webaccess vulnerabilities and fixes

Recent CVEs affecting webaccess, with upgrade or downgrade steps. 106 tracked.

webaccess has 106 tracked vulnerabilities, 42 critical. A fixed release or vendor patch exists for 88. Most recent: 2023-10-17. Highest priority: CVE-2017-16720 (score 69/100).

• CVE-2023-4215 MEDIUM 6.5 DOWNGRADE Advantech WebAccess version 9.1.3 contains an exposure of sensitive information to an unauthorized actor vulne
• CVE-2023-2866 HIGH 7.3 DOWNGRADE If an attacker can trick an authenticated user into loading a maliciously crafted .zip file onto Advantech We
• CVE-2021-38408 CRITICAL 9.8 UPGRADE A stack-based buffer overflow vulnerability in Advantech WebAccess Versions 9.02 and prior caused by a lack of
• CVE-2021-38389 CRITICAL 9.8 UPGRADE Advantech WebAccess versions 9.02 and prior are vulnerable to a stack-based buffer overflow, which may allow a
• CVE-2021-34540 MEDIUM 6.1 DOWNGRADE Advantech WebAccess 8.4.2 and 8.4.4 allows XSS via the username column of the bwRoot.asp page of WADashboard.
• CVE-2021-33023 CRITICAL 9.8 UPGRADE Advantech WebAccess versions 9.02 and prior are vulnerable to a heap-based buffer overflow, which may allow an
• CVE-2020-16202 HIGH 7.8 UPGRADE WebAccess Node (All versions prior to 9.0.1) has incorrect permissions set for resources used by specific serv
• CVE-2020-12026 HIGH 8.8 UPGRADE Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0
• CVE-2020-12022 CRITICAL 9.8 UPGRADE Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0
• CVE-2020-12019 CRITICAL 9.8 UPGRADE WebAccess Node Version 8.4.4 and prior is vulnerable to a stack-based buffer overflow, which may allow an atta
• CVE-2020-12018 HIGH 7.5 UPGRADE Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0
• CVE-2020-12014 HIGH 7.5 UPGRADE Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0
• CVE-2020-12010 HIGH 7.1 UPGRADE Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0
• CVE-2020-12006 CRITICAL 9.8 UPGRADE Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0
• CVE-2020-12002 CRITICAL 9.8 UPGRADE Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0
• CVE-2020-10638 CRITICAL 9.8 UPGRADE Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0
• CVE-2020-10607 HIGH 8.8 UPGRADE In Advantech WebAccess, Versions 8.4.2 and prior
• CVE-2019-7219 MEDIUM 6.1 DOWNGRADE Unauthenticated reflected cross-site scripting (XSS) exists in Zarafa Webapp 2.0.1.47791 and earlier
• CVE-2019-6554 HIGH 7.5 UPGRADE Advantech WebAccess/SCADA, Versions 8.3.5 and prior
• CVE-2019-6552 CRITICAL 9.8 UPGRADE Advantech WebAccess/SCADA, Versions 8.3.5 and prior
• CVE-2019-6550 CRITICAL 9.8 UPGRADE Advantech WebAccess/SCADA, Versions 8.3.5 and prior
• CVE-2019-3975 CRITICAL 9.8 DOWNGRADE Stack-based buffer overflow in Advantech WebAccess/SCADA 8.4.1 allows a remote, unauthenticated attacker to ex
• CVE-2019-3954 CRITICAL 9.8 DOWNGRADE Stack-based buffer overflow in Advantech WebAccess/SCADA 8.4.0 allows a remote, unauthenticated attacker to ex
• CVE-2019-3953 CRITICAL 9.8 DOWNGRADE Stack-based buffer overflow in Advantech WebAccess/SCADA 8.4.0 allows a remote, unauthenticated attacker to ex
• CVE-2019-3951 CRITICAL 9.8 UPGRADE Advantech WebAccess before 8.4.3 allows unauthenticated remote attackers to execute arbitrary code or cause a
• CVE-2019-3942 HIGH 7.5 DOWNGRADE Advantech WebAccess 8.3.4 does not properly restrict an RPC call that allows unauthenticated, remote users to
• CVE-2019-3941 HIGH 7.5 DOWNGRADE Advantech WebAccess 8.3.4 allows unauthenticated, remote attackers to delete arbitrary files via IOCTL 10005 R
• CVE-2019-3940 CRITICAL 9.8 DOWNGRADE Advantech WebAccess 8.3.4 is vulnerable to file upload attacks via unauthenticated RPC call
• CVE-2019-13558 CRITICAL 9.8 UPGRADE In WebAccess versions 8.4.1 and prior, an exploit executed over the network may cause improper control of gene
• CVE-2019-13556 HIGH 8.8 UPGRADE In WebAccess versions 8.4.1 and prior, multiple stack-based buffer overflow vulnerabilities are caused by a la
• CVE-2019-13552 HIGH 8.8 UPGRADE In WebAccess versions 8.4.1 and prior, multiple command injection vulnerabilities are caused by a lack of prop
• CVE-2019-13550 CRITICAL 9.8 UPGRADE In WebAccess, versions 8.4.1 and prior, an improper authorization vulnerability may allow an attacker to discl
• CVE-2019-10993 CRITICAL 9.8 UPGRADE In WebAccess/SCADA Versions 8.3.5 and prior, multiple untrusted pointer dereference vulnerabilities may allow
• CVE-2019-10991 CRITICAL 9.8 UPGRADE In WebAccess/SCADA, Versions 8.3.5 and prior, multiple stack-based buffer overflow vulnerabilities are caused
• CVE-2019-10989 CRITICAL 9.8 UPGRADE In WebAccess/SCADA Versions 8.3.5 and prior, multiple heap-based buffer overflow vulnerabilities are caused by
• CVE-2019-10987 HIGH 8.8 UPGRADE In WebAccess/SCADA Versions 8.3.5 and prior, multiple out-of-bounds write vulnerabilities are caused by a lack
• CVE-2019-10985 CRITICAL 9.1 UPGRADE In WebAccess/SCADA, Versions 8.3.5 and prior, a path traversal vulnerability is caused by a lack of proper val
• CVE-2019-10983 HIGH 7.5 UPGRADE In WebAccess/SCADA Versions 8.3.5 and prior, an out-of-bounds read vulnerability is caused by a lack of proper
• CVE-2018-8845 CRITICAL 9.8 UPGRADE UPGRADE In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashbo
• CVE-2018-8841 HIGH 7.8 UPGRADE UPGRADE In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashbo
• CVE-2018-7505 CRITICAL 9.8 UPGRADE UPGRADE In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashbo
• CVE-2018-7503 HIGH 7.5 UPGRADE UPGRADE In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashbo
• CVE-2018-7501 HIGH 7.5 UPGRADE UPGRADE In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashbo
• CVE-2018-7499 CRITICAL 9.8 UPGRADE UPGRADE In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashbo
• CVE-2018-7497 CRITICAL 9.8 UPGRADE UPGRADE In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashbo
• CVE-2018-7495 HIGH 7.5 UPGRADE UPGRADE In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashbo
• CVE-2018-6911 CRITICAL 9.8 DOWNGRADE The VBWinExec function in Node\AspVBObj.dll in Advantech WebAccess 8.3.0 allows remote attackers to execute ar
• CVE-2018-17910 HIGH 7.8 UPGRADE WebAccess Versions 8.3.2 and prior
• CVE-2018-17908 HIGH 7.8 UPGRADE WebAccess Versions 8.3.2 and prior
• CVE-2018-15707 MEDIUM 5.4 DOWNGRADE Advantech WebAccess 8.3.1 and 8.3.2 are vulnerable to cross-site scripting in the Bwmainleft.asp page
• CVE-2018-15706 MEDIUM 6.5 DOWNGRADE WADashboard API in Advantech WebAccess 8.3.1 and 8.3.2 allows remote authenticated attackers to read any file
• CVE-2018-15705 MEDIUM 6.5 DOWNGRADE WADashboard API in Advantech WebAccess 8.3.1 and 8.3.2 allows remote authenticated attackers to write or overw
• CVE-2018-15704 HIGH 8.8 UPGRADE Advantech WebAccess 8.3.2 and below is vulnerable to a stack buffer overflow vulnerability
• CVE-2018-15703 MEDIUM 6.1 UPGRADE Advantech WebAccess 8.3.2 and below is vulnerable to multiple reflected cross site scripting vulnerabilities
• CVE-2018-14828 HIGH 7.8 UPGRADE Advantech WebAccess 8.3.1 and earlier has an improper privilege management vulnerability, which may allow an a
• CVE-2018-14820 HIGH 7.5 UPGRADE Advantech WebAccess 8.3.1 and earlier has a .dll component that is susceptible to external control of file nam
• CVE-2018-14816 CRITICAL 9.8 UPGRADE Advantech WebAccess 8.3.1 and earlier has several stack-based buffer overflow vulnerabilities that have been i
• CVE-2018-14806 CRITICAL 9.8 UPGRADE Advantech WebAccess 8.3.1 and earlier has a path traversal vulnerability which may allow an attacker to execut
• CVE-2018-10591 MEDIUM 6.1 UPGRADE UPGRADE In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashbo
• CVE-2018-10590 HIGH 7.5 UPGRADE UPGRADE In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashbo
• CVE-2018-10589 CRITICAL 9.8 UPGRADE UPGRADE In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashbo
• CVE-2017-7929 HIGH 7.1 UPGRADE An Absolute Path Traversal issue was discovered in Advantech WebAccess Version 8.1 and prior
• CVE-2017-5175 HIGH 7.8 UPGRADE Advantech WebAccess 8.1 and earlier contains a DLL hijacking vulnerability which may allow an attacker to run
• CVE-2017-5154 CRITICAL 9.8 DOWNGRADE An issue was discovered in Advantech WebAccess Version 8.1
• CVE-2017-5152 CRITICAL 9.1 DOWNGRADE An issue was discovered in Advantech WebAccess Version 8.1
• CVE-2017-16753 HIGH 7.5 UPGRADE An Improper Input Validation issue was discovered in Advantech WebAccess versions prior to 8.3
• CVE-2017-16736 HIGH 7.5 UPGRADE An Unrestricted Upload Of File With Dangerous Type issue was discovered in Advantech WebAccess versions prior
• CVE-2017-16732 MEDIUM 6.5 UPGRADE A use-after-free issue was discovered in Advantech WebAccess versions prior to 8.3
• CVE-2017-16728 HIGH 7.5 UPGRADE An Untrusted Pointer Dereference issue was discovered in Advantech WebAccess versions prior to 8.3
• CVE-2017-16724 CRITICAL 9.8 UPGRADE A Stack-based Buffer Overflow issue was discovered in Advantech WebAccess versions prior to 8.3
• CVE-2017-16720 CRITICAL 9.8 UPGRADE A Path Traversal issue was discovered in WebAccess versions 8.3.2 and earlier
• CVE-2017-16716 CRITICAL 9.8 UPGRADE A SQL Injection issue was discovered in WebAccess versions prior to 8.3
• CVE-2017-14016 MEDIUM 6.3 UPGRADE A Stack-based Buffer Overflow issue was discovered in Advantech WebAccess versions prior to V8.2_20170817
• CVE-2017-12719 HIGH 7.5 UPGRADE An Untrusted Pointer Dereference issue was discovered in Advantech WebAccess versions prior to V8.2_20170817
• CVE-2017-12717 HIGH 7.8 UPGRADE An Uncontrolled Search Path Element issue was discovered in Advantech WebAccess versions prior to V8.2_2017081
• CVE-2017-12713 HIGH 7.8 UPGRADE An Incorrect Permission Assignment for Critical Resource issue was discovered in Advantech WebAccess versions
• CVE-2017-12711 HIGH 7.8 UPGRADE An Incorrect Privilege Assignment issue was discovered in Advantech WebAccess versions prior to V8.2_20170817
• CVE-2017-12710 HIGH 7.5 UPGRADE A SQL Injection issue was discovered in Advantech WebAccess versions prior to V8.2_20170817
• CVE-2017-12708 CRITICAL 9.8 UPGRADE An Improper Restriction Of Operations Within The Bounds Of A Memory Buffer issue was discovered in Advantech W
• CVE-2017-12706 CRITICAL 9.8 UPGRADE A stack-based buffer overflow issue was discovered in Advantech WebAccess versions prior to V8.2_20170817
• CVE-2017-12704 HIGH 8.8 UPGRADE A heap-based buffer overflow issue was discovered in Advantech WebAccess versions prior to V8.2_20170817
• CVE-2017-12702 HIGH 8.8 UPGRADE An Externally Controlled Format String issue was discovered in Advantech WebAccess versions prior to V8.2_2017
• CVE-2017-12698 CRITICAL 9.8 UPGRADE An Improper Authentication issue was discovered in Advantech WebAccess versions prior to V8.2_20170817
• CVE-2016-5817 CRITICAL 9.8 UPGRADE SQL injection vulnerability in news pages in Cargotec Navis WebAccess before 2016-08-10 allows remote attacker
• CVE-2016-5810 MEDIUM 4.9 UPGRADE upAdminPg.asp in Advantech WebAccess before 8.1_20160519 allows remote authenticated administrators to obtain
• CVE-2016-4528 MEDIUM 5.0 UPGRADE Buffer overflow in Advantech WebAccess before 8.1_20160519 allows local users to cause a denial of service via
• CVE-2016-4525 MEDIUM 6.6 UPGRADE Unspecified ActiveX controls in Advantech WebAccess before 8.1_20160519 allow remote authenticated users to ob
• CVE-2016-0860 HIGH 7.5 UPGRADE Buffer overflow in the BwpAlarm subsystem in Advantech WebAccess before 8.1 allows remote attackers to cause a
• CVE-2016-0859 CRITICAL 9.8 UPGRADE Integer overflow in the Kernel service in Advantech WebAccess before 8.1 allows remote attackers to execute ar
• CVE-2016-0858 HIGH 8.1 UPGRADE Race condition in Advantech WebAccess before 8.1 allows remote attackers to execute arbitrary code or cause a
• CVE-2016-0857 CRITICAL 9.8 UPGRADE Multiple heap-based buffer overflows in Advantech WebAccess before 8.1 allow remote attackers to execute arbit
• CVE-2016-0856 CRITICAL 9.8 UPGRADE Multiple stack-based buffer overflows in Advantech WebAccess before 8.1 allow remote attackers to execute arbi
• CVE-2016-0855 HIGH 7.5 UPGRADE Directory traversal vulnerability in Advantech WebAccess before 8.1 allows remote attackers to list arbitrary
• CVE-2016-0854 CRITICAL 9.8 UPGRADE Unrestricted file upload vulnerability in the uploadImageCommon function in the UploadAjaxAction script in the
• CVE-2016-0853 HIGH 7.5 UPGRADE Advantech WebAccess before 8.1 allows remote attackers to obtain sensitive information via crafted input.
• CVE-2016-0852 HIGH 7.5 UPGRADE Advantech WebAccess before 8.1 allows remote attackers to bypass an intended administrative requirement and ob
• CVE-2016-0851 HIGH 7.5 UPGRADE Advantech WebAccess before 8.1 allows remote attackers to cause a denial of service (out-of-bounds memory acce
• CVE-2015-6467 HIGH 8.1 UPGRADE Advantech WebAccess before 8.1 allows remote attackers to execute arbitrary code via vectors involving a brows
• CVE-2015-3948 MEDIUM 5.4 UPGRADE Cross-site scripting (XSS) vulnerability in Advantech WebAccess before 8.1 allows remote authenticated users t
• CVE-2015-3947 HIGH 8.1 UPGRADE SQL injection vulnerability in Advantech WebAccess before 8.1 allows remote authenticated users to execute arb
• CVE-2015-3946 HIGH 8.8 UPGRADE Cross-site request forgery (CSRF) vulnerability in Advantech WebAccess before 8.1 allows remote attackers to h
• CVE-2015-3943 MEDIUM 5.3 UPGRADE Advantech WebAccess before 8.1 allows remote attackers to read sensitive cleartext information about e-mail pr
• CVE-2014-9208 HIGH 10.0 UPGRADE Multiple stack-based buffer overflows in unspecified DLL files in Advantech WebAccess before 8.0.1 allow remot
• CVE-2014-9202 MEDIUM 6.9 DOWNGRADE Multiple stack-based buffer overflows in an unspecified DLL file in Advantech WebAccess before 8.0_20150816 al
• CVE-2014-8388 HIGH 7.2 UPGRADE Stack-based buffer overflow in Advantech WebAccess, formerly BroadWin WebAccess, before 8.0 allows remote atta
• CVE-2014-5449 LOW 2.1 DOWNGRADE MITIGATE Zarafa WebAccess 4.1 and WebApp uses world-readable permissions for the files in their tmp directory, which al

FAQ

How do I fix webaccess vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is webaccess being exploited right now?

None of the tracked webaccess CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which webaccess CVE should I patch first?

CVE-2017-16720 currently ranks highest (69/100): A Path Traversal issue was discovered in WebAccess versions 8.3.2 and earlier.

RSS feed for webaccess · ← Back to latest CVEs