| CVE-2020-12002 | 严重9.8 | Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple stack-based buffer overflow vulnerabilities exist caused by a lack of proper validation of the length of user-supplied data, which may allow remote code execution. | 08/05/2020 |
| CVE-2020-10638 | 严重9.8 | Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple heap-based buffer overflow vulnerabilities exist caused by a lack of proper validation of the length of user-supplied data, which may allow remote code execution. | 08/05/2020 |
| CVE-2020-10631 | 严重9.8 | An attacker could use a specially crafted URL to delete or read files outside the WebAccess/NMS's (versions prior to 3.0.2) control. | 09/04/2020 |
| CVE-2020-10629 | 高危7.5 | WebAccess/NMS (versions prior to 3.0.2) does not sanitize XML input. Specially crafted XML input could allow an attacker to read sensitive files. | 09/04/2020 |
| CVE-2020-10625 | 严重9.8 | WebAccess/NMS (versions prior to 3.0.2) allows an unauthenticated remote user to create a new admin account. | 09/04/2020 |
| CVE-2020-10623 | 中危6.5 | Multiple vulnerabilities could allow an attacker with low privileges to perform SQL injection on WebAccess/NMS (versions prior to 3.0.2) to gain access to sensitive information. | 09/04/2020 |
| CVE-2020-10619 | 严重9.1 | An attacker could use a specially crafted URL to delete files outside the WebAccess/NMS's (versions prior to 3.0.2) control. | 09/04/2020 |
| CVE-2020-10617 | 高危7.5 | There are multiple ways an unauthenticated attacker could perform SQL injection on WebAccess/NMS (versions prior to 3.0.2) to gain access to sensitive information. | 09/04/2020 |
| CVE-2020-10603 | 高危8.8 | WebAccess/NMS (versions prior to 3.0.2) does not properly sanitize user input and may allow an attacker to inject system commands remotely. | 09/04/2020 |
| CVE-2020-10621 | 严重9.8 | Multiple issues exist that allow files to be uploaded and executed on the WebAccess/NMS (versions prior to 3.0.2). | 09/04/2020 |
| CVE-2019-3942 | 高危7.5 | Advantech WebAccess 8.3.4 does not properly restrict an RPC call that allows unauthenticated, remote users to read files. An attacker can use this vulnerability to recover the administrator password. | 01/04/2020 |
| CVE-2020-10607 | 高危8.8 | In Advantech WebAccess, Versions 8.4.2 and prior. A stack-based buffer overflow vulnerability caused by a lack of proper validation of the length of user-supplied data may allow remote code execution. | 27/03/2020 |
| CVE-2019-18257 | 严重9.8 | In Advantech DiagAnywhere Server, Versions 3.07.11 and prior, multiple stack-based buffer overflow vulnerabilities exist in the file transfer service listening on the TCP port. Successful exploitation could allow an unauthenticated attacker to execute arbitrary code with the privileges of the user running DiagAnywhere | 17/12/2019 |
| CVE-2019-3951 | 严重9.8 | Advantech WebAccess before 8.4.3 allows unauthenticated remote attackers to execute arbitrary code or cause a denial of service (memory corruption) due to a stack-based buffer overflow when handling IOCTL 70533 RPC messages. | 12/12/2019 |
| CVE-2019-18229 | 中危6.5 | Advantech WISE-PaaS/RMM, Versions 3.3.29 and prior. Lack of sanitization of user-supplied input cause SQL injection vulnerabilities. An attacker can leverage these vulnerabilities to disclose information. | 31/10/2019 |
| CVE-2019-18227 | 高危7.5 | Advantech WISE-PaaS/RMM, Versions 3.3.29 and prior. XXE vulnerabilities exist that may allow disclosure of sensitive data. | 31/10/2019 |
| CVE-2019-13551 | 严重9.8 | Advantech WISE-PaaS/RMM, Versions 3.3.29 and prior. Path traversal vulnerabilities are caused by a lack of proper validation of a user-supplied path prior to use in file operations. An attacker can leverage these vulnerabilities to remotely execute code while posing as an administrator. | 31/10/2019 |
| CVE-2019-13547 | 严重9.8 | Advantech WISE-PaaS/RMM, Versions 3.3.29 and prior. There is an unsecured function that allows anyone who can access the IP address to use the function without authentication. | 31/10/2019 |
| CVE-2019-16901 | 高危7.5 | Advantech WebAccess/HMI Designer 2.1.9.31 has Exception Handler Chain corruption starting at Unknown Symbol @ 0x0000000000000000 called from ntdll!RtlRaiseStatus+0x00000000000000b4. | 26/09/2019 |
| CVE-2019-16900 | 高危7.5 | Advantech WebAccess/HMI Designer 2.1.9.31 has a User Mode Write AV starting at MSVCR90!memcpy+0x000000000000015c. | 26/09/2019 |