Filtered by vendor Advantech Subscriptions
Total 317 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-3983 1 Advantech 1 Iview 2024-11-21 8.8 High
An authenticated SQL injection vulnerability exists in Advantech iView versions prior to v5.7.4 build 6752. An authenticated remote attacker can bypass checks in com.imc.iview.utils.CUtils.checkSQLInjection() to perform blind SQL injection.
CVE-2023-3256 1 Advantech 1 R-seenet 2024-11-21 8.8 High
Advantech R-SeeNet versions 2.4.22 allows low-level users to access and load the content of local files.
CVE-2023-32628 1 Advantech 1 Webaccess\/scada 2024-11-21 7.2 High
In Advantech WebAccss/SCADA v9.1.3 and prior, there is an arbitrary file upload vulnerability that could allow an attacker to modify the file extension of a certificate file to ASP when uploading it, which can lead to remote code execution.
CVE-2023-32540 1 Advantech 1 Webaccess\/scada 2024-11-21 7.2 High
In Advantech WebAccss/SCADA v9.1.3 and prior, there is an arbitrary file overwrite vulnerability, which could allow an attacker to overwrite any file in the operating system (including system files), inject code into an XLS file, and modify the file extension, which could lead to arbitrary code execution.
CVE-2023-2866 1 Advantech 1 Webaccess 2024-11-21 7.3 High
If an attacker can trick an authenticated user into loading a maliciously crafted .zip file onto Advantech WebAccess version 8.4.5, a web shell could be used to give the attacker full control of the SCADA server.
CVE-2023-2611 1 Advantech 1 R-seenet 2024-11-21 9.8 Critical
Advantech R-SeeNet versions 2.4.22 is installed with a hidden root-level user that is not available in the users list. This hidden user has a password that cannot be changed by users.
CVE-2023-2575 1 Advantech 6 Eki-1521, Eki-1521 Firmware, Eki-1522 and 3 more 2024-11-21 8.8 High
Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21 are affected by a Stack-based Buffer Overflow vulnerability, which can be triggered by authenticated users via a crafted POST request.
CVE-2023-2574 1 Advantech 6 Eki-1521, Eki-1521 Firmware, Eki-1522 and 3 more 2024-11-21 8.8 High
Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21 are affected by an command injection vulnerability in the device name input field, which can be triggered by authenticated users via a crafted POST request.
CVE-2023-2573 1 Advantech 6 Eki-1521, Eki-1521 Firmware, Eki-1522 and 3 more 2024-11-21 8.8 High
Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21 are affected by an command injection vulnerability in the NTP server input field, which can be triggered by authenticated users via a crafted POST request.
CVE-2023-22450 1 Advantech 1 Webaccess\/scada 2024-11-21 7.2 High
In Advantech WebAccss/SCADA v9.1.3 and prior, there is an arbitrary file upload vulnerability that could allow an attacker to upload an ASP script file to a webserver when logged in as manager user, which can lead to arbitrary code execution.
CVE-2023-1437 1 Advantech 1 Webaccess\/scada 2024-11-21 9.8 Critical
All versions prior to 9.1.4 of Advantech WebAccess/SCADA are vulnerable to use of untrusted pointers. The RPC arguments the client sent could contain raw memory pointers for the server to use as-is. This could allow an attacker to gain access to the remote file system and the ability to execute commands and overwrite files.
CVE-2022-3387 1 Advantech 1 R-seenet 2024-11-21 6.5 Medium
Advantech R-SeeNet Versions 2.4.19 and prior are vulnerable to path traversal attacks. An unauthorized attacker could remotely exploit vulnerable PHP code to delete .PDF files.
CVE-2022-3386 1 Advantech 1 R-seenet 2024-11-21 9.8 Critical
Advantech R-SeeNet Versions 2.4.17 and prior are vulnerable to a stack-based buffer overflow. An unauthorized attacker can use an outsized filename to overflow the stack buffer and enable remote code execution.
CVE-2022-3385 1 Advantech 1 R-seenet 2024-11-21 9.8 Critical
Advantech R-SeeNet Versions 2.4.17 and prior are vulnerable to a stack-based buffer overflow. An unauthorized attacker can remotely overflow the stack buffer and enable remote code execution.
CVE-2022-3323 1 Advantech 1 Iview 2024-11-21 7.5 High
An SQL injection vulnerability in Advantech iView 5.7.04.6469. The specific flaw exists within the ConfigurationServlet endpoint, which listens on TCP port 8080 by default. An unauthenticated remote attacker can craft a special column_value parameter in the setConfiguration action to bypass checks in com.imc.iview.utils.CUtils.checkSQLInjection() to perform SQL injection. For example, the attacker can exploit the vulnerability to retrieve the iView admin password.
CVE-2022-2143 1 Advantech 1 Iview 2024-11-21 9.8 Critical
The affected product is vulnerable to two instances of command injection, which may allow an attacker to remotely execute arbitrary code.
CVE-2022-2142 1 Advantech 1 Iview 2024-11-21 8.1 High
The affected product is vulnerable to a SQL injection with high attack complexity, which may allow an unauthorized attacker to disclose information.
CVE-2022-2139 1 Advantech 1 Iview 2024-11-21 6.5 Medium
The affected product is vulnerable to directory traversal, which may allow an attacker to access unauthorized files and execute arbitrary code.
CVE-2022-2138 1 Advantech 1 Iview 2024-11-21 8.2 High
The affected product is vulnerable due to missing authentication, which may allow an attacker to read or modify sensitive data and execute arbitrary code, resulting in a denial-of-service condition.
CVE-2022-2137 1 Advantech 1 Iview 2024-11-21 4.9 Medium
The affected product is vulnerable to two SQL injections that require high privileges for exploitation and may allow an unauthorized attacker to disclose information