CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-2453 – Advantech WebAccess/SCADA SQL Injection
https://notcve.org/view.php?id=CVE-2024-2453
There is an SQL injection vulnerability in Advantech WebAccess/SCADA software that allows an authenticated attacker to remotely inject SQL code in the database. Successful exploitation of this vulnerability could allow an attacker to read or modify data on the remote database. Existe una vulnerabilidad de inyección SQL en el software Advantech WebAccess/SCADA que permite a un atacante autenticado inyectar código SQL de forma remota en la base de datos. La explotación exitosa de esta vulnerabilidad podría permitir a un atacante leer o modificar datos en la base de datos remota. • https://www.cisa.gov/news-events/ics-advisories/icsa-24-081-01 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-5642 – Advantech R-SeeNet Unauthenticated Read/Write
https://notcve.org/view.php?id=CVE-2023-5642
Advantech R-SeeNet v2.4.23 allows an unauthenticated remote attacker to read from and write to the snmpmon.ini file, which contains sensitive information. Advantech R-SeeNet v2.4.23 permite a un atacante remoto no autenticado leer y escribir en el archivo snmpmon.ini, que contiene información confidencial. • https://tenable.com/security/research/tra-2023-33 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-4215 – Advantech WebAccess Exposure of Sensitive Information to an Unauthorized Actor
https://notcve.org/view.php?id=CVE-2023-4215
Advantech WebAccess version 9.1.3 contains an exposure of sensitive information to an unauthorized actor vulnerability that could leak user credentials. Advantech WebAccess versión 9.1.3 contiene una exposición de información confidencial a una vulnerabilidad de un actor no autorizado que podría filtrar las credenciales del usuario. • https://www.cisa.gov/news-events/ics-advisories/icsa-23-285-15 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.0EPSS: 0%CPEs: 6EXPL: 1CVE-2023-4203 – Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2023-4203
Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21 are affected by a Stored Cross-Site Scripting vulnerability, which can be triggered by authenticated users in the ping tool of the web-interface. Los dispositivos Advantech EKI-1524, EKI-1522, EKI-1521 hasta la versión 1.21 están afectados por una vulnerabilidad Cross-Site Scripting (XSS) Almacenado, que puede ser activada por usuarios autenticados en la herramienta ping de la interfaz web. Advantech EKI-1524-CE series, EKI-1522 series,and EKI-1521 series versions 1.21 and below and 1.24 and below suffer from cross site scripting vulnerabilities. • http://packetstormsecurity.com/files/174153/Advantech-EKI-1524-CE-EKI-1522-EKI-1521-Cross-Site-Scripting.html http://seclists.org/fulldisclosure/2023/Aug/13 https://cyberdanube.com/en/en-st-polten-uas-multiple-vulnerabilities-in-advantech-eki-15xx-series • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.0EPSS: 0%CPEs: 6EXPL: 1CVE-2023-4202 – Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2023-4202
Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21 are affected by a Stored Cross-Site Scripting vulnerability, which can be triggered by authenticated users in the device name field of the web-interface. Los dispositivos Advantech EKI-1524, EKI-1522, EKI-1521 hasta la versión 1.21 están afectados por una vulnerabilidad de secuencias de comandos cruzadas almacenadas, que puede ser activada por usuarios autenticados en el campo del nombre del dispositivo de la interfaz web. Advantech EKI-1524-CE series, EKI-1522 series,and EKI-1521 series versions 1.21 and below and 1.24 and below suffer from cross site scripting vulnerabilities. • http://packetstormsecurity.com/files/174153/Advantech-EKI-1524-CE-EKI-1522-EKI-1521-Cross-Site-Scripting.html http://seclists.org/fulldisclosure/2023/Aug/13 https://cyberdanube.com/en/en-st-polten-uas-multiple-vulnerabilities-in-advantech-eki-15xx-series • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •