CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2017-12717
https://notcve.org/view.php?id=CVE-2017-12717
An Uncontrolled Search Path Element issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. A maliciously crafted dll file placed earlier in the search path may allow an attacker to execute code within the context of the application. Se descubrió un problema relacionado con un elemento de ruta de búsqueda no controlado en Advantech WebAccess en versiones anteriores a la V8.2_20170817. Un archivo dll manipulado de manera maliciosa ubicado previamente en la ruta de búsqueda puede permitir a un atacante ejecutar código en el contexto de la aplicación • https://github.com/zi0Black/POC-CVE-2017-12615-or-CVE-2017-12717 http://www.securityfocus.com/bid/100526 https://ics-cert.us-cert.gov/advisories/ICSA-17-241-02 • CWE-427: Uncontrolled Search Path Element •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-12704
https://notcve.org/view.php?id=CVE-2017-12704
A heap-based buffer overflow issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. Researchers have identified multiple vulnerabilities where there is a lack of proper validation of the length of user-supplied data prior to copying it to the heap-based buffer, which could allow an attacker to execute arbitrary code under the context of the process. Se descubrió una vulnerabilidad de desbordamiento de búfer basado en montículos en Advantech WebAccess en versiones anteriores a la V8.2_20170817. Los investigadores han identificado múltiples vulnerabilidades en donde no se valida correctamente la longitud de los datos introducidos por el usuario antes de copiarlos a la memoria dinámica, lo que podría permitir a un atacante ejecutar código arbitrario bajo el contexto del proceso. • http://www.securityfocus.com/bid/100526 https://ics-cert.us-cert.gov/advisories/ICSA-17-241-02 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-122: Heap-based Buffer Overflow •
CVSS: 9.4EPSS: 3%CPEs: 1EXPL: 0CVE-2017-12710 – Advantech WebAccess rmTemplate SQL Injection Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2017-12710
A SQL Injection issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. By submitting a specially crafted parameter, it is possible to inject arbitrary SQL statements that could allow an attacker to obtain sensitive information. Se descubrió una vulnerabilidad de inyección SQL en Advantech WebAccess en versiones anteriores a la V8.2_20170817. Al enviar un parámetro especialmente manipulado, es posible inyectar declaraciones SQL que podrían permitir a un atacante obtener información sensible. This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Advantech WebAccess. • http://www.securityfocus.com/bid/100526 http://www.zerodayinitiative.com/advisories/ZDI-17-712 https://ics-cert.us-cert.gov/advisories/ICSA-17-241-02 https://www.tenable.com/security/research/tra-2017-29 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-12713 – Advantech WebAccess Product Installation File Access Control Modification Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2017-12713
An Incorrect Permission Assignment for Critical Resource issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. Multiple files and folders with ACLs that affect other users are allowed to be modified by non-administrator accounts. Se descubrió una vulnerabilidad de asignación incorrecta de privilegios en Advantech WebAccess en versiones anteriores a la V8.2_20170817. Se permite que cuentas que no son administradores modifiquen múltiples archivos y carpetas con listas de control de acceso que afecten a otros usuarios. This vulnerability allows local attackers to escalate privilege on vulnerable installations of Advantech WebAccess. • http://www.securityfocus.com/bid/100526 https://ics-cert.us-cert.gov/advisories/ICSA-17-241-02 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2017-7929 – Advantech WebAccess odbcPg4 Absolute Path Traversal File Denial of Service Vulnerability
https://notcve.org/view.php?id=CVE-2017-7929
An Absolute Path Traversal issue was discovered in Advantech WebAccess Version 8.1 and prior. The absolute path traversal vulnerability has been identified, which may allow an attacker to traverse the file system to access restricted files or directories. Se detectó un problema de Salto de Ruta (Path) Absoluto en WebAccess Versión 8.1 y anteriores. Se ha identificado la vulnerabilidad de salto de ruta (path) absoluta, que puede permitir a un atacante atravesar el sistema de archivos para acceder a archivos o directorios restringidos. This vulnerability allows remote attackers to cause a denial of service condition on vulnerable installations of Advantech WebAccess. • http://www.securityfocus.com/bid/98311 https://ics-cert.us-cert.gov/advisories/ICSA-17-124-03 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-36: Absolute Path Traversal •