CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2017-7909
https://notcve.org/view.php?id=CVE-2017-7909
A Use of Client-Side Authentication issue was discovered in Advantech B+B SmartWorx MESR901 firmware versions 1.5.2 and prior. The web interface uses JavaScript to check client authentication and redirect unauthorized users. Attackers may intercept requests and bypass authentication to access restricted web pages. Un problema de uso de autenticación del lado del cliente se detectó en B+B SmartWorx MESR901 versiones de firmwares 1.5.2 y anteriores de Advantech. La interfaz web utiliza JavaScript para comprobar la autenticación de cliente y redireccionar a los usuarios no autorizados. • http://www.securityfocus.com/bid/98257 https://ics-cert.us-cert.gov/advisories/ICSA-17-122-03 • CWE-287: Improper Authentication CWE-603: Use of Client-Side Authentication •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2017-7929 – Advantech WebAccess odbcPg4 Absolute Path Traversal File Denial of Service Vulnerability
https://notcve.org/view.php?id=CVE-2017-7929
An Absolute Path Traversal issue was discovered in Advantech WebAccess Version 8.1 and prior. The absolute path traversal vulnerability has been identified, which may allow an attacker to traverse the file system to access restricted files or directories. Se detectó un problema de Salto de Ruta (Path) Absoluto en WebAccess Versión 8.1 y anteriores. Se ha identificado la vulnerabilidad de salto de ruta (path) absoluta, que puede permitir a un atacante atravesar el sistema de archivos para acceder a archivos o directorios restringidos. This vulnerability allows remote attackers to cause a denial of service condition on vulnerable installations of Advantech WebAccess. • http://www.securityfocus.com/bid/98311 https://ics-cert.us-cert.gov/advisories/ICSA-17-124-03 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-36: Absolute Path Traversal •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2017-5152 – Advantech WebAccess updateTemplate SQL Injection Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2017-5152
An issue was discovered in Advantech WebAccess Version 8.1. By accessing a specific uniform resource locator (URL) on the web server, a malicious user is able to access pages unrestricted (AUTHENTICATION BYPASS). Ha sido descubierto un problema en Advantech WebAccess Versión 8.1. Accediendo a un localizador de recursos uniforme (URL) específico en el servidor web, un usuario malicioso es capaz de acceder a páginas sin restricciones (ELUSIÓN DE AUTENTICACIÓN). This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Advantech WebAccess. • http://www.securityfocus.com/bid/95410 https://ics-cert.us-cert.gov/advisories/ICSA-17-012-01 https://www.tenable.com/security/research/tra-2017-04 • CWE-287: Improper Authentication •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-5154 – Advantech WebAccess updateTemplate SQL Injection Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2017-5154
An issue was discovered in Advantech WebAccess Version 8.1. To be able to exploit the SQL injection vulnerability, an attacker must supply malformed input to the WebAccess software. Successful attack could result in administrative access to the application and its data files. Ha sido descubierto un problema en Advantech WebAccess Versión 8.1. Para poder explotar la vulnerabilidad de inyección de SQL, un atacante debe proporcionar entrada malformada al software WebAccess. • http://www.securityfocus.com/bid/95410 https://ics-cert.us-cert.gov/advisories/ICSA-17-012-01 https://www.tenable.com/security/research/tra-2017-04 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.5EPSS: 0%CPEs: 1EXPL: 1CVE-2016-9351 – Advantech SUSIAccess Server UpgradeMgmt upload Directory Traversal Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2016-9351
An issue was discovered in Advantech SUISAccess Server Version 3.0 and prior. The directory traversal/file upload error allows an attacker to upload and unpack a zip file. Ha sido descubierto un problema en Advantech SUISAccess Server versión 3.0 y anteriores. El error de subida de directorio transversal/file permite a un atacante cargar y descomprimir un archivo zip. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Advantech SUSIAccess Server. • https://www.exploit-db.com/exploits/42402 http://www.securityfocus.com/bid/94629 https://ics-cert.us-cert.gov/advisories/ICSA-16-336-04 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •