CVSS: 7.5EPSS: 3%CPEs: 1EXPL: 0CVE-2018-5445 – Advantech WebAccess Node certUpdate filename Directory Traversal Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2018-5445
A Path Traversal issue was discovered in Advantech WebAccess/SCADA versions prior to V8.2_20170817. An attacker has read access to files within the directory structure of the target device. Se ha descubierto un problema de salto de directorio en Advantech WebAccess/SCADA en versiones anteriores a la V8.2_20170817. Un atacante tiene acceso de lectura a archivos en la estructura de directorio del dispositivo objetivo. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Advantech WebAccess Node. • http://www.securityfocus.com/bid/102781 https://ics-cert.us-cert.gov/advisories/ICSA-18-023-01 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2017-16736
https://notcve.org/view.php?id=CVE-2017-16736
An Unrestricted Upload Of File With Dangerous Type issue was discovered in Advantech WebAccess versions prior to 8.3. WebAccess allows a remote attacker to upload arbitrary files. Se ha descubierto un problema de subida no restringida de archivos con tipo peligroso en Advantech WebAccess en versiones anteriores a la 8.3. WebAccess permite que un atacante remoto ejecute código arbitrario. • https://ics-cert.us-cert.gov/advisories/ICSA-18-004-02A • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2017-16732
https://notcve.org/view.php?id=CVE-2017-16732
A use-after-free issue was discovered in Advantech WebAccess versions prior to 8.3. WebAccess allows an unauthenticated attacker to specify an arbitrary address. Se ha descubierto un problema de uso de memoria previamente liberada en Advantech WebAccess en versiones anteriores a la 8.3. WebAccess permite que un atacante no autenticado especifique una dirección arbitraria. • https://ics-cert.us-cert.gov/advisories/ICSA-18-004-02A • CWE-416: Use After Free •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2017-16753
https://notcve.org/view.php?id=CVE-2017-16753
An Improper Input Validation issue was discovered in Advantech WebAccess versions prior to 8.3. WebAccess allows some inputs that may cause the program to crash. Se ha descubierto un problema de validación incorrecta de entradas en Advantech WebAccess en versiones anteriores a la 8.3. WebAccess permite algunas entradas que podrían provocar que el programa se cierre inesperadamente. • http://www.securityfocus.com/bid/102424 https://ics-cert.us-cert.gov/advisories/ICSA-18-004-02 • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-16724 – Advantech WebAccess BwSyncDb Stack-based Buffer Overflow Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2017-16724
A Stack-based Buffer Overflow issue was discovered in Advantech WebAccess versions prior to 8.3. There are multiple instances of a vulnerability that allows too much data to be written to a location on the stack. Se ha descubierto un problema de desbordamiento de búfer basado en pila en Advantech WebAccess en versiones anteriores a la 8.3. Existen múltiples instancias de una vulnerabilidad que permiten que demasiados datos se escriban en una ubicación de la pila. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Advantech WebAccess. • http://www.securityfocus.com/bid/102424 https://ics-cert.us-cert.gov/advisories/ICSA-18-004-02 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-121: Stack-based Buffer Overflow •