CVSS: 6.1EPSS: 36%CPEs: 1EXPL: 1CVE-2019-7219
https://notcve.org/view.php?id=CVE-2019-7219
11 Apr 2019 — Unauthenticated reflected cross-site scripting (XSS) exists in Zarafa Webapp 2.0.1.47791 and earlier. NOTE: this is a discontinued product. The issue was fixed in later Zarafa Webapp versions; however, some former Zarafa Webapp customers use the related Kopano product instead. Reflected Cross-Site Scripting (XSS) no autenticados se presenta en Zarafa Webapp versión 2.0.1.47791 y anteriores. NOTA: este es un producto descontinuado. • https://github.com/verifysecurity/CVE-2019-7219 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 3%CPEs: 1EXPL: 1CVE-2019-3941
https://notcve.org/view.php?id=CVE-2019-3941
09 Apr 2019 — Advantech WebAccess 8.3.4 allows unauthenticated, remote attackers to delete arbitrary files via IOCTL 10005 RPC. Advantech WebAccess en la versión 8.3.4, permite a los atacantes remotos no autenticados eliminar archivos arbitrarios mediante IOCTL 10005 RPC. • http://www.securityfocus.com/bid/107847 • CWE-306: Missing Authentication for Critical Function •
CVSS: 9.8EPSS: 5%CPEs: 1EXPL: 0CVE-2019-3940
https://notcve.org/view.php?id=CVE-2019-3940
09 Apr 2019 — Advantech WebAccess 8.3.4 is vulnerable to file upload attacks via unauthenticated RPC call. An unauthenticated, remote attacker can use this vulnerability to execute arbitrary code. Advantech WebAccess versión 8.3.4 es vulnerable a ataques de carga de archivos por medio de una llamada RPC no autenticada. Un atacante remoto no autenticado puede usar esta vulnerabilidad para ejecutar código arbitrario. • http://www.securityfocus.com/bid/107847 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 9.8EPSS: 3%CPEs: 1EXPL: 0CVE-2019-6550 – Advantech WebAccess Node makensis Stack-based Buffer Overflow Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2019-6550
05 Apr 2019 — Advantech WebAccess/SCADA, Versions 8.3.5 and prior. Multiple stack-based buffer overflow vulnerabilities, caused by a lack of proper validation of the length of user-supplied data, may allow remote code execution. Advantech WebAccess/SCADA, en versiones 8.3.5 y anteriores. Múltiples vulnerabilidades de desbordamiento de búfer basado en pila, provocadas por la falta de una validación correcta de la longitud de los datos proporcionados, podrían permitir una ejecución remota de código. This vulnerability allo... • https://ics-cert.us-cert.gov/advisories/ICSA-19-092-01 • CWE-121: Stack-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 0CVE-2019-6552 – Advantech WebAccess Node bwrunmie Command Injection Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2019-6552
02 Apr 2019 — Advantech WebAccess/SCADA, Versions 8.3.5 and prior. Multiple command injection vulnerabilities, caused by a lack of proper validation of user-supplied data, may allow remote code execution. Advantech WebAccess/SCADA, en versiones 8.3.5 y anteriores. Múltiples vulnerabilidades de inyección de comandos, provocadas por la falta de una validación correcta de la longitud de los datos proporcionados, podrían permitir una ejecución remota de código. This vulnerability allows remote attackers to execute arbitrary ... • https://ics-cert.us-cert.gov/advisories/ICSA-19-092-01 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2019-6554 – Advantech WebAccess Node UninstallWA Improper Access Control Denial-of-Service Vulnerability
https://notcve.org/view.php?id=CVE-2019-6554
02 Apr 2019 — Advantech WebAccess/SCADA, Versions 8.3.5 and prior. An improper access control vulnerability may allow an attacker to cause a denial-of-service condition. Advantech WebAccess/SCADA, en versiones 8.3.5 y anteriores. Una vulnerabilidad de control de acceso incorrecto podría permitir que un atacante provoque una condición de denegación de servicio (DoS). This vulnerability allows remote attackers to create a denial-of-service condition on vulnerable installations of Advantech WebAccess Node. • https://ics-cert.us-cert.gov/advisories/ICSA-19-092-01 • CWE-284: Improper Access Control •
CVSS: 6.8EPSS: 4%CPEs: 2EXPL: 1CVE-2018-15706
https://notcve.org/view.php?id=CVE-2018-15706
31 Oct 2018 — WADashboard API in Advantech WebAccess 8.3.1 and 8.3.2 allows remote authenticated attackers to read any file on the filesystem due to a directory traversal vulnerability in the readFile API. WADashboard API en Advantech WebAccess 8.3.1 y 8.3.2 permite que atacantes autenticados remotos lean cualquier archivo del sistema de archivos debido a una vulnerabilidad de salto de directorio en la API readFile. • https://www.tenable.com/security/research/tra-2018-35 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 8.5EPSS: 6%CPEs: 2EXPL: 3CVE-2018-15705 – Advantech WebAccess SCADA 8.3.2 - Remote Code Execution
https://notcve.org/view.php?id=CVE-2018-15705
31 Oct 2018 — WADashboard API in Advantech WebAccess 8.3.1 and 8.3.2 allows remote authenticated attackers to write or overwrite any file on the filesystem due to a directory traversal vulnerability in the writeFile API. An attacker can use this vulnerability to remotely execute arbitrary code. WADashboard API en Advantech WebAccess 8.3.1 y 8.3.2 permite que atacantes autenticados remotos escriban o sobrescriban cualquier archivo del sistema de archivos debido a una vulnerabilidad de salto de directorio en la API writeFi... • https://packetstorm.news/files/id/150157 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 5.4EPSS: 1%CPEs: 2EXPL: 3CVE-2018-15707 – Advantech WebAccess SCADA 8.3.2 - Remote Code Execution
https://notcve.org/view.php?id=CVE-2018-15707
31 Oct 2018 — Advantech WebAccess 8.3.1 and 8.3.2 are vulnerable to cross-site scripting in the Bwmainleft.asp page. An attacker could leverage this vulnerability to disclose credentials amongst other things. Advantech WebAccess 8.3.1 y 8.3.2 son vulnerables a Cross-Site Scripting (XSS) en la página Bwmainleft.asp. Un atacante podría aprovechar esta vulnerabilidad para divulgar credenciales, entre otras cosas. Advantech WebAccess SCADA version 8.3.2 suffers from a code execution vulnerability. • https://packetstorm.news/files/id/150157 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.4EPSS: 0%CPEs: 1EXPL: 0CVE-2018-17908 – Advantech WebAccess Client Improper Access Control Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2018-17908
29 Oct 2018 — WebAccess Versions 8.3.2 and prior. During installation, the application installer disables user access control and does not re-enable it after the installation is complete. This could allow an attacker to run elevated arbitrary code. WebAccess en versiones 8.3.2 y anteriores. Durante la instalación, el instalador de la aplicación deshabilita el control de acceso de los usuario y no lo rehabilita tras completar la instalación. • http://www.securityfocus.com/bid/105736 • CWE-284: Improper Access Control •