Advantech
Advantech Webaccess: vulnerabilidades y CVE
Advantech Webaccess tiene 103 vulnerabilidades publicadas, 0 de ellas en los últimos 12 meses. 41 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE103
Últimos 12 meses0
Críticas41
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2023-4215 | Alta (7.5) | 0.46% | — | 17 oct 2023 | Advantech WebAccess version 9.1.3 contains an exposure of sensitive information to an unauthorized actor vulnerability that could leak user credentials. |
| CVE-2023-2866 | Alta (7.8) | 0.14% | — | 7 jun 2023 | If an attacker can trick an authenticated user into loading a maliciously crafted .zip file onto Advantech WebAccess version 8.4.5, a web shell could be used to give the attacker full control of the SCADA server. |
| CVE-2021-38389 | Crítica (9.8) | 10% | — | 18 oct 2021 | Advantech WebAccess versions 9.02 and prior are vulnerable to a stack-based buffer overflow, which may allow an attacker to remotely execute code. |
| CVE-2021-33023 | Crítica (9.8) | 2.3% | — | 18 oct 2021 | Advantech WebAccess versions 9.02 and prior are vulnerable to a heap-based buffer overflow, which may allow an attacker to remotely execute code. |
| CVE-2021-38408 | Crítica (9.8) | 12% | — | 9 sept 2021 | A stack-based buffer overflow vulnerability in Advantech WebAccess Versions 9.02 and prior caused by a lack of proper validation of the length of user-supplied data may allow remote code execution. |
| CVE-2021-34540 | Media (6.1) | 0.87% | — | 11 jun 2021 | Advantech WebAccess 8.4.2 and 8.4.4 allows XSS via the username column of the bwRoot.asp page of WADashboard. |
| CVE-2020-16202 | Alta (7.8) | 0.38% | — | 22 sept 2020 | WebAccess Node (All versions prior to 9.0.1) has incorrect permissions set for resources used by specific services, which may allow code execution with system privileges. |
| CVE-2020-12019 | Crítica (9.8) | 2.2% | — | 15 jun 2020 | WebAccess Node Version 8.4.4 and prior is vulnerable to a stack-based buffer overflow, which may allow an attacker to remotely execute arbitrary code. |
| CVE-2020-12026 | Alta (8.8) | 2.3% | — | 8 may 2020 | Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple relative path traversal vulnerabilities exist that may allow a low privilege user to overwrite files outside the application’s control. |
| CVE-2020-12022 | Crítica (9.8) | 1.7% | — | 8 may 2020 | Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. An improper validation vulnerability exists that could allow an attacker to inject specially crafted input into memory where it can be executed. |
| CVE-2020-12018 | Alta (7.5) | 1.5% | — | 8 may 2020 | Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. An out-of-bounds vulnerability exists that may allow access to unauthorized data. |
| CVE-2020-12014 | Alta (7.5) | 1.5% | — | 8 may 2020 | Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Input is not properly sanitized and may allow an attacker to inject SQL commands. |
| CVE-2020-12010 | Alta (7.1) | 1.0% | — | 8 may 2020 | Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple relative path traversal vulnerabilities exist that may allow an authenticated user to use a specially crafted file to delete files outside the… |
| CVE-2020-12006 | Crítica (9.8) | 3.7% | — | 8 may 2020 | Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple relative path traversal vulnerabilities exist that may allow a low privilege user to overwrite files outside the application’s control. |
| CVE-2020-12002 | Crítica (9.8) | 9.1% | — | 8 may 2020 | Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple stack-based buffer overflow vulnerabilities exist caused by a lack of proper validation of the length of user-supplied data, which may allow… |
| CVE-2020-10638 | Crítica (9.8) | 7.1% | — | 8 may 2020 | Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple heap-based buffer overflow vulnerabilities exist caused by a lack of proper validation of the length of user-supplied data, which may allow… |
| CVE-2019-3942 | Alta (7.5) | 1.4% | — | 1 abr 2020 | Advantech WebAccess 8.3.4 does not properly restrict an RPC call that allows unauthenticated, remote users to read files. An attacker can use this vulnerability to recover the administrator password. |
| CVE-2020-10607 | Alta (8.8) | 2.1% | — | 27 mar 2020 | In Advantech WebAccess, Versions 8.4.2 and prior. A stack-based buffer overflow vulnerability caused by a lack of proper validation of the length of user-supplied data may allow remote code execution. |
| CVE-2019-3951 | Crítica (9.8) | 3.6% | — | 12 dic 2019 | Advantech WebAccess before 8.4.3 allows unauthenticated remote attackers to execute arbitrary code or cause a denial of service (memory corruption) due to a stack-based buffer overflow when handling IOCTL 70533 RPC… |
| CVE-2019-13558 | Crítica (9.8) | 2.9% | — | 18 sept 2019 | In WebAccess versions 8.4.1 and prior, an exploit executed over the network may cause improper control of generation of code, which may allow remote code execution, data exfiltration, or cause a system crash. |
| CVE-2019-13556 | Alta (8.8) | 2.1% | — | 18 sept 2019 | In WebAccess versions 8.4.1 and prior, multiple stack-based buffer overflow vulnerabilities are caused by a lack of proper validation of the length of user-supplied data. Exploitation of these vulnerabilities may allow… |
| CVE-2019-13552 | Alta (8.8) | 2.7% | — | 18 sept 2019 | In WebAccess versions 8.4.1 and prior, multiple command injection vulnerabilities are caused by a lack of proper validation of user-supplied data and may allow arbitrary file deletion and remote code execution. |
| CVE-2019-13550 | Crítica (9.8) | 2.8% | — | 18 sept 2019 | In WebAccess, versions 8.4.1 and prior, an improper authorization vulnerability may allow an attacker to disclose sensitive information, cause improper control of generation of code, which may allow remote code… |
| CVE-2019-3975 | Crítica (9.8) | 4.6% | — | 10 sept 2019 | Stack-based buffer overflow in Advantech WebAccess/SCADA 8.4.1 allows a remote, unauthenticated attacker to execute arbitrary code via a crafted IOCTL 70603 RPC message. |
| CVE-2019-10993 | Crítica (9.8) | 11% | — | 28 jun 2019 | In WebAccess/SCADA Versions 8.3.5 and prior, multiple untrusted pointer dereference vulnerabilities may allow a remote attacker to execute arbitrary code. |
| CVE-2019-10991 | Crítica (9.8) | 9.0% | — | 28 jun 2019 | In WebAccess/SCADA, Versions 8.3.5 and prior, multiple stack-based buffer overflow vulnerabilities are caused by a lack of proper validation of the length of user-supplied data. Exploitation of these vulnerabilities may… |
| CVE-2019-10989 | Crítica (9.8) | 8.6% | — | 28 jun 2019 | In WebAccess/SCADA Versions 8.3.5 and prior, multiple heap-based buffer overflow vulnerabilities are caused by a lack of proper validation of the length of user-supplied data. Exploitation of these vulnerabilities may… |
| CVE-2019-10987 | Alta (8.8) | 5.7% | — | 28 jun 2019 | In WebAccess/SCADA Versions 8.3.5 and prior, multiple out-of-bounds write vulnerabilities are caused by a lack of proper validation of the length of user-supplied data. Exploitation of these vulnerabilities may allow… |
| CVE-2019-10985 | Crítica (9.1) | 3.1% | — | 28 jun 2019 | In WebAccess/SCADA, Versions 8.3.5 and prior, a path traversal vulnerability is caused by a lack of proper validation of a user-supplied path prior to use in file operations. An attacker can leverage this vulnerability… |
| CVE-2019-10983 | Alta (7.5) | 2.4% | — | 28 jun 2019 | In WebAccess/SCADA Versions 8.3.5 and prior, an out-of-bounds read vulnerability is caused by a lack of proper validation of user-supplied data. Exploitation of this vulnerability may allow disclosure of information. |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.