAccess software. Successful attack could result in administrative access to the application and its data files. Ha sido descubierto un problema en Advantech WebAccess Versión 8.1. Para poder explotar la vulnerabilidad de inyección de SQL, un atacante debe proporcionar entrada malformada al software WebAccess. • http://www.securityfocus.com/bid/95410 https://ics-cert.us-cert.gov/advisories/ICSA-17-012-01 https://www.tenable.com/security/research/tra-2017-04 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2016-5817
https://notcve.org/view.php?id=CVE-2016-5817
SQL injection vulnerability in news pages in Cargotec Navis WebAccess before 2016-08-10 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Vulnerabilidad de inyección SQL en páginas de noticias en Cargotec Navis WebAccess en versiones anteriores a 2016-08-10 permite a atacantes remotos ejecutar comandos SQL arbitrarios a través de vectores no especificados. • https://ics-cert.us-cert.gov/advisories/ICSA-16-231-01 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •