Vulnerabilities > Advantech > Advantech Webaccess > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2014-07-19 | CVE-2014-2366 | Information Exposure vulnerability in Advantech Webaccess 5.0/6.0/7.0 upAdminPg.asp in Advantech WebAccess before 7.2 allows remote authenticated users to discover credentials by reading HTML source code. | 4.0 |
| 2014-07-19 | CVE-2014-2365 | Remote Code Execution vulnerability in Advantech Webaccess 5.0/6.0/7.0 Unspecified vulnerability in Advantech WebAccess before 7.2 allows remote authenticated users to create or delete arbitrary files via unknown vectors. | 5.5 |
| 2014-04-12 | CVE-2014-0772 | Information Exposure vulnerability in Advantech Webaccess 5.0/6.0/7.0 The OpenUrlToBufferTimeout method in the BWOCXRUN.BwocxrunCtrl.1 ActiveX control in bwocxrun.ocx in Advantech WebAccess before 7.2 allows remote attackers to read arbitrary files via a file: URL. | 5.0 |
| 2014-04-12 | CVE-2014-0771 | Information Exposure vulnerability in Advantech Webaccess 5.0/6.0/7.0 The OpenUrlToBuffer method in the BWOCXRUN.BwocxrunCtrl.1 ActiveX control in bwocxrun.ocx in Advantech WebAccess before 7.2 allows remote attackers to read arbitrary files via a file: URL. | 5.0 |
| 2012-02-21 | CVE-2012-1235 | Cross-Site Request Forgery (CSRF) vulnerability in Advantech Webaccess 5.0/6.0 Cross-site request forgery (CSRF) vulnerability in Advantech/BroadWin WebAccess 7.0 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors. | 6.0 |
| 2012-02-21 | CVE-2012-1234 | SQL Injection vulnerability in Advantech Webaccess 5.0/6.0 SQL injection vulnerability in Advantech/BroadWin WebAccess 7.0 allows remote authenticated users to execute arbitrary SQL commands via a malformed URL. | 6.5 |
| 2012-02-21 | CVE-2012-0241 | Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Advantech Webaccess 5.0/6.0 Advantech/BroadWin WebAccess before 7.0 allows remote attackers to cause a denial of service (memory corruption) via a modified stream identifier to a function. | 5.0 |
| 2012-02-21 | CVE-2012-0239 | Improper Authentication vulnerability in Advantech Webaccess 5.0/6.0 uaddUpAdmin.asp in Advantech/BroadWin WebAccess before 7.0 does not properly perform authentication, which allows remote attackers to modify an administrative password via a password-change request. | 5.0 |
| 2012-02-21 | CVE-2012-0237 | Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Advantech Webaccess 5.0/6.0 Advantech/BroadWin WebAccess before 7.0 allows remote attackers to (1) enable date and time syncing or (2) disable date and time syncing via a crafted URL. | 6.4 |
| 2012-02-21 | CVE-2012-0236 | Information Exposure vulnerability in Advantech Webaccess 5.0/6.0 Advantech/BroadWin WebAccess 7.0 and earlier allows remote attackers to obtain sensitive information via a direct request to a URL. | 5.0 |