CVSS: 9.8EPSS: 2%CPEs: 1EXPL: 0CVE-2019-10987 – Advantech WebAccess Node webvrpcs viewsrv Out-Of-Bounds Write Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2019-10987
28 Jun 2019 — In WebAccess/SCADA Versions 8.3.5 and prior, multiple out-of-bounds write vulnerabilities are caused by a lack of proper validation of the length of user-supplied data. Exploitation of these vulnerabilities may allow remote code execution. En WebAccess/SCADA versiones 8.3.5 y anteriores, múltiples vulnerabilidades de escritura fuera de límites son provocadas por la falta de una validación correcta de la longitud de los datos proporcionados. La explotación de estas vulnerabilidades podría provocar la ejecuci... • https://www.us-cert.gov/ics/advisories/icsa-19-178-05 • CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2019-10983 – Advantech WebAccess Node viewsrv Out-Of-Bounds Read Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2019-10983
28 Jun 2019 — In WebAccess/SCADA Versions 8.3.5 and prior, an out-of-bounds read vulnerability is caused by a lack of proper validation of user-supplied data. Exploitation of this vulnerability may allow disclosure of information. En WebAccess/SCADA versiones 8.3.5 y anteriores, una vulnerabilidad de lectura fuera de límites se debe por la falta de una validación correcta de la longitud de los datos proporcionados. La explotación de esta vulnerabilidad puede permitir la divulgación de información. This vulnerability allo... • https://www.us-cert.gov/ics/advisories/icsa-19-178-05 • CWE-125: Out-of-bounds Read •
CVSS: 9.8EPSS: 12%CPEs: 1EXPL: 0CVE-2019-10989 – Advantech WebAccess Node BwPAlarm Heap-based Buffer Overflow Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2019-10989
28 Jun 2019 — In WebAccess/SCADA Versions 8.3.5 and prior, multiple heap-based buffer overflow vulnerabilities are caused by a lack of proper validation of the length of user-supplied data. Exploitation of these vulnerabilities may allow remote code execution. Note: A different vulnerability than CVE-2019-10991. En WebAccess/SCADA versiones 8.3.5 y anteriores, múltiples vulnerabilidades de desbordamiento de búfer basado en memoria dinámica (heap) son provocadas por la falta de una validación correcta de la longitud de lo... • https://www.us-cert.gov/ics/advisories/icsa-19-178-05 • CWE-787: Out-of-bounds Write •
CVSS: 9.8EPSS: 24%CPEs: 1EXPL: 0CVE-2019-10991 – Advantech WebAccess Client bwclient Stack-based Buffer Overflow Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2019-10991
28 Jun 2019 — In WebAccess/SCADA, Versions 8.3.5 and prior, multiple stack-based buffer overflow vulnerabilities are caused by a lack of proper validation of the length of user-supplied data. Exploitation of these vulnerabilities may allow remote code execution. En WebAccess/SCADA, versiones 8.3.5 y anteriores, múltiples vulnerabilidades de desbordamiento de búfer basado en pila son provocadas por la falta de una validación correcta de la longitud de los datos proporcionados. La explotación de estas vulnerabilidades podr... • https://www.us-cert.gov/ics/advisories/icsa-19-178-05 • CWE-787: Out-of-bounds Write •
CVSS: 9.1EPSS: 3%CPEs: 1EXPL: 0CVE-2019-10985 – Advantech WebAccess Node viewsrv Arbitrary File Deletion Vulnerability
https://notcve.org/view.php?id=CVE-2019-10985
28 Jun 2019 — In WebAccess/SCADA, Versions 8.3.5 and prior, a path traversal vulnerability is caused by a lack of proper validation of a user-supplied path prior to use in file operations. An attacker can leverage this vulnerability to delete files while posing as an administrator. En WebAccess/SCADA, versiones 8.3.5 y anteriores, una vulnerabilidad de salto de directorio es provocada por la falta de una validación correcta de una ruta suministrada por el usuario antes de utilizarla en las operaciones de archivo. Un atac... • https://www.us-cert.gov/ics/advisories/icsa-19-178-05 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.8EPSS: 3%CPEs: 1EXPL: 0CVE-2019-6550 – Advantech WebAccess Node makensis Stack-based Buffer Overflow Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2019-6550
05 Apr 2019 — Advantech WebAccess/SCADA, Versions 8.3.5 and prior. Multiple stack-based buffer overflow vulnerabilities, caused by a lack of proper validation of the length of user-supplied data, may allow remote code execution. Advantech WebAccess/SCADA, en versiones 8.3.5 y anteriores. Múltiples vulnerabilidades de desbordamiento de búfer basado en pila, provocadas por la falta de una validación correcta de la longitud de los datos proporcionados, podrían permitir una ejecución remota de código. This vulnerability allo... • https://ics-cert.us-cert.gov/advisories/ICSA-19-092-01 • CWE-121: Stack-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 0CVE-2019-6552 – Advantech WebAccess Node bwrunmie Command Injection Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2019-6552
02 Apr 2019 — Advantech WebAccess/SCADA, Versions 8.3.5 and prior. Multiple command injection vulnerabilities, caused by a lack of proper validation of user-supplied data, may allow remote code execution. Advantech WebAccess/SCADA, en versiones 8.3.5 y anteriores. Múltiples vulnerabilidades de inyección de comandos, provocadas por la falta de una validación correcta de la longitud de los datos proporcionados, podrían permitir una ejecución remota de código. This vulnerability allows remote attackers to execute arbitrary ... • https://ics-cert.us-cert.gov/advisories/ICSA-19-092-01 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2019-6554 – Advantech WebAccess Node UninstallWA Improper Access Control Denial-of-Service Vulnerability
https://notcve.org/view.php?id=CVE-2019-6554
02 Apr 2019 — Advantech WebAccess/SCADA, Versions 8.3.5 and prior. An improper access control vulnerability may allow an attacker to cause a denial-of-service condition. Advantech WebAccess/SCADA, en versiones 8.3.5 y anteriores. Una vulnerabilidad de control de acceso incorrecto podría permitir que un atacante provoque una condición de denegación de servicio (DoS). This vulnerability allows remote attackers to create a denial-of-service condition on vulnerable installations of Advantech WebAccess Node. • https://ics-cert.us-cert.gov/advisories/ICSA-19-092-01 • CWE-284: Improper Access Control •
CVSS: 9.3EPSS: 3%CPEs: 1EXPL: 0CVE-2018-17910 – Advantech WebAccess Client bwswfcfg Stack-based Buffer Overflow Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2018-17910
29 Oct 2018 — WebAccess Versions 8.3.2 and prior. The application fails to properly validate the length of user-supplied data, causing a buffer overflow condition that allows for arbitrary remote code execution. WebAccess en versiones 8.3.2 y anteriores. La aplicación no valida correctamente la longitud de los datos proporcionados por el usuario, provocando una condición de desbordamiento de búfer que permite la ejecución remota de código. This vulnerability allows remote attackers to execute arbitrary code on affected i... • http://www.securityfocus.com/bid/105736 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-121: Stack-based Buffer Overflow •
CVSS: 8.4EPSS: 0%CPEs: 1EXPL: 0CVE-2018-17908 – Advantech WebAccess Client Improper Access Control Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2018-17908
29 Oct 2018 — WebAccess Versions 8.3.2 and prior. During installation, the application installer disables user access control and does not re-enable it after the installation is complete. This could allow an attacker to run elevated arbitrary code. WebAccess en versiones 8.3.2 y anteriores. Durante la instalación, el instalador de la aplicación deshabilita el control de acceso de los usuario y no lo rehabilita tras completar la instalación. • http://www.securityfocus.com/bid/105736 • CWE-284: Improper Access Control •