CVSS: 9.8EPSS: 26%CPEs: 2EXPL: 0CVE-2020-10638 – Advantech WebAccess/SCADA BwBacNetJ Heap-based Buffer Overflow Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2020-10638
08 May 2020 — Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple heap-based buffer overflow vulnerabilities exist caused by a lack of proper validation of the length of user-supplied data, which may allow remote code execution. Advantech WebAccess Node, versiones 8.4.4 y anteriores, versión 9.0.0. Se presentan múltiples vulnerabilidades de desbordamiento del búfer en la región heap de la memoria causada por una falta de comprobación apropiada de la longitud de los datos suministrados por el usuari... • https://www.us-cert.gov/ics/advisories/icsa-20-128-01 • CWE-122: Heap-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 9.8EPSS: 31%CPEs: 2EXPL: 0CVE-2020-12002 – Advantech WebAccess/SCADA BwBacNetJ Stack-based Buffer Overflow Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2020-12002
08 May 2020 — Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple stack-based buffer overflow vulnerabilities exist caused by a lack of proper validation of the length of user-supplied data, which may allow remote code execution. Advantech WebAccess Node, versiones 8.4.4 y anteriores, versión 9.0.0. Se presentan múltiples vulnerabilidades de desbordamiento del búfer en la región stack de la memoria causada por una falta de comprobación apropiada de la longitud de los datos suministrados por el usua... • https://www.us-cert.gov/ics/advisories/icsa-20-128-01 • CWE-121: Stack-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 9.8EPSS: 5%CPEs: 2EXPL: 0CVE-2020-12006 – Advantech WebAccess/SCADA DrawSrv IOCTL 0x00002711 Command Injection Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2020-12006
08 May 2020 — Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple relative path traversal vulnerabilities exist that may allow a low privilege user to overwrite files outside the application’s control. Advantech WebAccess Node, versiones 8.4.4 y anteriores, versión 9.0.0. Se presentan múltiples vulnerabilidades de salto de ruta relativa que pueden permitir a un usuario con poco privilegio sobrescribir archivos fuera del control de la aplicación. This vulnerability allows remote attackers to execute... • https://www.us-cert.gov/ics/advisories/icsa-20-128-01 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-23: Relative Path Traversal •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2020-12014 – Advantech WebAccess/SCADA BwWebSvc IOCTL 0x00013c76 IOCTL 0x00013c77 SQL Injection Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2020-12014
08 May 2020 — Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Input is not properly sanitized and may allow an attacker to inject SQL commands. Advantech WebAccess Node, versiones 8.4.4 y anteriores, versión 9.0.0. Una entrada no está apropiadamente saneada y puede permitir a un atacante inyectar comandos SQL. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech WebAccess/SCADA. • https://www.us-cert.gov/ics/advisories/icsa-20-128-01 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2020-12018 – Advantech WebAccess/SCADA DrawSrv IOCTL 0x00002722 Out-Of-Bounds Read Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2020-12018
08 May 2020 — Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. An out-of-bounds vulnerability exists that may allow access to unauthorized data. Advantech WebAccess Node, versiones 8.4.4 y anteriores, versión 9.0.0. Se presenta una vulnerabilidad de lectura fuera de límites que puede permitir el acceso a datos no autorizados. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech WebAccess/SCADA. • https://www.us-cert.gov/ics/advisories/icsa-20-128-01 • CWE-125: Out-of-bounds Read •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2020-12022 – Advantech WebAccess/SCADA DATACORE IOCTL 0x0000521e Improper Validation of Array Index Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2020-12022
08 May 2020 — Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. An improper validation vulnerability exists that could allow an attacker to inject specially crafted input into memory where it can be executed. Advantech WebAccess Node, versiones 8.4.4 y anteriores, versión 9.0.0. Se presenta una vulnerabilidad de comprobación inapropiada que podría permitir a un atacante inyectar información especialmente diseñada dentro de la memoria donde pueda ser ejecutada. This vulnerability allows remote attackers to... • https://www.us-cert.gov/ics/advisories/icsa-20-128-01 • CWE-129: Improper Validation of Array Index •
CVSS: 9.8EPSS: 1%CPEs: 2EXPL: 0CVE-2020-12026 – Advantech WebAccess/SCADA DrawSrv IOCTL 0x0000277d Directory Traversal Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2020-12026
08 May 2020 — Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple relative path traversal vulnerabilities exist that may allow a low privilege user to overwrite files outside the application’s control. Advantech WebAccess Node, versiones 8.4.4 y anteriores, versión 9.0.0. Se presentan múltiples vulnerabilidades de salto de ruta relativa que puede permitir a un usuario con poco privilegio sobrescribir archivos fuera del control de la aplicación. This vulnerability allows remote attackers to execute ... • https://www.us-cert.gov/ics/advisories/icsa-20-128-01 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-23: Relative Path Traversal •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-10603 – Advantech WebAccess/NMS DatabaseMgmtResource OS Command Injection Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2020-10603
08 Apr 2020 — WebAccess/NMS (versions prior to 3.0.2) does not properly sanitize user input and may allow an attacker to inject system commands remotely. WebAccess/NMS (versiones anteriores a 3.0.2), no sanea apropiadamente una entrada del usuario y puede permitir a un atacante inyectar comandos del sistema remotamente. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Advantech WebAccess/NMS. Although authentication is required to exploit this vulnerability, the existing a... • https://www.us-cert.gov/ics/advisories/icsa-20-098-01 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-10617 – Advantech WebAccess/NMS addLinkMonitor SQL Injection Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2020-10617
08 Apr 2020 — There are multiple ways an unauthenticated attacker could perform SQL injection on WebAccess/NMS (versions prior to 3.0.2) to gain access to sensitive information. Se presenta múltiples maneras en que un atacante no autenticado podría llevar a cabo una inyección SQL en WebAccess/NMS (versiones anteriores a 3.0.2) para conseguir acceso a información confidencial. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech WebAccess/NMS. Authentication i... • https://www.us-cert.gov/ics/advisories/icsa-20-098-01 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.1EPSS: 1%CPEs: 1EXPL: 0CVE-2020-10619 – Advantech WebAccess/NMS saveBackgroundAction Directory Traversal Denial-of-Service Vulnerability
https://notcve.org/view.php?id=CVE-2020-10619
08 Apr 2020 — An attacker could use a specially crafted URL to delete files outside the WebAccess/NMS's (versions prior to 3.0.2) control. Un atacante podría usar una URL especialmente diseñada para eliminar archivos fuera del control de WebAccess/NMS (versiones anteriores a 3.0.2). This vulnerability allows remote attackers to delete arbitary files on affected installations of Advantech WebAccess/NMS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of calls to... • https://www.us-cert.gov/ics/advisories/icsa-20-098-01 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-23: Relative Path Traversal •