← Back

Advantech Webaccess

advantech_webaccess

Vendor: Advantech • 44 CVEs

CVEs (44)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2014-0765
1Advantech
1Advantech Webaccess
May 6, 2026
Apr 12, 2014
N/A· v4
N/A· v3
7.5 HIGH· v2
To exploit this vulnerability, the attacker sends data from the GotoCmd argument to control. If the value of the argument is overly long, the static stack buffer can be overflowed. This will allow the attacker to exec...Show more
To exploit this vulnerability, the attacker sends data from the GotoCmd argument to control. If the value of the argument is overly long, the static stack buffer can be overflowed. This will allow the attacker to execute arbitrary code remotely.Show less
CVE-2014-0764
1Advantech
1Advantech Webaccess
May 6, 2026
Apr 12, 2014
N/A· v4
N/A· v3
7.5 HIGH· v2
By providing an overly long string to the NodeName parameter, an attacker may be able to overflow the static stack buffer. The attacker may then execute code on the target device remotely.
CVE-2014-0763
1Advantech
1Advantech Webaccess
May 6, 2026
Apr 12, 2014
N/A· v4
N/A· v3
7.5 HIGH· v2
An attacker using SQL injection may use arguments to construct queries without proper sanitization. The DBVisitor.dll is exposed through SOAP interfaces, and the exposed functions are vulnerable to SOAP injection. Thi...Show more
An attacker using SQL injection may use arguments to construct queries without proper sanitization. The DBVisitor.dll is exposed through SOAP interfaces, and the exposed functions are vulnerable to SOAP injection. This may allow unexpected SQL action and access to records in the table of the software database or execution of arbitrary code.Show less
CVE-2013-2299
1Advantech
1Advantech Webaccess
Apr 29, 2026
Aug 22, 2013
N/A· v4
N/A· v3
3.5 LOW· v2
Cross-site scripting (XSS) vulnerability in Advantech WebAccess (formerly BroadWin WebAccess) before 7.1 2013.05.30 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-1235
1Advantech
1Advantech Webaccess
Apr 29, 2026
Feb 21, 2012
N/A· v4
N/A· v3
6.0 MEDIUM· v2
Cross-site request forgery (CSRF) vulnerability in Advantech/BroadWin WebAccess 7.0 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors. NOTE: this vulnerability exi...Show more
Cross-site request forgery (CSRF) vulnerability in Advantech/BroadWin WebAccess 7.0 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0235.Show less
CVE-2012-1234
1Advantech
1Advantech Webaccess
Apr 29, 2026
Feb 21, 2012
N/A· v4
N/A· v3
6.5 MEDIUM· v2
SQL injection vulnerability in Advantech/BroadWin WebAccess 7.0 allows remote authenticated users to execute arbitrary SQL commands via a malformed URL. NOTE: this vulnerability exists because of an incomplete fix for C...Show more
SQL injection vulnerability in Advantech/BroadWin WebAccess 7.0 allows remote authenticated users to execute arbitrary SQL commands via a malformed URL. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0234.Show less
CVE-2012-0244
1Advantech
1Advantech Webaccess
Apr 29, 2026
Feb 21, 2012
N/A· v4
N/A· v3
7.5 HIGH· v2
Multiple SQL injection vulnerabilities in Advantech/BroadWin WebAccess before 7.0 allow remote attackers to execute arbitrary SQL commands via crafted string input.
CVE-2012-0243
1Advantech
1Advantech Webaccess
Apr 29, 2026
Feb 21, 2012
N/A· v4
N/A· v3
10.0 HIGH· v2
Buffer overflow in an ActiveX control in bwocxrun.ocx in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary code by leveraging the ability to write arbitrary content to any pathname.
CVE-2012-0242
1Advantech
1Advantech Webaccess
Apr 29, 2026
Feb 21, 2012
N/A· v4
N/A· v3
10.0 HIGH· v2
Format string vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary code via format string specifiers in a message string.
CVE-2012-0241
1Advantech
1Advantech Webaccess
Apr 29, 2026
Feb 21, 2012
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Advantech/BroadWin WebAccess before 7.0 allows remote attackers to cause a denial of service (memory corruption) via a modified stream identifier to a function.
CVE-2012-0240
1Advantech
1Advantech Webaccess
Apr 29, 2026
Feb 21, 2012
N/A· v4
N/A· v3
10.0 HIGH· v2
GbScriptAddUp.asp in Advantech/BroadWin WebAccess before 7.0 does not properly perform authentication, which allows remote attackers to execute arbitrary code via unspecified vectors.
CVE-2012-0239
1Advantech
1Advantech Webaccess
Apr 29, 2026
Feb 21, 2012
N/A· v4
N/A· v3
5.0 MEDIUM· v2
uaddUpAdmin.asp in Advantech/BroadWin WebAccess before 7.0 does not properly perform authentication, which allows remote attackers to modify an administrative password via a password-change request.
CVE-2012-0238
1Advantech
1Advantech Webaccess
Apr 29, 2026
Feb 21, 2012
N/A· v4
N/A· v3
10.0 HIGH· v2
Stack-based buffer overflow in opcImg.asp in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary code via unspecified vectors.
CVE-2012-0237
1Advantech
1Advantech Webaccess
Apr 29, 2026
Feb 21, 2012
N/A· v4
N/A· v3
6.4 MEDIUM· v2
Advantech/BroadWin WebAccess before 7.0 allows remote attackers to (1) enable date and time syncing or (2) disable date and time syncing via a crafted URL.
CVE-2012-0236
1Advantech
1Advantech Webaccess
Apr 29, 2026
Feb 21, 2012
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Advantech/BroadWin WebAccess 7.0 and earlier allows remote attackers to obtain sensitive information via a direct request to a URL. NOTE: the vendor reportedly "does not consider it to be a security risk."
CVE-2012-0235
1Advantech
1Advantech Webaccess
Apr 29, 2026
Feb 21, 2012
N/A· v4
N/A· v3
6.0 MEDIUM· v2
Cross-site request forgery (CSRF) vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVE-2012-0234
1Advantech
1Advantech Webaccess
Apr 29, 2026
Feb 21, 2012
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary SQL commands via a malformed URL.
CVE-2012-0233
1Advantech
1Advantech Webaccess
Apr 29, 2026
Feb 21, 2012
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to inject arbitrary web script or HTML via a malformed URL.
CVE-2011-4526
1Advantech
1Advantech Webaccess
Apr 29, 2026
Feb 21, 2012
N/A· v4
N/A· v3
10.0 HIGH· v2
Buffer overflow in an ActiveX control in Advantech/BroadWin WebAccess before 7.0 might allow remote attackers to execute arbitrary code via a long string value in unspecified parameters.
CVE-2011-4525
1Advantech
1Advantech Webaccess
Apr 29, 2026
Feb 21, 2012
N/A· v4
N/A· v3
10.0 HIGH· v2
Advantech/BroadWin WebAccess before 7.0 allows remote attackers to trigger the extraction of arbitrary web content into a batch file on a client system, and execute this batch file, via unspecified vectors.