Skip to content
OpenAdvisories
Critical ICSA-16-014-01 15 CVEs

Advantech WebAccess Vulnerabilities

Published Oct 17, 2016 · Updated Jun 9, 2025 · Revision 2

Vendor: Advantech Product: WebAccess

Vulnerabilities 15

  • Unscored —
    CVE-2015-3943

    Advantech WebAccess before 8.1 allows remote attackers to read sensitive cleartext information about e-mail project acc…

  • Unscored —
    CVE-2015-3946

    Cross-site request forgery (CSRF) vulnerability in Advantech WebAccess before 8.1 allows remote attackers to hijack the…

  • Unscored —
    CVE-2015-3947

    SQL injection vulnerability in Advantech WebAccess before 8.1 allows remote authenticated users to execute arbitrary SQ…

  • Unscored —
    CVE-2015-3948

    Cross-site scripting (XSS) vulnerability in Advantech WebAccess before 8.1 allows remote authenticated users to inject …

  • Unscored —
    CVE-2015-6467

    Advantech WebAccess before 8.1 allows remote attackers to execute arbitrary code via vectors involving a browser plugin.

  • Unscored —
    CVE-2016-0851

    Advantech WebAccess before 8.1 allows remote attackers to cause a denial of service (out-of-bounds memory access) via u…

  • Unscored —
    CVE-2016-0852

    Advantech WebAccess before 8.1 allows remote attackers to bypass an intended administrative requirement and obtain file…

  • Unscored —
    CVE-2016-0853

    Advantech WebAccess before 8.1 allows remote attackers to obtain sensitive information via crafted input.

  • Unscored —
    CVE-2016-0854 Public exploit EPSS 77%

    Unrestricted file upload vulnerability in the uploadImageCommon function in the UploadAjaxAction script in the WebAcces…

  • Unscored —
    CVE-2016-0855

    Directory traversal vulnerability in Advantech WebAccess before 8.1 allows remote attackers to list arbitrary virtual-d…

  • Unscored —
    CVE-2016-0856 EPSS 17%

    Multiple stack-based buffer overflows in Advantech WebAccess before 8.1 allow remote attackers to execute arbitrary cod…

  • Unscored —
    CVE-2016-0857 EPSS 28%

    Multiple heap-based buffer overflows in Advantech WebAccess before 8.1 allow remote attackers to execute arbitrary code…

  • Unscored —
    CVE-2016-0858

    Race condition in Advantech WebAccess before 8.1 allows remote attackers to execute arbitrary code or cause a denial of…

  • Unscored —
    CVE-2016-0859

    Integer overflow in the Kernel service in Advantech WebAccess before 8.1 allows remote attackers to execute arbitrary c…

  • Unscored —
    CVE-2016-0860

    Buffer overflow in the BwpAlarm subsystem in Advantech WebAccess before 8.1 allows remote attackers to cause a denial o…

Revision history

  1. #2

    Advisory converted into a CSAF

  2. #1

    Initial Publication

References