Webaccess
by Advantech
CVEs (172)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2016-4528 | Med | 0.33 | 5.0 | 0.01 | Jun 25, 2016 | Buffer overflow in Advantech WebAccess before 8.1_20160519 allows local users to cause a denial of service via a crafted DLL file. | ||
| CVE-2025-67653 | Med | 0.28 | 4.3 | 0.01 | Dec 18, 2025 | Advantech WebAccess/SCADA is vulnerable to directory traversal, which may allow an attacker to determine the existence of arbitrary files. | ||
| CVE-2025-14848 | Med | 0.28 | 4.3 | 0.01 | Dec 18, 2025 | Advantech WebAccess/SCADA is vulnerable to absolute directory traversal, which may allow an attacker to determine the existence of arbitrary files. | ||
| CVE-2021-38431 | Med | 0.28 | 4.3 | 0.01 | Oct 15, 2021 | An authenticated user using Advantech WebAccess SCADA in versions 9.0.3 and prior can use API functions to disclose project names and paths from other users. | ||
| CVE-2014-2364 | 0.08 | — | 0.61 | Jul 19, 2014 | Multiple stack-based buffer overflows in Advantech WebAccess before 7.2 allow remote attackers to execute arbitrary code via a long string in the (1) ProjectName, (2) SetParameter, (3) NodeName, (4) CCDParameter, (5) SetColor, (6) AlarmImage, (7) GetParameter, (8) GetColor, (9)… | |||
| CVE-2014-0763 | 0.05 | — | 0.19 | Apr 12, 2014 | An attacker using SQL injection may use arguments to construct queries without proper sanitization. The DBVisitor.dll is exposed through SOAP interfaces, and the exposed functions are vulnerable to SOAP injection. This may allow unexpected SQL action and access to records in… | |||
| CVE-2014-9208 | 0.04 | — | 0.09 | Sep 11, 2015 | Multiple stack-based buffer overflows in unspecified DLL files in Advantech WebAccess before 8.0.1 allow remote attackers to execute arbitrary code via unknown vectors. | |||
| CVE-2012-0242 | 0.04 | — | 0.07 | Feb 21, 2012 | Format string vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary code via format string specifiers in a message string. | |||
| CVE-2011-4041 | 0.04 | — | 0.18 | Feb 6, 2012 | webvrpcs.exe in Advantech/BroadWin WebAccess allows remote attackers to execute arbitrary code or obtain a security-code value via a long string in an RPC request to TCP port 4592. | |||
| CVE-2013-2299 | 0.03 | — | 0.01 | Aug 22, 2013 | Cross-site scripting (XSS) vulnerability in Advantech WebAccess (formerly BroadWin WebAccess) before 7.1 2013.05.30 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. | |||
| CVE-2012-0241 | 0.03 | — | 0.05 | Feb 21, 2012 | Advantech/BroadWin WebAccess before 7.0 allows remote attackers to cause a denial of service (memory corruption) via a modified stream identifier to a function. | |||
| CVE-2014-9202 | 0.00 | — | 0.01 | Sep 28, 2015 | Multiple stack-based buffer overflows in an unspecified DLL file in Advantech WebAccess before 8.0_20150816 allow remote attackers to execute arbitrary code via a crafted file that triggers long string arguments to functions. | |||
| CVE-2014-8388 | 0.00 | — | 0.01 | Nov 21, 2014 | Stack-based buffer overflow in Advantech WebAccess, formerly BroadWin WebAccess, before 8.0 allows remote attackers to execute arbitrary code via a crafted ip_address parameter in an HTML document. | |||
| CVE-2014-0992 | 0.00 | — | 0.03 | Sep 20, 2014 | Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the password parameter. | |||
| CVE-2014-0991 | 0.00 | — | 0.03 | Sep 20, 2014 | Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the projectname parameter. | |||
| CVE-2014-0990 | 0.00 | — | 0.03 | Sep 20, 2014 | Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the UserName parameter. | |||
| CVE-2014-0989 | 0.00 | — | 0.03 | Sep 20, 2014 | Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the AccessCode2 parameter. | |||
| CVE-2014-0988 | 0.00 | — | 0.03 | Sep 20, 2014 | Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the AccessCode parameter. | |||
| CVE-2014-0987 | 0.00 | — | 0.03 | Sep 20, 2014 | Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the NodeName2 parameter. | |||
| CVE-2014-0986 | 0.00 | — | 0.03 | Sep 20, 2014 | Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the GotoCmd parameter. |
- risk 0.33cvss 5.0epss 0.01
Buffer overflow in Advantech WebAccess before 8.1_20160519 allows local users to cause a denial of service via a crafted DLL file.
- risk 0.28cvss 4.3epss 0.01
Advantech WebAccess/SCADA is vulnerable to directory traversal, which may allow an attacker to determine the existence of arbitrary files.
- risk 0.28cvss 4.3epss 0.01
Advantech WebAccess/SCADA is vulnerable to absolute directory traversal, which may allow an attacker to determine the existence of arbitrary files.
- risk 0.28cvss 4.3epss 0.01
An authenticated user using Advantech WebAccess SCADA in versions 9.0.3 and prior can use API functions to disclose project names and paths from other users.
- CVE-2014-2364Jul 19, 2014risk 0.08cvss —epss 0.61
Multiple stack-based buffer overflows in Advantech WebAccess before 7.2 allow remote attackers to execute arbitrary code via a long string in the (1) ProjectName, (2) SetParameter, (3) NodeName, (4) CCDParameter, (5) SetColor, (6) AlarmImage, (7) GetParameter, (8) GetColor, (9)…
- CVE-2014-0763Apr 12, 2014risk 0.05cvss —epss 0.19
An attacker using SQL injection may use arguments to construct queries without proper sanitization. The DBVisitor.dll is exposed through SOAP interfaces, and the exposed functions are vulnerable to SOAP injection. This may allow unexpected SQL action and access to records in…
- CVE-2014-9208Sep 11, 2015risk 0.04cvss —epss 0.09
Multiple stack-based buffer overflows in unspecified DLL files in Advantech WebAccess before 8.0.1 allow remote attackers to execute arbitrary code via unknown vectors.
- CVE-2012-0242Feb 21, 2012risk 0.04cvss —epss 0.07
Format string vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary code via format string specifiers in a message string.
- CVE-2011-4041Feb 6, 2012risk 0.04cvss —epss 0.18
webvrpcs.exe in Advantech/BroadWin WebAccess allows remote attackers to execute arbitrary code or obtain a security-code value via a long string in an RPC request to TCP port 4592.
- CVE-2013-2299Aug 22, 2013risk 0.03cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in Advantech WebAccess (formerly BroadWin WebAccess) before 7.1 2013.05.30 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
- CVE-2012-0241Feb 21, 2012risk 0.03cvss —epss 0.05
Advantech/BroadWin WebAccess before 7.0 allows remote attackers to cause a denial of service (memory corruption) via a modified stream identifier to a function.
- CVE-2014-9202Sep 28, 2015risk 0.00cvss —epss 0.01
Multiple stack-based buffer overflows in an unspecified DLL file in Advantech WebAccess before 8.0_20150816 allow remote attackers to execute arbitrary code via a crafted file that triggers long string arguments to functions.
- CVE-2014-8388Nov 21, 2014risk 0.00cvss —epss 0.01
Stack-based buffer overflow in Advantech WebAccess, formerly BroadWin WebAccess, before 8.0 allows remote attackers to execute arbitrary code via a crafted ip_address parameter in an HTML document.
- CVE-2014-0992Sep 20, 2014risk 0.00cvss —epss 0.03
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the password parameter.
- CVE-2014-0991Sep 20, 2014risk 0.00cvss —epss 0.03
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the projectname parameter.
- CVE-2014-0990Sep 20, 2014risk 0.00cvss —epss 0.03
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the UserName parameter.
- CVE-2014-0989Sep 20, 2014risk 0.00cvss —epss 0.03
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the AccessCode2 parameter.
- CVE-2014-0988Sep 20, 2014risk 0.00cvss —epss 0.03
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the AccessCode parameter.
- CVE-2014-0987Sep 20, 2014risk 0.00cvss —epss 0.03
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the NodeName2 parameter.
- CVE-2014-0986Sep 20, 2014risk 0.00cvss —epss 0.03
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the GotoCmd parameter.
Page 7 of 9